Skip to content

Commit 8a73e81

Browse files
alexvy86MarioJGMsoft
authored andcommitted
build(build-tools): Update danger dependency (start of CVE remediation) (microsoft#25081)
## Description Updates the `danger` dependency in build-tools to the latest version to get rid of the transitive dependency on `parse-git-config` which is affected by https://nvd.nist.gov/vuln/detail/CVE-2025-25975. A [PR](jonschlinkert/parse-git-config#15) was opened in their repo to fix it but the maintainer has not responded in several months. `danger` decided to replace it with something else in v13.0.0 (see [CHANGELOG](https://github.com/danger/danger-js/blob/main/CHANGELOG.md)). The breaking change announced there doesn't seem like something that should affect us as consumers of `danger`. Note: since build-tools has a dev dependency on a previous version of itself, fully addressing the Component Governance alert (getting rid of all references to danger<13.0.0 in lockfiles) will need us to release build-tools with this fix, and update the dev dep to that version. ## Reviewer Guidance The review process is outlined on [this wiki page](https://github.com/microsoft/FluidFramework/wiki/PR-Guidelines#guidelines). [AB#35181](https://dev.azure.com/fluidframework/235294da-091d-4c29-84fc-cdfc3d90890b/_workitems/edit/35181)
1 parent 9715039 commit 8a73e81

File tree

2 files changed

+83
-15
lines changed

2 files changed

+83
-15
lines changed

build-tools/packages/build-cli/package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@
9898
"azure-devops-node-api": "^11.2.0",
9999
"change-case": "^3.1.0",
100100
"cosmiconfig": "^8.3.6",
101-
"danger": "^12.3.3",
101+
"danger": "^13.0.3",
102102
"date-fns": "^2.30.0",
103103
"debug": "^4.3.7",
104104
"execa": "^5.1.1",

build-tools/pnpm-lock.yaml

Lines changed: 82 additions & 14 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)