Skip to content

[Snyk] Fix for 1 vulnerabilities #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Eric-Guo wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk] Fix for 1 vulnerabilities #8

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,9 +20,9 @@
"@selectize/selectize": "^0.15.2",
"babel-loader": "^8.4.1",
"chart.js": "^3.9.1",
"compression-webpack-plugin": "^9.2.0",
"compression-webpack-plugin": "^12.0.0",
"css-loader": "^6.11.0",
"css-minimizer-webpack-plugin": "^4.2.2",
"css-minimizer-webpack-plugin": "^8.0.0",
Comment on lines +23 to +25

@chatgpt-codex-connector chatgpt-codex-connector Bot Mar 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Regenerate lockfile after bumping webpack plugins

This commit updates compression-webpack-plugin and css-minimizer-webpack-plugin in package.json but does not update pnpm-lock.yaml, which still pins the old specs (^9.2.0 and ^4.2.2 at pnpm-lock.yaml:66-74). In this repo, CI installs JS deps with pnpm install --frozen-lockfile (.github/workflows/rubyonrails.yml:54), so the workflow will fail once package.json and lockfile diverge. Please regenerate and commit pnpm-lock.yaml with these dependency changes.

Useful? React with 👍 / 👎.

Comment on lines +23 to +25

Copilot AI Mar 30, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These dependency bumps change package.json but the repo/CI uses pnpm install --frozen-lockfile, so leaving pnpm-lock.yaml unchanged will make installs fail and may prevent the vuln remediation from actually being applied. Please regenerate and commit pnpm-lock.yaml for these new versions (e.g., run pnpm install).

Copilot uses AI. Check for mistakes.
Comment on lines +23 to +25

Copilot AI Mar 30, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR description refers to "yarn dependencies" / updating yarn.lock, but this project declares packageManager: pnpm@... and uses pnpm-lock.yaml in CI. Consider adjusting the Snyk project/package manager settings or updating the PR text so it matches the actual tooling used here.

Copilot uses AI. Check for mistakes.
"datatables.net": "^1.13.11",
"datatables.net-bs5": "^1.13.11",
"date-fns": "^2.30.0",
Expand Down
Loading