diff --git a/.github/workflows/snyk_sca_scan.yaml b/.github/workflows/snyk_sca_scan.yaml index eb88f1847..172cd7c0f 100644 --- a/.github/workflows/snyk_sca_scan.yaml +++ b/.github/workflows/snyk_sca_scan.yaml @@ -1,4 +1,8 @@ name: Snyk Software Composition Analysis Scan +# This git workflow leverages Snyk actions to perform a Software Composition +# Analysis scan on our Opensource libraries upon Pull Requests to Master & +# Develop branches. We use this as a control to prevent vulnerable packages +# from being introduced into the codebase. on: pull_request: branches: @@ -9,17 +13,19 @@ jobs: runs-on: ubuntu-latest strategy: matrix: - node-version: [16.x] + node-version: [20.x] steps: - uses: actions/checkout@v3 - name: Setting up Node - #- name: Use Node.js ${{ matrix.node-version }} uses: actions/setup-node@v3 with: node-version: ${{ matrix.node-version }} - - name: Run Snyk to check for opensource vulnerabilities - uses: snyk/actions/setup@master + - name: Installing snyk-delta and dependencies + run: npm i -g snyk-delta + - uses: snyk/actions/setup@master + - name: Perform SCA Scan + continue-on-error: false run: | - snyk test --all-projects --strict-out-of-sync=false --detection-depth=6 --exclude=docker,Dockerfile --severity-threshold=critical + snyk test --all-projects --detection-depth=4 --exclude=docker,Dockerfile --severity-threshold=critical env: SNYK_TOKEN: ${{ secrets.SNYK_API_TOKEN }} diff --git a/package-lock.json b/package-lock.json index 480138919..283ee5e05 100644 --- a/package-lock.json +++ b/package-lock.json @@ -21172,9 +21172,9 @@ "dev": true }, "node_modules/webpack": { - "version": "5.82.1", - "resolved": "https://registry.npmjs.org/webpack/-/webpack-5.82.1.tgz", - "integrity": "sha512-C6uiGQJ+Gt4RyHXXYt+v9f+SN1v83x68URwgxNQ98cvH8kxiuywWGP4XeNZ1paOzZ63aY3cTciCEQJNFUljlLw==", + "version": "5.83.1", + "resolved": "https://registry.npmjs.org/webpack/-/webpack-5.83.1.tgz", + "integrity": "sha512-TNsG9jDScbNuB+Lb/3+vYolPplCS3bbEaJf+Bj0Gw4DhP3ioAflBb1flcRt9zsWITyvOhM96wMQNRWlSX52DgA==", "dependencies": { "@types/eslint-scope": "^3.7.3", "@types/estree": "^1.0.0", @@ -54786,9 +54786,9 @@ "dev": true }, "webpack": { - "version": "5.82.1", - "resolved": "https://registry.npmjs.org/webpack/-/webpack-5.82.1.tgz", - "integrity": "sha512-C6uiGQJ+Gt4RyHXXYt+v9f+SN1v83x68URwgxNQ98cvH8kxiuywWGP4XeNZ1paOzZ63aY3cTciCEQJNFUljlLw==", + "version": "5.83.1", + "resolved": "https://registry.npmjs.org/webpack/-/webpack-5.83.1.tgz", + "integrity": "sha512-TNsG9jDScbNuB+Lb/3+vYolPplCS3bbEaJf+Bj0Gw4DhP3ioAflBb1flcRt9zsWITyvOhM96wMQNRWlSX52DgA==", "requires": { "@types/eslint-scope": "^3.7.3", "@types/estree": "^1.0.0", diff --git a/test-apps/cra-e2e-and-ct/package-lock.json b/test-apps/cra-e2e-and-ct/package-lock.json index c22f2f4c1..411cf9341 100644 --- a/test-apps/cra-e2e-and-ct/package-lock.json +++ b/test-apps/cra-e2e-and-ct/package-lock.json @@ -3692,9 +3692,9 @@ "integrity": "sha512-YATxVxgRqNH6nHEIsvg6k2Boc1JHI9ZbH5iWFFv/MTkchz3b1ieGDa5T0a9RznNdI0KhVbdbWSN+KWWrQZRxTw==" }, "node_modules/@types/node": { - "version": "16.18.48", - "resolved": "https://registry.npmjs.org/@types/node/-/node-16.18.48.tgz", - "integrity": "sha512-mlaecDKQ7rIZrYD7iiKNdzFb6e/qD5I9U1rAhq+Fd+DWvYVs+G2kv74UFHmSOlg5+i/vF3XxuR522V4u8BqO+Q==" + "version": "16.18.50", + "resolved": "https://registry.npmjs.org/@types/node/-/node-16.18.50.tgz", + "integrity": "sha512-OiDU5xRgYTJ203v4cprTs0RwOCd5c5Zjv+K5P8KSqfiCsB1W3LcamTUMcnQarpq5kOYbhHfSOgIEJvdPyb5xyw==" }, "node_modules/@types/parse-json": { "version": "4.0.0", @@ -18611,9 +18611,9 @@ "integrity": "sha512-YATxVxgRqNH6nHEIsvg6k2Boc1JHI9ZbH5iWFFv/MTkchz3b1ieGDa5T0a9RznNdI0KhVbdbWSN+KWWrQZRxTw==" }, "@types/node": { - "version": "16.18.48", - "resolved": "https://registry.npmjs.org/@types/node/-/node-16.18.48.tgz", - "integrity": "sha512-mlaecDKQ7rIZrYD7iiKNdzFb6e/qD5I9U1rAhq+Fd+DWvYVs+G2kv74UFHmSOlg5+i/vF3XxuR522V4u8BqO+Q==" + "version": "16.18.50", + "resolved": "https://registry.npmjs.org/@types/node/-/node-16.18.50.tgz", + "integrity": "sha512-OiDU5xRgYTJ203v4cprTs0RwOCd5c5Zjv+K5P8KSqfiCsB1W3LcamTUMcnQarpq5kOYbhHfSOgIEJvdPyb5xyw==" }, "@types/parse-json": { "version": "4.0.0",