Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix security vulnerability #516

Merged
merged 4 commits into from
Dec 9, 2024
Merged

fix security vulnerability #516

merged 4 commits into from
Dec 9, 2024

Conversation

carlostxm
Copy link
Contributor

This MR upgrades msw to v2 to fix the vulnerability caused by the transitive dependency cookie: https://github.com/cabify/prom-react/security/dependabot/22.

@carlostxm carlostxm self-assigned this Dec 5, 2024
@carlostxm
Copy link
Contributor Author

There is bug in the implementation of mockServer related with matchRequestUrl not been evaluated properly. It's needed to check the property matches to see if the URLs matches, otherwise is just checking the object returned (which is truthy).

If the bug is fixed in main the same three tests fails, so this is a previous bug not related with the msw upgrade.

image

@carlostxm
Copy link
Contributor Author

carlostxm commented Dec 5, 2024

The bug has been fixed in 9c206a4. However, a test started to fail because the previous bug was masking the actual result. I have decided to skip this test, as the fix reveals that this functionality was not working correctly before.

@carlostxm carlostxm changed the title upgrade msw to v2 fix security vulnerability Dec 9, 2024
@carlostxm carlostxm merged commit b58bd79 into main Dec 9, 2024
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

2 participants