Skip to content

Fix vulnerabilities as of 2025-04-08 #352

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tung2744 merged 7 commits into from
Apr 9, 2025
Merged

Fix vulnerabilities as of 2025-04-08 #352

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
18bb408
Fix vuln in ./package-lock.json
louischan-oursky Apr 8, 2025
144e26a
Fix vuln in ./example/reactnative/yarn.lock
louischan-oursky Apr 8, 2025
b47b154
Fix vuln in ./website/package-lock.json
louischan-oursky Apr 8, 2025
5017a62
Fix vuln in ./example/capacitor/package-lock.json
louischan-oursky Apr 8, 2025
a7711a6
Set up bundler-audit
louischan-oursky Apr 8, 2025
31ae862
Fix vuln in ./Gemfile.lock
louischan-oursky Apr 8, 2025
2900387
Only build apps when it is a push event
louischan-oursky Apr 8, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions .github/workflows/ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ jobs:
- uses: ruby/setup-ruby@v1
with:
bundler-cache: true
- run: make ruby-audit
Copy link
Copy Markdown
Collaborator

@tung2744 tung2744 Apr 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So are we going to remove this step?

Copy link
Copy Markdown
Contributor Author

@louischan-oursky louischan-oursky Apr 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No. Fixing vulnerabilities in gems are still needed.

Copy link
Copy Markdown
Collaborator

@tung2744 tung2744 Apr 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, but I believe it should not block ci because it is development dependencies?
Anyway let me merge this first.

Copy link
Copy Markdown
Member

@rickmak rickmak Apr 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It will be very difficult to separate the development dependencies that might generate code that to be used in production. for example program used in go generate might have CVE that generate faulty code. So from compliance perspective, we will cover the dev dependencies.

The same logic follow, developer machine is in the compliance coverage too.

- run: sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer
- run: npm ci
- run: npm ci
Expand Down Expand Up @@ -111,7 +112,7 @@ jobs:
- run: make capacitor-build-unsigned-aab

react_native_ios:
if: ${{ github.repository == 'authgear/authgear-sdk-js' }}
if: ${{ github.repository == 'authgear/authgear-sdk-js' && github.event_name == 'push' }}
needs: test
# When we change the runner image, the ruby version will change too.
# We need to update .tool-versions to make them the same.
Expand Down Expand Up @@ -145,7 +146,7 @@ jobs:
run: make react-native-upload-ios-app

react_native_android:
if: ${{ github.repository == 'authgear/authgear-sdk-js' }}
if: ${{ github.repository == 'authgear/authgear-sdk-js' && github.event_name == 'push' }}
needs: test
# When we change the runner image, the available Android build tools versions will also change.
# We need to update build.gradle too.
Expand Down Expand Up @@ -181,7 +182,7 @@ jobs:
make react-native-upload-aab

capacitor_ios:
if: ${{ github.repository == 'authgear/authgear-sdk-js' }}
if: ${{ github.repository == 'authgear/authgear-sdk-js' && github.event_name == 'push' }}
needs: test
runs-on: macos-14
steps:
Expand Down Expand Up @@ -213,7 +214,7 @@ jobs:
run: make capacitor-upload-ios-app

capacitor_android:
if: ${{ github.repository == 'authgear/authgear-sdk-js' }}
if: ${{ github.repository == 'authgear/authgear-sdk-js' && github.event_name == 'push' }}
needs: test
runs-on: macos-14
steps:
Expand Down
1 change: 1 addition & 0 deletions Gemfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,5 +5,6 @@ source "https://rubygems.org"
# https://github.com/actions/runner-images/issues/11345
ruby "~> 3.3"

gem "bundler-audit", "~> 0.9.2"
gem "cocoapods", "~> 1.16"
gem "fastlane", "~> 2.227"
7 changes: 6 additions & 1 deletion Gemfile.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,9 @@ GEM
base64 (0.2.0)
benchmark (0.4.0)
bigdecimal (3.1.9)
bundler-audit (0.9.2)
bundler (>= 1.2.0, < 3)
thor (~> 1.0)
claide (1.1.0)
cocoapods (1.16.2)
addressable (~> 2.8)
Expand Down Expand Up @@ -231,7 +234,7 @@ GEM
i18n (1.14.7)
concurrent-ruby (~> 1.0)
jmespath (1.6.2)
json (2.10.1)
json (2.10.2)
jwt (2.10.1)
base64
logger (1.6.6)
Expand Down Expand Up @@ -276,6 +279,7 @@ GEM
terminal-notifier (2.0.0)
terminal-table (3.0.2)
unicode-display_width (>= 1.1.1, < 3)
thor (1.3.2)
trailblazer-option (0.1.2)
tty-cursor (0.7.1)
tty-screen (0.8.2)
Expand Down Expand Up @@ -314,6 +318,7 @@ PLATFORMS
x86_64-linux-musl

DEPENDENCIES
bundler-audit (~> 0.9.2)
cocoapods (~> 1.16)
fastlane (~> 2.227)

Expand Down
4 changes: 4 additions & 0 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,10 @@ build-image:
push-image:
docker push $(IMAGE)

.PHONY: ruby-audit
ruby-audit:
bundle exec bundler-audit check --update

.PHONY: clean
clean:
rm -rf ./build
Expand Down
6 changes: 3 additions & 3 deletions example/capacitor/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2,397 changes: 1,013 additions & 1,384 deletions example/reactnative/yarn.lock
View file
Open in desktop

Large diffs are not rendered by default.

7 changes: 4 additions & 3 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

14 changes: 8 additions & 6 deletions website/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.