Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): replace dependencies that use vulnerable lodash.template #48

Merged
merged 2 commits into from
Jun 25, 2024

Conversation

barronhagerman
Copy link
Contributor

Summary

This removes the use of lodash.template by replacing the following dependencies:

  • Replaces gulp-cssmin with gulp-cleancss
    • The resulting CSS in dist/css/style.min.css is slightly different, but it seems to simply involve reorganization of the CSS
  • Replaces gulp-header with gulp-prepend

Addresses https://github.com/Banno/jha-design/security/dependabot/79

How to test

  1. Check out master and run a dev server from the dist/ directory, such as npx http-server -p 3000
  2. Load the web page
  3. Check out this branch, repeat steps 1 and 2, and compare the CSS

@barronhagerman barronhagerman added dependencies Pull requests that update a dependency file security labels Jun 17, 2024
@barronhagerman barronhagerman requested a review from a team as a code owner June 17, 2024 21:17
@jrobinson01 jrobinson01 merged commit e7e9037 into master Jun 25, 2024
2 checks passed
@jrobinson01 jrobinson01 deleted the vuln/79-lodash branch June 25, 2024 18:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file security
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants