From 1401985eb1a64e3b3bf072cf81f6b89c12e6bc93 Mon Sep 17 00:00:00 2001 From: Mike Lewis Date: Thu, 29 Jul 2021 10:14:51 +0100 Subject: [PATCH 1/3] Update version of ws in yarn.lock to fix Snyk error Signed-off-by: Mike Lewis --- yarn.lock | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/yarn.lock b/yarn.lock index d0dfbe3c0f..661daf4126 100644 --- a/yarn.lock +++ b/yarn.lock @@ -26572,9 +26572,9 @@ ws@7.4.5: integrity sha512-xzyu3hFvomRfXKH8vOFMU3OguG6oOvhXMo3xsGy3xWExqaM2dxBbVxuD99O7m3ZUFMvvscsZDqxfgMaRr/Nr1g== ws@^5.2.0: - version "5.2.2" - resolved "https://registry.npmjs.org/ws/-/ws-5.2.2.tgz#dffef14866b8e8dc9133582514d1befaf96e980f" - integrity sha512-jaHFD6PFv6UgoIVda6qZllptQsMlDEJkTQcybzzXDYM1XO9Y8em691FGMPmM46WGyLU4z9KMgQN+qrux/nhlHA== + version "5.2.3" + resolved "https://registry.npmjs.org/ws/-/ws-5.2.3.tgz#05541053414921bc29c63bee14b8b0dd50b07b3d" + integrity sha512-jZArVERrMsKUatIdnLzqvcfydI85dvd/Fp1u/VOpfdDWQ4c9qWXe+VIeAbQ5FrDwciAkr+lzofXLz3Kuf26AOA== dependencies: async-limiter "~1.0.0" @@ -26584,9 +26584,9 @@ ws@^5.2.0: integrity sha512-6ezXvzOZupqKj4jUqbQ9tXuJNo+BR2gU8fFRk3XCP3e0G6WT414u5ELe6Y0vtp7kmSJ3F7YWObSNr1ESsgi4vw== ws@^6.1.2, ws@^6.2.1: - version "6.2.1" - resolved "https://registry.npmjs.org/ws/-/ws-6.2.1.tgz#442fdf0a47ed64f59b6a5d8ff130f4748ed524fb" - integrity sha512-GIyAXC2cB7LjvpgMt9EKS2ldqr0MTrORaleiOno6TweZ6r3TKtoFQWay/2PceJ3RuBasOHzXNn5Lrw1X0bEjqA== + version "6.2.2" + resolved "https://registry.npmjs.org/ws/-/ws-6.2.2.tgz#dd5cdbd57a9979916097652d78f1cc5faea0c32e" + integrity sha512-zmhltoSR8u1cnDsD43TX59mzoMZsLKqUweyYBAIvTngR3shc0W6aOZylZmq/7hqyVxPdi+5Ud2QInblgyE72fw== dependencies: async-limiter "~1.0.0" From b1369cfa93f749dc00d8dd91af720f060c1001d1 Mon Sep 17 00:00:00 2001 From: Mike Lewis Date: Thu, 29 Jul 2021 12:08:30 +0100 Subject: [PATCH 2/3] Use resolution to force ws@7.4.6 inside url-loader Fixes Snyk warning by avoiding v7.4.5 of ws. https://snyk.io/vuln/SNYK-JS-WS-1296835 Signed-off-by: Mike Lewis --- package.json | 1 + yarn.lock | 8 ++++---- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/package.json b/package.json index 93517d3374..04177f798e 100644 --- a/package.json +++ b/package.json @@ -41,6 +41,7 @@ ] }, "resolutions": { + "**/@graphql-tools/url-loader/**/ws": "^7.4.6", "**/@roadiehq/**/@backstage/core": "*", "**/@roadiehq/**/@backstage/plugin-catalog": "*", "**/@roadiehq/**/@backstage/catalog-model": "*", diff --git a/yarn.lock b/yarn.lock index 661daf4126..981907d84d 100644 --- a/yarn.lock +++ b/yarn.lock @@ -26566,10 +26566,10 @@ write-pkg@^4.0.0: type-fest "^0.4.1" write-json-file "^3.2.0" -ws@7.4.5: - version "7.4.5" - resolved "https://registry.npmjs.org/ws/-/ws-7.4.5.tgz#a484dd851e9beb6fdb420027e3885e8ce48986c1" - integrity sha512-xzyu3hFvomRfXKH8vOFMU3OguG6oOvhXMo3xsGy3xWExqaM2dxBbVxuD99O7m3ZUFMvvscsZDqxfgMaRr/Nr1g== +ws@7.4.5, ws@^7.4.6: + version "7.5.3" + resolved "https://registry.npmjs.org/ws/-/ws-7.5.3.tgz#160835b63c7d97bfab418fc1b8a9fced2ac01a74" + integrity sha512-kQ/dHIzuLrS6Je9+uv81ueZomEwH0qVYstcAQ4/Z93K8zeko9gtAbttJWzoC5ukqXY1PpoouV3+VSOqEAFt5wg== ws@^5.2.0: version "5.2.3" From 6fa92ba6910da4cf751991d11591080e835b079d Mon Sep 17 00:00:00 2001 From: Mike Lewis Date: Thu, 29 Jul 2021 14:10:20 +0100 Subject: [PATCH 3/3] Switch to referencing @graphql-codegen/cli in ws resolution Signed-off-by: Mike Lewis --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 04177f798e..ea1cf0c9b4 100644 --- a/package.json +++ b/package.json @@ -41,7 +41,7 @@ ] }, "resolutions": { - "**/@graphql-tools/url-loader/**/ws": "^7.4.6", + "**/@graphql-codegen/cli/**/ws": "^7.4.6", "**/@roadiehq/**/@backstage/core": "*", "**/@roadiehq/**/@backstage/plugin-catalog": "*", "**/@roadiehq/**/@backstage/catalog-model": "*",