fix: babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code (#15840)
Resolves [Dependabot Alert 95](https://github.com/twentyhq/twenty/security/dependabot/95) - babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code. These were the few options we had for a direct drop-in replacement. - [x-var](https://www.npmjs.com/package/x-var?activeTab=readme) - [cross-let](https://www.npmjs.com/package/cross-let) - [cross-var-no-babel](https://www.npmjs.com/package/cross-var-no-babel) x-var has the most weekly downloads among the three and it is also the most actively maintained fork of the original cross-var package that introduced the vulnerability. There is no syntax difference per the documentation, but I do not have a windows machine to test. `cross-var-no-babel` offers the most minimal changes, but is also abandoned without a public-facing repo.
This commit is contained in:
@@ -234,7 +234,7 @@
|
||||
"command": "nx storybook:build {projectName}",
|
||||
"forwardAllArgs": false
|
||||
},
|
||||
"cross-var chromatic --project-token=$CHROMATIC_PROJECT_TOKEN --storybook-build-dir=storybook-static {args.ci}"
|
||||
"chromatic --storybook-build-dir=storybook-static {args.ci}"
|
||||
],
|
||||
"parallel": false
|
||||
},
|
||||
|
||||
Reference in New Issue
Block a user