Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump cheerio to @1.0.0-rc.11 #2561

Draft
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

vinodkumarsharma276
Copy link

Due to recent security vulnerability in nth-checkv1.2.0 which is fetched transitively from enzyme --> cheerio --> css-select --> .... --> nth-checkv1.2.0.

[email protected] removes dependency of css-select which ultimately removes dependency of nth-check

Due to recent security vulnerability in nth-checkv1.2.0 which is fetched transitively from enzyme --> cheerio --> css-select --> .... --> nth-checkv1.2.0.

[email protected] removes dependency of css-select which ultimately removes dependency of nth-check
@vinodkumarsharma276
Copy link
Author

vinodkumarsharma276 commented Jun 13, 2022

Hi @ljharb / @lelandrichardson @koba04 @nfcampos ,
Can someone take a look at this PR and approve. This will fix security vulnerability with [email protected] which is downloaded transitively using enzyme.

@codecov
Copy link

codecov bot commented Jun 13, 2022

Codecov Report

Merging #2561 (6c63667) into master (3d286a4) will decrease coverage by 1.68%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##           master    #2561      +/-   ##
==========================================
- Coverage   96.31%   94.62%   -1.69%     
==========================================
  Files          49       32      -17     
  Lines        4207     2717    -1490     
  Branches     1130      777     -353     
==========================================
- Hits         4052     2571    -1481     
+ Misses        155      146       -9     
Impacted Files Coverage Δ
...enzyme-adapter-utils/src/wrapWithSimpleWrapper.jsx 61.11% <0.00%> (-38.89%) ⬇️
packages/enzyme/src/EnzymeAdapter.js 75.00% <0.00%> (-25.00%) ⬇️
...ges/enzyme-adapter-react-16/src/detectFiberTags.js 85.24% <0.00%> (-8.20%) ⬇️
packages/enzyme/src/ShallowWrapper.js 94.86% <0.00%> (-4.26%) ⬇️
...enzyme-adapter-react-16/src/ReactSixteenAdapter.js 93.73% <0.00%> (-1.73%) ⬇️
packages/enzyme/src/RSTTraversal.js 96.36% <0.00%> (-0.91%) ⬇️
packages/enzyme/src/ReactWrapper.js 99.27% <0.00%> (-0.25%) ⬇️
packages/enzyme-adapter-react-14/src/index.js
packages/enzyme-adapter-react-13/src/index.js
packages/enzyme-adapter-react-15.4/src/index.js
... and 14 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 3d286a4...6c63667. Read the comment docs.

@ljharb
Copy link
Member

ljharb commented Jun 13, 2022

It's worth noting that this is not actually a vulnerability, it's a false positive, at least for enzyme's use case.

@@ -39,7 +39,7 @@
"license": "MIT",
"dependencies": {
"array.prototype.flat": "^1.2.4",
"cheerio": "=1.0.0-rc.3",
"cheerio": "=1.0.0-rc.11",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"cheerio": "=1.0.0-rc.11",
"cheerio": "^1.0.0-rc.11",

i suspect this will break tests, which is why it's pinned to rc3.

@ljharb ljharb marked this pull request as draft June 13, 2022 17:27
@ChristopherChudzicki
Copy link

ChristopherChudzicki commented Jun 17, 2022

FYI: People (me included!) have been having problems with cheerio 1.0.0-rc.11 see ... cheeriojs/cheerio#2545. It's not clear to me whether this is actually a cheerio issue, or something a bit wonky with mine and others webpack/babel configs.

I mention it here because I, like others in that thread, encountered it through the dependency from enzyme.

@ljharb ljharb force-pushed the master branch 3 times, most recently from 43eb75e to 39e6b1f Compare November 3, 2022 21:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants