Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security] Update elliptic and jspdf #2418

Open
4 of 12 tasks
billhimmelsbach opened this issue Feb 28, 2025 · 1 comment · May be fixed by #2419
Open
4 of 12 tasks

[Security] Update elliptic and jspdf #2418

billhimmelsbach opened this issue Feb 28, 2025 · 1 comment · May be fixed by #2419
Assignees

Comments

@billhimmelsbach
Copy link

billhimmelsbach commented Feb 28, 2025

After snyk reported a security vulnerability, we'll need to update two libraries: elliptic and jspdf. These are fairly minor updates, so we'll tackle them together.

This will resolve the following PRs:
#2318
#2317
#2413

The method we'll be using is:

  • Search to see if updates to the deps have been tried before, but were blocking changes for some reason in issues, PRs, etc
  • Update package.json, run yarn to update the package.lock
  • Run e2e tests locally
  • Examine where these packages are used and ensure that these updates don't break anything not caught by e2e tests
  • If everything looks good, proceed. Otherwise, revise code and chat with @ojbravo
  • Deploy changes to Dev via CLI, run e2e tests again and test everything
  • Get me admin access to this repo so I can make PRs, label and assign issues, etc.
  • Create a PR and merge in the security updates
  • Create a github release
  • Deploy mLAR changes to Prod via CLI (based on how I understand things currently are working with the caching workaround, these changes won't be visible until a manual deploy is done) - use the same image that's on dev
  • Test things out with the team, confirm e2e tests pass (wait till they run automatically or trigger manually)
  • 🥳
@billhimmelsbach
Copy link
Author

billhimmelsbach commented Mar 3, 2025

Posting the screenshots from last week's test runs and my little exploration of these deps.

I think these are in line with the expectation that some tests fail usually when on dev environments, but I'll check with @ojbravo today.

e2e tests running on branch with elliptic and jspdf deps updated

Image

e2e tests just running against master

Image

@billhimmelsbach billhimmelsbach self-assigned this Mar 4, 2025
@billhimmelsbach billhimmelsbach linked a pull request Mar 4, 2025 that will close this issue
12 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant