FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Update @manypkg/get-packages to ^2.2.2 to address GHSA-968p-4wvh-cqc8 by Pewtro · Pull Request #1609 · changesets/changesets · GitHub

/ changesets Public

Update @manypkg/get-packages to ^2.2.2 to address GHSA-968p-4wvh-cqc8 - #1609

Closed
Pewtro wants to merge 2 commits into
changesets:mainfrom
Pewtro:chore/update-manypkg-get-packages
ConversationCommits (2)ChecksFiles changed
Closed

Update @manypkg/get-packages to ^2.2.2 to address GHSA-968p-4wvh-cqc8#1609
Pewtro wants to merge 2 commits into
changesets:mainfrom
Pewtro:chore/update-manypkg-get-packages

Conversation

Pewtro commented Mar 14, 2025 •
edited
Loading

Copy link
Copy Markdown

This fixes GHSA-968p-4wvh-cqc8 by updating to version 2 of @manypkg/get-packages which had a few breaking changes, but as far as I could tell none of the breaking changes are exposed to consumers so I believe it can be released a patch version.

I know that the vulnerability probably does not truly affect changesets, but github is flagging projects using changesets with the security alert, so I would assume you'll eventually get a lot of questions about it.

changeset-bot Bot commented Mar 14, 2025 •
edited
Loading

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 8251b28

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 11 packages
Name Type
@changesets/apply-release-plan Major
@changesets/assemble-release-plan Major
@changesets/cli Major
@changesets/config Major
@changesets/get-dependents-graph Major
@changesets/git Major
@changesets/pre Major
@changesets/release-utils Major
@changesets/should-skip-package Major
@changesets/get-release-plan Patch
@changesets/read Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

Pewtro force-pushed the chore/update-manypkg-get-packages branch from f0e2460 to 2fc9ae9 Compare March 14, 2025 09:40

codecov Bot commented Mar 14, 2025 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 88.88889% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 81.17%. Comparing base (5c2bac5) to head (8251b28).
⚠️ Report is 36 commits behind head on main.

Files with missing lines Patch % Lines
packages/cli/src/commands/publish/index.ts 50.00% 1 Missing ⚠️
...s/get-dependents-graph/src/get-dependency-graph.ts 83.33% 1 Missing ⚠️
Additional details and impacted files 
@@           Coverage Diff           @@
##             main    #1609   +/-   ##
=======================================
  Coverage   81.16%   81.17%           
=======================================
  Files          54       54           
  Lines        2241     2247    +6     
  Branches      669      672    +3     
=======================================
+ Hits         1819     1824    +5     
- Misses        417      418    +1     
  Partials        5        5

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Pewtro force-pushed the chore/update-manypkg-get-packages branch from bc2d841 to 9cafe34 Compare March 14, 2025 09:59
Pewtro marked this pull request as ready for review March 14, 2025 10:02
Pewtro changed the title Update @manypkg/get-packages to ^2.2.2 Update @manypkg/get-packages to ^2.2.2 to address GHSA-968p-4wvh-cqc8 Mar 14, 2025

Andarist commented Mar 14, 2025

Copy link
Copy Markdown
Member

This might not affect CLI consumers but for other packages this is a breaking change.

Pewtro commented Mar 14, 2025

Copy link
Copy Markdown
Author

Sure, bumped the changeset and added a link to v2.0.0 that brought along the breaking changes in the description

bluwy commented Nov 17, 2025

Copy link
Copy Markdown
Member

It looks like the vulnerability is fixed in a babel patch, which should already be covered in our semver ranges, so I don't think we have to bump this to fix it.

It would be good to update to latest in general though, but for breaking changes, we're currently focusing them in the next branch. And also, @manypkg/get-packages has a v3 that we can migrate to directly, and I just found out I've made a PR and forgot to follow up before: #1655

If you can help review it when it's ready, that'll be much appreciated. For now I'll close this PR, thanks for contributing.

bluwy closed this Nov 17, 2025
bluwy mentioned this pull request Nov 18, 2025
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

Back | FazBrowse Home | New Git URL