Uh oh!
There was an error while loading. Please reload this page.
SEC-6539 use exact 2.5.2 on jest canvas lib per guidance - #33
Conversation
There was a problem hiding this comment.
Pull request overview
Pins the jest-canvas-mock devDependency to an exact version (2.5.2) in the web UI workspace, aligning with the referenced security guidance (SEC-6539).
Changes:
- Update
web/ui/package.jsonto pinjest-canvas-mockto exactly2.5.2(no caret range). - Update
web/ui/package-lock.jsonaccordingly (but includes substantial additional lockfile churn). - Remove
catalog-info.yamlfrom the repo root.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| web/ui/package.json | Pins jest-canvas-mock to an exact version for security guidance compliance. |
| web/ui/package-lock.json | Reflects the pinned dependency, but also includes many unrelated lockfile metadata changes. |
| catalog-info.yaml | Deleted Backstage catalog metadata file (not mentioned in PR description). |
Files not reviewed (1)
- web/ui/package-lock.json: Generated file
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "devDependencies": { | ||
| "@types/jest": "^29.5.12", | ||
| "@types/node": "^20.14.9", | ||
| "eslint-config-prettier": "^9.1.0", | ||
| "eslint-config-react-app": "^7.0.1", | ||
| "eslint-plugin-prettier": "^4.2.1", | ||
| "jest-canvas-mock": "^2.5.2", | ||
| "jest-canvas-mock": "2.5.2", | ||
| "jest-fetch-mock": "^3.0.3", |
There was a problem hiding this comment.
Fixed. The lockfile had been regenerated with a newer npm (Node 22 / npm 10), which rewrote many "peer": true flags across the tree.
I restored web/ui/package-lock.json from main and re-ran npm install with the repo’s expected toolchain (Node v20.5.1 / npm v9.8.0 per web/ui/.nvmrc). The PR diff vs main is now only the intended pin:
| File | Change |
|---|---|
web/ui/package.json | jest-canvas-mock: ^2.5.2 → 2.5.2 |
web/ui/package-lock.json | same single-line spec change |
No unrelated peer-dependency churn remains. Pushed in commit 5d25ca9c5.
Restore lockfile from main and re-run npm install with the repo's expected Node/npm versions to avoid unrelated peer dependency churn. Only the jest-canvas-mock exact version pin changes. Co-authored-by: Danny Peck <dannypeck@gmail.com>
Pins jest-canvas-mock to exact 2.5.2 per security guidance (SEC-6539).
Replaces prometheus#19176, which was accidentally opened against upstream prometheus/prometheus instead of this fork.