Skip to content

Conversation

@ricardodalarme
Copy link

Description

  • Dependabot found a vulnerability in the semver package that commitlint depends on. So this PR updates commitlint to the latest version, which uses a patched version of semver that fixes the vulnerability.
  • Additionally, it removes the prefix 'v' when auto-releasing the package, given that the tag name reflects in the package version and including a prefix is not the convention for maven packages.

Related Issues

Pull request checklist

  • Tests: This PR includes tests for covering the features or bug fixes (if applicable).
  • Docs: This PR updates/creates the necessary documentation.
  • CI: Make sure your Pull Request passes all CI checks. If not, clarify the motif behind that and the action plan to solve it (may reference a ticket)

ricardodalarme added 2 commits June 27, 2023 13:18
- Dependabot found a vulnerability in the semver package that commitlint
  depends on. This PR updates commitlint to the latest version, which
  uses a patched version of semver that fixes the vulnerability.

Closes #86
- The tag name is reflected in the package version and including a prefix
  is not the convention for maven packages.
Copy link
Collaborator

@aelnonym aelnonym left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@ricardodalarme ricardodalarme self-assigned this Jun 27, 2023
Copy link

@loadez loadez left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

The version 7.5.3 was released also fixing a problem in regex but I don't think that it's relevant

@ricardodalarme ricardodalarme merged commit bf271c4 into main Jun 28, 2023
@ricardodalarme ricardodalarme deleted the chore/update-commitlint branch June 28, 2023 12:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Dependabot alert - Vulnerability on yarn.lock

4 participants