Bump ejs from 3.1.6 to 3.1.8 in /research-hub-web#360
Bump ejs from 3.1.6 to 3.1.8 in /research-hub-web#360dependabot[bot] wants to merge 2111 commits intomasterfrom
Conversation
Bumps [cypress-commands](https://github.com/Lakitna/cypress-commands) from 1.1.0 to 2.0.1. - [Release notes](https://github.com/Lakitna/cypress-commands/releases) - [Changelog](https://github.com/Lakitna/cypress-commands/blob/develop/CHANGELOG.md) - [Commits](Lakitna/cypress-commands@1.1.0...2.0.1) --- updated-dependencies: - dependency-name: cypress-commands dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>
* generated new components * first version of contact card * changed card title color * fixed elevation * first version of org unit card * first version of document card * moved cards module and components * article simplification * changed mouse pointer on card * minor change to article page * Revert "minor change to article page" This reverts commit 4c66bf8. * case-studys page refactor * fixed width cards, minor article change * changed equipment page * changes to events * changed fundings page * changes to service page * changes to software page * changes to subhubs and standard card * set image height * removed app-cards from featured component * removed old cards components * fixed featured layout * better spacing on featured component * fixed lock icon size * fixed article layout * fixed mobile card width * fixed clickable cards * generated new components * first version of contact card * changed card title color * fixed elevation * first version of org unit card * first version of document card * moved cards module and components * article simplification * changed mouse pointer on card * minor change to article page * Revert "minor change to article page" This reverts commit 4c66bf8. * case-studys page refactor * fixed width cards, minor article change * changed equipment page * changes to events * changed fundings page * changes to service page * changes to software page * changes to subhubs and standard card * set image height * removed app-cards from featured component * removed old cards components * fixed featured layout * better spacing on featured component * fixed lock icon size * fixed article layout * fixed mobile card width * fixed clickable cards * generated new components * first version of contact card * changed card title color * fixed elevation * first version of org unit card * first version of document card * moved cards module and components * article simplification * changed mouse pointer on card * minor change to article page * Revert "minor change to article page" This reverts commit 4c66bf8. * case-studys page refactor * fixed width cards, minor article change * changed equipment page * changes to events * changed fundings page * changes to service page * changes to software page * changes to subhubs and standard card * set image height * removed app-cards from featured component * removed old cards components * fixed featured layout * better spacing on featured component * fixed lock icon size * fixed article layout * fixed mobile card width * fixed clickable cards * generated new components * first version of contact card * changed card title color * fixed elevation * first version of org unit card * first version of document card * moved cards module and components * changed mouse pointer on card * minor change to article page * Revert "minor change to article page" This reverts commit 4c66bf8. * fixed width cards, minor article change * fixed clickable cards * minor fixes * article layout fixes * fixes for case studies layout * more layout fixes * fixed unit tests * fix for equipment table * upgraded e2e test with cypress types, fixed e2e tests * fixed inconsistent bottom margin * mat-icon white on subhub child card * added missing case study references * fixed 3 column layout being too narrow * fixed you-might-be-interested-in id * fixed featured layout * fixed missing funding purpose * fixed body media error * fix nulls error on subhub pages * fixed title underline * Revert "fixed title underline" This reverts commit d92ba98. * fixed subhub child card underline Co-authored-by: Rose McColl <[email protected]>
…ypress-commands-2.0.1
…search-hub-web/cypress-commands-2.0.1 Bump cypress-commands from 1.1.0 to 2.0.1 in /research-hub-web
* initial commit for content graph * added resolver and adjustments, highlight node on hover * update lockfile version * minor fixes for null checks * added auth guard to graph route * first version of node info box * added node highlighting * improved details list and highlighting * first version of graph legend in drawer * layout fixes * layout improvements * renamed graph-legend to graph-filter * added legend, added dev env * added graph link to footer * fixed capitalisation * some fixes for unit tests * more fixes for tests * exclude GraphFilter test for now * added graph API to CSP headers (dev) * renamed graph-container * refactored graph into component * tidy up field order * changed loading behaviour, removed route resolver * fixed canvas width, colour changes * fixed color legend and search box * minor improvements * many UI improvements, added contentful link to env files * updated test and prod environment files with graph api url * some fixes for unit tests * more fixes for unit tests * minor improvements for node details UI * added graph api to csp headers in cloudfront functions * rebuild package-lock.json * added esbuild dep
* Add token references for CI build * Add missing package * Fix npm shrinkwrap issue * Fix wrong org id * Update readme * Update documentation * Add indentation and minor fixes to README * FIx minor heading issue with readme Co-authored-by: Lukas Trombach <[email protected]>
Co-authored-by: rosemcc <[email protected]> Co-authored-by: Lukas Trombach <[email protected]>
* chore: version update * CHORE: update versions * HOTFIX * Chore: version changes Co-authored-by: Rose <[email protected]> Co-authored-by: rosemcc <[email protected]> Co-authored-by: Lukas Trombach <[email protected]> Co-authored-by: Lukas Trombach <[email protected]> Co-authored-by: etan221 <[email protected]>
Change feedback button text
dependabot
bot
added
the
dependencies
* add initial modules and components * update search lambda * update and add new graphQL queries * add capability type to standard card * add components to routes * add capability list * reuse article default banner for capability card for now * add capability display name to pipe * first version of capability page * make tests runnable * add capability page type to search types * add navbar link to subhub * add capability list unit test * make e2e tests runnable * fix unit test * fix unit tests * add capability unit test * decapitalised navbar link * added new card background for capability * add capability e2e tests and fixture * fix capability not showing in search results * fix e2e test * add capability type to content graph * remove navbar link to be added later * fix standard card default image loading * lowercase sign in/out * move support materials to the top * fix unit test * fix navbar e2e test * move contacts to the top * minor fix for standard images * simplify standard card component * add comment explaining image height
update package versions
Bumps [ejs](https://github.com/mde/ejs) from 3.1.6 to 3.1.8. - [Release notes](https://github.com/mde/ejs/releases) - [Changelog](https://github.com/mde/ejs/blob/main/CHANGELOG.md) - [Commits](mde/ejs@v3.1.6...v3.1.8) --- updated-dependencies: - dependency-name: ejs dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
bot
force-pushed
the
dependabot/npm_and_yarn/research-hub-web/ejs-3.1.8
branch
from
4d188ea to
641bbaa
Compare
lugn621
force-pushed
the
dependabot/npm_and_yarn/research-hub-web/ejs-3.1.8
branch
from
641bbaa to
280ef95
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| name: Run linters | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: Check out Git repository | ||
| uses: actions/checkout@v2 | ||
|
|
||
| - name: Set up Node.js | ||
| uses: actions/setup-node@v1 | ||
| with: | ||
| node-version: 14 | ||
|
|
||
| - name: Install Node.js dependencies | ||
| working-directory: ./research-hub-web | ||
| run: npm ci | ||
|
|
||
| - name: Install Angular CLI | ||
| run: npm install -g @angular/cli | ||
|
|
||
| - name: ng lint | ||
| working-directory: ./research-hub-web | ||
| run: ng lint |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 days ago
In general, the fix is to explicitly restrict the GITHUB_TOKEN permissions for this workflow to the minimum required, instead of inheriting the repository/organization defaults. For a lint-only job that just checks out code and runs npm/ng lint, read-only access to repository contents is sufficient.
The best fix without changing functionality is to add a root-level permissions block just under the workflow name: (before on:), setting contents: read. This will apply to all jobs in the workflow (there is only run-linters), and they will only have read access to repository contents. No other scopes (like issues, pull-requests, etc.) are needed for this workflow. No additional imports or external libraries are needed; this is purely a YAML configuration change.
Concretely, in .github/workflows/linting.yml, between line 1 (name: Lint) and line 3 (on:), insert:
permissions:
contents: readleaving the rest of the workflow unchanged.
| @@ -1,5 +1,8 @@ | ||
| name: Lint | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| # Trigger the workflow on push or pull request, | ||
| # but only for the main branch |
| name: Create Sentry Release | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: Check out Git repository | ||
| uses: actions/checkout@v2 | ||
| - name: Get Branch | ||
| id: var | ||
| run: echo ::set-output name=branch::${GITHUB_REF#refs/*/} | ||
| - name: Output Branch | ||
| run: echo ${{ steps.var.outputs.branch }} | ||
| - name: Notify Sentry | ||
| # https://github.com/getsentry/action-release | ||
| uses: getsentry/[email protected] | ||
| env: | ||
| SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} | ||
| SENTRY_ORG: university-of-auckland-7o | ||
| SENTRY_PROJECT: research-hub | ||
| with: | ||
| environment: ${{ steps.var.outputs.branch }} No newline at end of file |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 days ago
Generally, this problem is fixed by explicitly declaring a permissions block for the workflow or the specific job, reducing the GITHUB_TOKEN to the minimum scopes required. For a workflow that only checks out code and interacts with Sentry using a separate token from secrets, the GITHUB_TOKEN only needs to read repository contents.
The best fix here is to add a permissions block at the workflow root (applies to all jobs) or inside the sentry-release job, specifying contents: read. This preserves existing behavior: actions/checkout@v2 still works with read-only contents, and Sentry authentication continues to rely on SENTRY_AUTH_TOKEN from secrets, not on GITHUB_TOKEN. No other scopes (like issues, pull-requests, or contents: write) are needed based on the shown steps.
Concretely, in .github/workflows/sentry.yml, add:
- A
permissions:mapping after thename:(line 1) and beforeon:(line 3), withcontents: read.
No additional imports or dependencies are required.
| @@ -1,5 +1,8 @@ | ||
| name: Sentry Release | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| push: | ||
| branches: |
| run: echo ${{ steps.var.outputs.branch }} | ||
| - name: Notify Sentry | ||
| # https://github.com/getsentry/action-release | ||
| uses: getsentry/[email protected] |
Check warning
Code scanning / CodeQL
Unpinned tag for a non-immutable Action in workflow Medium
|
|
||
| module.exports.search = async (event, context) => { | ||
| try { | ||
| console.log(`Received query: ${event.body}`); |
Check warning
Code scanning / CodeQL
Log injection Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 days ago
In general, to fix log injection when logging user input, sanitize the input before logging: at minimum, strip or replace newline (\n) and carriage return (\r) characters, and clearly label user-controlled fields in the log message. For HTML or other structured log formats, appropriate encoding/escaping should be applied.
For this specific case, we should avoid logging event.body as-is. A minimal, behavior-preserving fix is to create a sanitized version of event.body right before logging by removing \n and \r characters, then log that sanitized value instead. The rest of the function can continue to use the original event.body for parsing and processing, so application behavior is unchanged aside from safer logs. No new imports are needed; we can rely on String.prototype.replace with a regular expression.
Concretely:
- In
module.exports.search, before line 53, define asafeBodyvariable that:- Handles the case where
event.bodyis not a string (e.g.,nullor an object) by converting it to a string withString(...). - Replaces
\nand\rglobally with empty strings.
- Handles the case where
- Change the
console.logcall to usesafeBodyinstead ofevent.body.
Only lines around 53 in hub-search-proxy/handler.js need to be changed.
| @@ -50,7 +50,8 @@ | ||
|
|
||
| module.exports.search = async (event, context) => { | ||
| try { | ||
| console.log(`Received query: ${event.body}`); | ||
| const safeBody = String(event.body).replace(/[\r\n]/g, ''); | ||
| console.log(`Received query: ${safeBody}`); | ||
| const requestBody = JSON.parse(event.body); | ||
| let queryString = ''; | ||
| let size = 10; |
7 participants
Bumps ejs from 3.1.6 to 3.1.8.
Release notes
Sourced from ejs's releases.
Commits
5126ff5Version 3.1.87d5a1c6Merge branch 'main' of github.com:mde/ejs into main551949dMinor mitigation66f7471Merge pull request #664 from netcode/patch-1820855aVersion 3.1.7076dcb6Don't use template literalfaf8b84Skip test -- error message vary depending on JS runtimec028c34Update packages839ad20Update SECURITY.mdc040180Update README.mdYou can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.