[ https://issues.apache.org/jira/browse/CB-14145?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16540066#comment-16540066 ]
ASF subversion and git services commented on CB-14145: ------------------------------------------------------ Commit d3e6a18f2c41b78f23f7aaa2172d4db56d899e2b in cordova-browser's branch refs/heads/5.0.x from Christopher J. Brody [ https://gitbox.apache.org/repos/asf?p=cordova-browser.git;h=d3e6a18 ] CB-14145 npm audit fix, pinned in 5.0.x only - cordova-common@2.2.5 - cordova-serve@2.0.1 > Resolve npm audit issues > ------------------------ > > Key: CB-14145 > URL: https://issues.apache.org/jira/browse/CB-14145 > Project: Apache Cordova > Issue Type: Bug > Components: cordova-android, cordova-app-hello-world, > cordova-browser, cordova-cli, cordova-coho, cordova-common, cordova-ios, > cordova-js, cordova-lib, cordova-osx, cordova-plugman, cordova-windows > Reporter: Chris Brody > Assignee: Chris Brody > Priority: Major > > From private discussions I discovered that running {{npm audit}} on a number > of components would report dependencies with security issues. While we could > not see any {{npm audit}} issues that may affect applications built using > Cordova I think it is extremely important to resolve these issues as soon as > possible. Most affect devDependencies used for testing of Cordova itself; a > minority seem to affect Cordova scripts that may be run by Cordova > application developers. Better safe than sorry! > I would like to resolve this issue as follows: > * patch release of common library components such as {{cordova-common}}, > {{cordova-lib}}, etc. (fixed in minor release branch) > * patch or minor release of other affected components such as CLI, Cordova > platform implementations, major plugins, etc. (expected to be fixed in minor > release branch; do not want to pollute the master branch with extra reverts, > updated node_modules committed, etc.) > * {{npm audit}} issues resolved in master branch for next major release, > which should NOT be shipped with any {{npm audit}} issues lurking > * {{npm audit}} step added to CI for both patch release and next major release -- This message was sent by Atlassian JIRA (v7.6.3#76005) --------------------------------------------------------------------- To unsubscribe, e-mail: issues-unsubscr...@cordova.apache.org For additional commands, e-mail: issues-h...@cordova.apache.org