ASF subversion and git services commented on CB-14145:

Commit d3e6a18f2c41b78f23f7aaa2172d4db56d899e2b in cordova-browser's branch 
refs/heads/5.0.x from Christopher J. Brody
[ https://gitbox.apache.org/repos/asf?p=cordova-browser.git;h=d3e6a18 ]

CB-14145 npm audit fix, pinned in 5.0.x only

- cordova-common@2.2.5
- cordova-serve@2.0.1

> Resolve npm audit issues
> ------------------------
>                 Key: CB-14145
>                 URL: https://issues.apache.org/jira/browse/CB-14145
>             Project: Apache Cordova
>          Issue Type: Bug
>          Components: cordova-android, cordova-app-hello-world, 
> cordova-browser, cordova-cli, cordova-coho, cordova-common, cordova-ios, 
> cordova-js, cordova-lib, cordova-osx, cordova-plugman, cordova-windows
>            Reporter: Chris Brody
>            Assignee: Chris Brody
>            Priority: Major
> From private discussions I discovered that running {{npm audit}} on a number 
> of components would report dependencies with security issues. While we could 
> not see any {{npm audit}} issues that may affect applications built using 
> Cordova I think it is extremely important to resolve these issues as soon as 
> possible. Most affect devDependencies used for testing of Cordova itself; a 
> minority seem to affect Cordova scripts that may be run by Cordova 
> application developers. Better safe than sorry!
> I would like to resolve this issue as follows:
> * patch release of common library components such as {{cordova-common}}, 
> {{cordova-lib}}, etc. (fixed in minor release branch)
> * patch or minor release of other affected components such as CLI, Cordova 
> platform implementations, major plugins, etc. (expected to be fixed in minor 
> release branch; do not want to pollute the master branch with extra reverts, 
> updated node_modules committed, etc.)
> * {{npm audit}} issues resolved in master branch for next major release, 
> which should NOT be shipped with any {{npm audit}} issues lurking
> * {{npm audit}} step added to CI for both patch release and next major release

This message was sent by Atlassian JIRA

To unsubscribe, e-mail: issues-unsubscr...@cordova.apache.org
For additional commands, e-mail: issues-h...@cordova.apache.org

Reply via email to