Outdates package/packages fix
- 主要语言
- JavaScript
- 星标
- 84
- 派生
- 30
- PR 合并指标
- 30 天内没有已合并 PR
描述
Security tooling (ex. checkmarx) flags `electron@35.7.5` when installed via `@codeceptjs/ui@1.2.5` when working with label-studio
- Dependency path:
label-studio/web/libs/editor/tests/e2e/package.json
-> @codeceptjs/ui@1.2.5
-> electron@35.7.5
- Scan date: 2026-01-09
- Finding: "Monitored Vulnerability (98)"
- Electron upstream has newer versions available (e.g., 39.x).
The second topic is that the latest version of electron is still not considered as a safe one, but I think this is a separate issue. But consider if You can update it to pass security checks.
Is there a chance to dump this package to newest version?
I've seen that empty issue with nearly the same topic: https://github.com/codeceptjs/ui/issues/604
Thanks in advance
贡献指南
调研方向
Start with label-studio/web/libs/editor/tests/e2e/package.json and inspect its @codeceptjs/ui dependency and resolved Electron version. Update the dependency to a version that passes the reported security check, then verify installation and scanning no longer flag Electron.
由索引模型根据 Issue 内容生成。
评估
- 技术栈
- electron, javascript
- 领域
- security, testing-qa
- Issue 类型
- 缺陷
- 难度
- 2/5
- 预计耗时
- 1-3 小时
- 活跃度
- 停滞
- 描述清晰度
- 基本清楚
- 新手友好度
- 52/100