codeceptjs / codeceptjs/ui

Outdates package/packages fix

未关闭
#673 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
主要语言
JavaScript
星标
84
派生
30
PR 合并指标
30 天内没有已合并 PR

描述

Security tooling (ex. checkmarx) flags `electron@35.7.5` when installed via `@codeceptjs/ui@1.2.5` when working with label-studio

- Dependency path:
label-studio/web/libs/editor/tests/e2e/package.json
-> @codeceptjs/ui@1.2.5
-> electron@35.7.5

- Scan date: 2026-01-09
- Finding: "Monitored Vulnerability (98)"
- Electron upstream has newer versions available (e.g., 39.x).

The second topic is that the latest version of electron is still not considered as a safe one, but I think this is a separate issue. But consider if You can update it to pass security checks.

Is there a chance to dump this package to newest version?
I've seen that empty issue with nearly the same topic: https://github.com/codeceptjs/ui/issues/604

Thanks in advance

贡献指南

打开贡献指南

调研方向

Start with label-studio/web/libs/editor/tests/e2e/package.json and inspect its @codeceptjs/ui dependency and resolved Electron version. Update the dependency to a version that passes the reported security check, then verify installation and scanning no longer flag Electron.

由索引模型根据 Issue 内容生成。

评估

技术栈
electron, javascript
领域
security, testing-qa
Issue 类型
缺陷
难度
2/5
预计耗时
1-3 小时
活跃度
停滞
描述清晰度
基本清楚
新手友好度
52/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。