mi6 / mi6/ic-ui-kit

Internal issue 3056 - eliminate audit exceptions on ui-kit repo

Open
#3,614 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
53
Forks
63
Avg merge
2d 4h
Merged PRs (30d)
15

Description

There are a number of items added to the allowlist (audit-ci.json) to ensure audit passes. Some of these could hopefully be eliminated once other work is complete:

moving to storybook v9 may help:
[https://github.com/mi6/ic-ui-kit/issues/3588|https://github.com/mi6/ic-ui-kit/issues/3588]

once e2e tests have been removed under
[https://github.com/mi6/ic-ui-kit/issues/3522|https://github.com/mi6/ic-ui-kit/issues/3522], it may be possible to remove puppeteer as a dev dependency - this is currently v13 with a number of vulnerabilities

UPDATE: puppeteer has been removed as dev dependency as part of https://github.com/mi6/ic-ui-kit/pull/3685, but the audit issue still remains as the problem lies in cypress-audit/lighthouse package - no current update available

An update to react router v7 should resolve some other vulnerabilities - this is only a dependency for our storybook examples that need it, so we could update the stories if it causes a breaking change

Contributor guide

Open the contributing guide

Research direction

Start with audit-ci.json and the remaining audit output; review issues 3588 and 3522 for the dependency work they describe. Check the current dependency manifests and the changes from pull request 3685, then identify which allowlist entries can be removed and verify the audit passes without the affected vulnerabilities.

Written by the indexing model from the issue text.

Assessment

Tech stack
cypress, react, typescript
Domain
security, testing, tooling
Issue type
Refactor
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.