Address Security Vulnerability

[armahillo]

A security vulnerability was discovered by Github:

https://github.com/rubyforgood/diaper/network/alerts

It looks like webpacker needs to be updated.

[Nirvikalpa108]

Hi @armahillo would you mind providing some more detail please? @chaserx and I checked the gemfile lock with Rubygems.org and they're the same version. Would you be able to provide more clarity please?

[armahillo]

@Nirvikalpa108 Absolutely!

If you click on the link in that first post, it'll list out the Gems that have known vulnerabilities. The way we've addressed this in the past is by doing a bundle update foo where foo is the gem that has a vulnerability.

It looks like 2 of the security alerts are for Javascript packages, maintained by yarn. I'm not 100% sure how to update those, I would presume it's something like yarn update or something similar.

When this is merged to master, the security alert should go away. When that happens, this can be closed.

Let me know if you need further clarification! :)

[Nirvikalpa108]

Thanks @armahillo. I'm sorry if this is a silly question, but would you mind explaining where I would be able to see the security alert myself so that once I update the Javascript packages, I can check I have been successful? The Github link in the first post takes me to a 404.
Thank you so much in advance 😃

[chaserx]

I think only owners can see the dependency alerts.

[trevordocherty]

@armahillo Can I get access so I can see the first post about the alerts. Thank you!

[boscomonkey]

@armahillo Can I get access so I can see the first post about the alerts. Thank you!

You don't need access to this repo to see the alerts. You can see your own version with the following steps:

1. Fork this repo into your account. For example: after I forked, my version of the repo is now available at https://github.com/boscomonkey/diaper
   • In your case - https://github.com/trevordocherty/diaper
2. Enable Vulnerability Alerts under https://github.com/boscomonkey/diaper/settings
   • In your case - https://github.com/trevordocherty/diaper/settings
3. Alerts will now be available under https://github.com/boscomonkey/diaper/network/alerts - you may have to wait a little bit for the analysis to complete
   • In your case - https://github.com/trevordocherty/diaper/network/alerts

Your Vulnerability Alerts page will look something like this: