Skip to content
This repository was archived by the owner on Jun 10, 2019. It is now read-only.
This repository was archived by the owner on Jun 10, 2019. It is now read-only.

Add snyk for dependency vulnerability checking #496

Closed
#841
Closed
Add snyk for dependency vulnerability checking#496
#841
Assignees
sethbergman
Labels
Priority: LowType: Feature/Redesign

Description

@sethbergman
sethbergman
opened on Sep 11, 2017

Feature

Integrate snyk for dependency vulnerability checking

Why is this feature being added?

It automatically checks dependencies that have been identified as vulnerable.

What should your feature do?

  • Run a command in package.json for the snyk app to report the dependency vulnerabilities.

  • snyk badge --> Known Vulnerabilities

Activity

  1. sethbergman
    added this to the User Profiles with oAuth, Resume building / importing and Data Visualization milestone on Sep 11, 2017
  2. sethbergman
    added
    Priority: High
    Status: In Progress
    Type: Feature/Redesign
    on Sep 11, 2017
  3. sethbergman
    removed this from the User Profiles with oAuth, Resume building / importing and Data Visualization milestone on Sep 11, 2017
  4. sethbergman
    self-assigned this
    on Sep 11, 2017

  5. sethbergman commented on Sep 29, 2017

    @sethbergman
    sethbergman
    on Sep 29, 2017
    MemberAuthor

    Snyk's wizard will:

    • Enumerate your local dependencies and query Snyk's servers for vulnerabilities
    • Guide you through fixing found vulnerabilities
    • Create a .snyk policy file to guide snyk commands such as test and protect
    • Remember your dependencies to alert you when new vulnerabilities are disclosed

    Querying vulnerabilities database...

    License issues are not supported by the wizard, use snyk ignore

    Tested 380 dependencies for known vulnerabilities, found 4 vulnerabilities, 27 vulnerable paths.

    • Low severity vuln found in debug@2.6.7, introduced via axios@0.16.1

    Remediation options (Use arrow keys)

    1. ❯ Re-install axios@0.16.1 (triggers upgrade to debug@2.6.9)
    2. Patch (modifies files locally, updates policy for snyk protect runs)
    3. Set to ignore for 30 days (updates policy)
    4. Skip
  6. sethbergman
    added
    Needs: More Detail
    and removed
    Priority: High
    Status: In Progress
    on Sep 30, 2017
  7. kylemh
    added
    hacktoberfest
    Priority: Low
    Status: Available
    and removed
    Needs: More Detail
    on Oct 1, 2017
  8. kylemh
    removed
    hacktoberfest
    on Nov 11, 2017
  9. sethbergman
    added
    Status: In Progress
    and removed
    Status: Available
    on Feb 2, 2018

  10. sethbergman commented on Feb 2, 2018

    @sethbergman
    sethbergman
    on Feb 2, 2018
    MemberAuthor

    This should be good to go. Thanks @gokaygurcan and @kylemh for your help with this. Sorry about the delay.

  11. kylemh
    removed
    Status: In Progress
    on Apr 11, 2018

  12. dmarchante commented on Jul 14, 2018

    @dmarchante
    dmarchante
    on Jul 14, 2018
    Contributor

    @kylemh @sethbergman Why is this still open, is there a reason?

  13. kylemh commented on Jul 14, 2018

    @kylemh
    kylemh
    on Jul 14, 2018
    Member

    The PR that's open for this doesn't work, and it should. I was having a back-n-forth email conversation with people @ Snyk, but wasn't able to resolve the issue.

  14. kylemh commented on Oct 1, 2018

    @kylemh
    kylemh
    on Oct 1, 2018
    Member

    Dependency security issues tracked via Greenkeeper in new repo

  15. kylemh
    closed this as completedon Oct 1, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Priority: LowType: Feature/Redesign

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions