Skip to content

UI: Add npm-force-resolutions. Replace ansi-html with ansi-html-community. Upgrade some other libs

Nikolay Samokhvalov requested to merge nik-ui-upgrade-ansi-html-lib into master

Description

Start using npm-force-resolutions and force upgrades for some libraries that are known to have vulnerabilities.

ansi-html

ansi-html is abandoned and unsupported, old/final version 0.0.7 has security issues (CVE-2021-23424), this MR is to switch to ansi-html-community 0.0.8

Recipe: https://stackoverflow.com/questions/69548370/how-to-override-a-nested-npm-sub-dependency-with-a-different-package-altogether/69591894#69591894

Issue reported in: https://github.com/postgres-ai/database-lab-engine/issues/37

Other upgrades

Force use of specific versions for various libraries to mitigate various CVEs:

Checklist

  • MR description has been reviewed
  • MR changes are functionally tested
  • MR does NOT have text changes OR there are text changes and they have been reviewed
  • MR does NOT have API/CLI changes OR there are API/CLI changes and they have been reviewed
  • MR does NOT have UI changes OR there are UI changes and they have been reviewed
Edited by Nikolay Samokhvalov

Merge request reports