bcgov / bcgov/entity

Name Examination UI: verify and resolve dependency update PRs

Open
#11,176 0 comments 0 reactions 0 assignees View on GitHub
ENTITY - DO NOT USE Priority2 security
Dominant language
JavaScript
Stars
23
Forks
62
Avg merge
24m
Merged PRs (30d)
1

Description

A Github process called "dependabot" automatically creates a PR to update a package dependency to potentially fix a security vulnerability. Eg,

![image.png](https://images.zenhubusercontent.com/5d0a7edda4644173e93bf808/b1224dc9-5e28-4ce3-8d10-93b86eb46d64)

Before accepting and merging these PRs, each subject package should be reviewed for potential code impacts (eg, breaking changes), and the project should be rebuilt and tested.

The identified "security vulnerabilities" are of moderate or high severity. A summary page is available at: https://github.com/bcgov/name-examination/security/dependabot

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at the Dependabot security summary linked in the issue and review the open moderate- and high-severity dependency update PRs. For each subject package, check for breaking-change impacts, then rebuild and run the project's tests. Done means the relevant PRs have been verified and resolved with test results recorded.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
devops, security, testing
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.