Skip to content

Commit

Permalink
clean readme
Browse files Browse the repository at this point in the history
  • Loading branch information
anamontiaga committed May 10, 2024
1 parent a50ec26 commit 8f74986
Showing 1 changed file with 0 additions and 18 deletions.
18 changes: 0 additions & 18 deletions client/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -59,21 +59,3 @@ Check out the [Next.js deployment documentation](https://nextjs.org/docs/deploym

Please, **create a PR** for any improvement or feature you want to add. Try not to commit anything directly on the `main` branch.


[Dependabot's vulnerability security alerts](https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts) are configured in this repository and are displayed to the administrators.

When vulnerabilities are detected, a warning message is displayed at the top of the repository. The list of alerts can be found on the Dependabot alerts page.

Here's a step-by-step guide on how to address vulnerabilities found in production code:

1. Go to the Dependabot alerts page and locate the front-end vulnerability to address
2. Identify if the vulnerability affects production code:
- To do so run `pnpm npm audit --recursive --environment production`
- If the dependency is _not_ listed by this command, then the vulnerability only affects the development code. You can dismiss the alert on GitHub as “Vulnerable code is not actually used” in the top right corner of the vulnerability page.
- If the dependency _is_ listed, follow the steps below.
3. On the vulnerability page, click the “Create Dependabot security update” button
- This will create a Pull Request with a fix for the vulnerability. If GitHub can generate this PR, then you can merge and the security alert will disappear.
- If the vulnerability can't be patched automatically, follow the steps below.
4. If the action fails, then you can semi-automatically update the vulnerable dependency by running `npm_config_yes=true npx pnpm-audit-fix --only prod`
- The tool might also not be able to fix the vulnerability. If so, continue with the steps below.
5. If the action fails, then you will have to manually update the dependencies until the vulnerability is solved

0 comments on commit 8f74986

Please sign in to comment.