Skip to content

chore(ci): Replace Snyk with yarn audit #21

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Mar 7, 2019

Conversation

hedgepigdaniel
Copy link
Collaborator

Snyk is really resisting being used for free. Meanwhile yarn audit is much simpler to use.

I upgraded packages to fix all the identified vulnerabilities, which required some babel+jest fixes to account for the breaking changes in jest.

I removed the vulnerability checking from the CI script for 2 reasons:

  • It doesn't work because Travis has too old a version of yarn
  • Its non-deterministic, and it doesn't make sense to block PRs because a new unrelated vulnerability was found. For example refactor: 💡 Add options to the "call" middleware #17 is totally unrelated to Snyk and yet it hasn't been merged because of Snyk.

@hedgepigdaniel hedgepigdaniel merged commit dc2c86c into master Mar 7, 2019
@hedgepigdaniel hedgepigdaniel deleted the refactor/yarn-audit branch April 15, 2019 00:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants