Bump minimist from 1.2.5 to 1.2.7 in /hub-search-proxy#357
Bump minimist from 1.2.5 to 1.2.7 in /hub-search-proxy#357dependabot[bot] wants to merge 2111 commits intomasterfrom
Conversation
Bumps [cypress-commands](https://github.com/Lakitna/cypress-commands) from 1.1.0 to 2.0.1. - [Release notes](https://github.com/Lakitna/cypress-commands/releases) - [Changelog](https://github.com/Lakitna/cypress-commands/blob/develop/CHANGELOG.md) - [Commits](Lakitna/cypress-commands@1.1.0...2.0.1) --- updated-dependencies: - dependency-name: cypress-commands dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>
* generated new components * first version of contact card * changed card title color * fixed elevation * first version of org unit card * first version of document card * moved cards module and components * article simplification * changed mouse pointer on card * minor change to article page * Revert "minor change to article page" This reverts commit 4c66bf8. * case-studys page refactor * fixed width cards, minor article change * changed equipment page * changes to events * changed fundings page * changes to service page * changes to software page * changes to subhubs and standard card * set image height * removed app-cards from featured component * removed old cards components * fixed featured layout * better spacing on featured component * fixed lock icon size * fixed article layout * fixed mobile card width * fixed clickable cards * generated new components * first version of contact card * changed card title color * fixed elevation * first version of org unit card * first version of document card * moved cards module and components * article simplification * changed mouse pointer on card * minor change to article page * Revert "minor change to article page" This reverts commit 4c66bf8. * case-studys page refactor * fixed width cards, minor article change * changed equipment page * changes to events * changed fundings page * changes to service page * changes to software page * changes to subhubs and standard card * set image height * removed app-cards from featured component * removed old cards components * fixed featured layout * better spacing on featured component * fixed lock icon size * fixed article layout * fixed mobile card width * fixed clickable cards * generated new components * first version of contact card * changed card title color * fixed elevation * first version of org unit card * first version of document card * moved cards module and components * article simplification * changed mouse pointer on card * minor change to article page * Revert "minor change to article page" This reverts commit 4c66bf8. * case-studys page refactor * fixed width cards, minor article change * changed equipment page * changes to events * changed fundings page * changes to service page * changes to software page * changes to subhubs and standard card * set image height * removed app-cards from featured component * removed old cards components * fixed featured layout * better spacing on featured component * fixed lock icon size * fixed article layout * fixed mobile card width * fixed clickable cards * generated new components * first version of contact card * changed card title color * fixed elevation * first version of org unit card * first version of document card * moved cards module and components * changed mouse pointer on card * minor change to article page * Revert "minor change to article page" This reverts commit 4c66bf8. * fixed width cards, minor article change * fixed clickable cards * minor fixes * article layout fixes * fixes for case studies layout * more layout fixes * fixed unit tests * fix for equipment table * upgraded e2e test with cypress types, fixed e2e tests * fixed inconsistent bottom margin * mat-icon white on subhub child card * added missing case study references * fixed 3 column layout being too narrow * fixed you-might-be-interested-in id * fixed featured layout * fixed missing funding purpose * fixed body media error * fix nulls error on subhub pages * fixed title underline * Revert "fixed title underline" This reverts commit d92ba98. * fixed subhub child card underline Co-authored-by: Rose McColl <[email protected]>
…ypress-commands-2.0.1
…search-hub-web/cypress-commands-2.0.1 Bump cypress-commands from 1.1.0 to 2.0.1 in /research-hub-web
* initial commit for content graph * added resolver and adjustments, highlight node on hover * update lockfile version * minor fixes for null checks * added auth guard to graph route * first version of node info box * added node highlighting * improved details list and highlighting * first version of graph legend in drawer * layout fixes * layout improvements * renamed graph-legend to graph-filter * added legend, added dev env * added graph link to footer * fixed capitalisation * some fixes for unit tests * more fixes for tests * exclude GraphFilter test for now * added graph API to CSP headers (dev) * renamed graph-container * refactored graph into component * tidy up field order * changed loading behaviour, removed route resolver * fixed canvas width, colour changes * fixed color legend and search box * minor improvements * many UI improvements, added contentful link to env files * updated test and prod environment files with graph api url * some fixes for unit tests * more fixes for unit tests * minor improvements for node details UI * added graph api to csp headers in cloudfront functions * rebuild package-lock.json * added esbuild dep
* Add token references for CI build * Add missing package * Fix npm shrinkwrap issue * Fix wrong org id * Update readme * Update documentation * Add indentation and minor fixes to README * FIx minor heading issue with readme Co-authored-by: Lukas Trombach <[email protected]>
Co-authored-by: rosemcc <[email protected]> Co-authored-by: Lukas Trombach <[email protected]>
* chore: version update * CHORE: update versions * HOTFIX * Chore: version changes Co-authored-by: Rose <[email protected]> Co-authored-by: rosemcc <[email protected]> Co-authored-by: Lukas Trombach <[email protected]> Co-authored-by: Lukas Trombach <[email protected]> Co-authored-by: etan221 <[email protected]>
Change feedback button text
dependabot
bot
added
the
dependencies
* add initial modules and components * update search lambda * update and add new graphQL queries * add capability type to standard card * add components to routes * add capability list * reuse article default banner for capability card for now * add capability display name to pipe * first version of capability page * make tests runnable * add capability page type to search types * add navbar link to subhub * add capability list unit test * make e2e tests runnable * fix unit test * fix unit tests * add capability unit test * decapitalised navbar link * added new card background for capability * add capability e2e tests and fixture * fix capability not showing in search results * fix e2e test * add capability type to content graph * remove navbar link to be added later * fix standard card default image loading * lowercase sign in/out * move support materials to the top * fix unit test * fix navbar e2e test * move contacts to the top * minor fix for standard images * simplify standard card component * add comment explaining image height
update package versions
Bumps [minimist](https://github.com/minimistjs/minimist) from 1.2.5 to 1.2.7. - [Release notes](https://github.com/minimistjs/minimist/releases) - [Changelog](https://github.com/minimistjs/minimist/blob/main/CHANGELOG.md) - [Commits](minimistjs/minimist@v1.2.5...v1.2.7) --- updated-dependencies: - dependency-name: minimist dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
bot
force-pushed
the
dependabot/npm_and_yarn/hub-search-proxy/minimist-1.2.7
branch
from
a0c67c2 to
a85a21e
Compare
lugn621
force-pushed
the
dependabot/npm_and_yarn/hub-search-proxy/minimist-1.2.7
branch
from
a85a21e to
8381c8e
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| name: Run linters | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: Check out Git repository | ||
| uses: actions/checkout@v2 | ||
|
|
||
| - name: Set up Node.js | ||
| uses: actions/setup-node@v1 | ||
| with: | ||
| node-version: 14 | ||
|
|
||
| - name: Install Node.js dependencies | ||
| working-directory: ./research-hub-web | ||
| run: npm ci | ||
|
|
||
| - name: Install Angular CLI | ||
| run: npm install -g @angular/cli | ||
|
|
||
| - name: ng lint | ||
| working-directory: ./research-hub-web | ||
| run: ng lint |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 days ago
To fix the problem, explicitly restrict the GITHUB_TOKEN permissions in the workflow by adding a permissions block that grants only the minimal rights needed. Since this workflow only checks out the code and runs linters, it needs read access to repository contents and no write access.
The best minimal fix without changing existing functionality is to add a workflow‑level permissions block directly under the name: Lint line. This will apply to all jobs (currently only run-linters) and clearly documents that the token is limited. The block should specify contents: read, which is enough for actions/checkout to fetch the repository. No steps need to be changed, and no additional scopes (like pull-requests or issues) are required because the lint job does not interact with GitHub APIs in that way.
Concretely, in .github/workflows/linting.yml, insert:
permissions:
contents: readafter line 1 (name: Lint). No imports or other definitions are needed.
| @@ -1,4 +1,6 @@ | ||
| name: Lint | ||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| # Trigger the workflow on push or pull request, |
| name: Create Sentry Release | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: Check out Git repository | ||
| uses: actions/checkout@v2 | ||
| - name: Get Branch | ||
| id: var | ||
| run: echo ::set-output name=branch::${GITHUB_REF#refs/*/} | ||
| - name: Output Branch | ||
| run: echo ${{ steps.var.outputs.branch }} | ||
| - name: Notify Sentry | ||
| # https://github.com/getsentry/action-release | ||
| uses: getsentry/[email protected] | ||
| env: | ||
| SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} | ||
| SENTRY_ORG: university-of-auckland-7o | ||
| SENTRY_PROJECT: research-hub | ||
| with: | ||
| environment: ${{ steps.var.outputs.branch }} No newline at end of file |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 days ago
In general, the fix is to add an explicit permissions: block that restricts the GITHUB_TOKEN to the minimal access needed. For this workflow, the steps only need to read the repository content (for actions/checkout) and do not show any GitHub write operations, so contents: read at the job (or workflow) level is sufficient and preserves existing behavior while tightening security.
The best fix here is to add a permissions: section under the sentry-release job (indented to the same level as runs-on:) specifying contents: read. No additional imports or dependencies are required, and existing logic remains unchanged. Concretely, in .github/workflows/sentry.yml, modify the sentry-release job definition around line 15–16 to insert:
permissions:
contents: readbetween runs-on: ubuntu-latest and steps:.
| @@ -13,6 +13,8 @@ | ||
| sentry-release: | ||
| name: Create Sentry Release | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
|
|
||
| steps: | ||
| - name: Check out Git repository |
| run: echo ${{ steps.var.outputs.branch }} | ||
| - name: Notify Sentry | ||
| # https://github.com/getsentry/action-release | ||
| uses: getsentry/[email protected] |
Check warning
Code scanning / CodeQL
Unpinned tag for a non-immutable Action in workflow Medium
|
|
||
| module.exports.search = async (event, context) => { | ||
| try { | ||
| console.log(`Received query: ${event.body}`); |
Check warning
Code scanning / CodeQL
Log injection Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 days ago
In general, to fix log injection when logging user input, normalize or sanitize the user-controlled string before logging. For plain-text logs, this typically means removing or replacing newline (\n) and carriage return (\r) characters, and optionally other control characters, and clearly labeling user-provided content in logs.
For this specific case, the simplest fix that does not change existing functionality is to create a sanitized version of event.body specifically for logging, while still using the original event.body for parsing. Right before logging, convert event.body to a string (in case it is not already) and strip out \r and \n using String.prototype.replace. For example:
const safeBodyForLog = String(event.body).replace(/[\r\n]/g, '');
console.log(`Received query: ${safeBodyForLog}`);All subsequent logic (parsing with JSON.parse(event.body) etc.) remains unchanged. No new imports or dependencies are needed; we use standard JavaScript string methods. The change is confined to the logging statement around line 53 in hub-search-proxy/handler.js.
| @@ -50,7 +50,8 @@ | ||
|
|
||
| module.exports.search = async (event, context) => { | ||
| try { | ||
| console.log(`Received query: ${event.body}`); | ||
| const safeBodyForLog = String(event.body).replace(/[\r\n]/g, ''); | ||
| console.log(`Received query: ${safeBodyForLog}`); | ||
| const requestBody = JSON.parse(event.body); | ||
| let queryString = ''; | ||
| let size = 10; |
7 participants
Bumps minimist from 1.2.5 to 1.2.7.
Changelog
Sourced from minimist's changelog.
Commits
c590d75v1.2.70ebf4eb[meta] addauto-changeloge115b63[actions] add reusable workflows01fc23f[meta] addsafe-publish-latestf58745b[eslint] add eslint; rules to enable later are warnings228ae93[Tests] addaudinposttest236f4a0[readme] rename and add badgesab03356[Dev Deps] switch fromcoverttonyc49c5f9f[Dev Deps] updatecovert,tape; remove unnecessarytap783a49b[meta] create FUNDING.yml; addfundingin package.jsonMaintainer changes
This version was pushed to npm by ljharb, a new releaser for minimist since your current version.
You can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.