Upgrade dependencies to fix security vulnerabilities in ws-manager-bridge#21387
Upgrade dependencies to fix security vulnerabilities in ws-manager-bridge#21387Abuchtela wants to merge 2 commits intogitpod-io:mainfrom
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-BODYPARSER-7926860 - https://snyk.io/vuln/SNYK-JS-COOKIE-8163060 - https://snyk.io/vuln/SNYK-JS-EXPRESS-6474509 - https://snyk.io/vuln/SNYK-JS-EXPRESS-7926867 - https://snyk.io/vuln/SNYK-JS-PATHTOREGEXP-7925106 - https://snyk.io/vuln/SNYK-JS-PATHTOREGEXP-8482416 - https://snyk.io/vuln/SNYK-JS-SEND-7926862 - https://snyk.io/vuln/SNYK-JS-SERVESTATIC-7926865
There was a problem hiding this comment.
Pull request overview
Updates ws-manager-bridge dependencies to address reported security vulnerabilities by bumping the express version.
Changes:
- Upgrade
expressincomponents/ws-manager-bridgefrom^4.17.3to^4.21.2.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "@gitpod/ws-manager": "0.1.5", | ||
| "@gitpod/ws-manager-bridge-api": "0.1.5", | ||
| "express": "^4.17.3", | ||
| "express": "^4.21.2", | ||
| "inversify": "^6.0.1", | ||
| "ioredis": "^5.3.2", |
There was a problem hiding this comment.
ws-manager-bridge uses the workspace yarn lockfile for dependency resolution (see components/ws-manager-bridge/BUILD.yaml yarnLock: ${coreYarnLockBase}/yarn.lock). Bumping express to ^4.21.2 without updating the root yarn.lock (and offline-mirror artifacts, if applicable) will likely break reproducible installs/builds because the lockfile currently pins express@^4.17.3.
Please regenerate and commit the corresponding lockfile changes (and any offline mirror updates) for this new semver range.
Description
Related Issue(s)
Fixes #
How to test
Documentation
Preview status
gitpod:summary
Build Options
Build
Run the build with werft instead of GHA
Run Leeway with
--dont-testPublish
Installer
Add desired feature flags to the end of the line above, space separated
Preview Environment / Integration Tests
If enabled this will build
install/previewIf enabled this will create the environment on GCE infra
Saves cost. Untick this only if you're really sure you need a non-preemtible machine.
Valid options are
all,workspace,webapp,ide,jetbrains,vscode,ssh. If enabled,with-previewandwith-large-vmwill be enabled./hold