Skip to content

BB2-4988: Updates for security#166

Merged
JamesDemeryNava merged 1 commit into
mainfrom
jamesdemery/bb2-4988-security-updates
Jul 21, 2026
Merged

BB2-4988: Updates for security#166
JamesDemeryNava merged 1 commit into
mainfrom
jamesdemery/bb2-4988-security-updates

Conversation

@JamesDemeryNava

Copy link
Copy Markdown
Contributor

JIRA Ticket:
BB2-4988

What Does This PR Do?

Updates js-yaml, the version of Node, and the version of libcap2 that are being used in the project to address security vulnerabilities.

What Should Reviewers Watch For?

Validation

If you're reviewing this PR, please check for these things in particular:

  • Pull down the branch, cd into client directory, run yarn list js-yaml.
    • Confirm you see js-yaml@4.3.0
  • Run docker-compose up -d
  • Go through a local auth flow, confirm it works
  • Run docker ps, then docker exec -it {{client_container_id}} /bin/bash
  • Run dpkg -l | grep libcap2, confirm you see 1:2.75-10+deb13u1+b1

@sb-DarenDean

Copy link
Copy Markdown

G2G! Have another eng review and approve. Thanks!

@bwang-icf bwang-icf left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Was able to do all the verification. Thanks for doing this! What exactly were your update steps? It seems like you had to do more than just running an npm update. I will still approve but am just curious

@JamesDemeryNava

Copy link
Copy Markdown
Contributor Author

Was able to do all the verification. Thanks for doing this! What exactly were your update steps? It seems like you had to do more than just running an npm update. I will still approve but am just curious

I added js-yaml to the to the resolutions section of package.json. After running an npm install and then npm ls js-yaml, I saw that the version hadn't updated to 4.3.0, because of mistmatches with eslint and vite-plugin-svgr. So I upgraded eslint and vite-plugin-svgr as well to make sure that js-yaml would update correctly, and the version updates for those two seemed to do it!

@JamesDemeryNava
JamesDemeryNava merged commit d509f30 into main Jul 21, 2026
3 checks passed
@JamesDemeryNava
JamesDemeryNava deleted the jamesdemery/bb2-4988-security-updates branch July 21, 2026 10:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants