Bump deps

[mfocko]

as a follow-up to the vulnerability report

[usercont-release-bot]

Preview: https://packit-dashboard-pr-325.surge.sh (deployed at Mon 04 Sep 2023, 15:43 UTC)

[softwarefactory-project-zuul]

Build succeeded.
https://softwarefactory-project.io/zuul/t/packit-service/buildset/f3a31628972745fcb502d5ad4ab4b09d

✔️ pre-commit SUCCESS in 1m 15s

[jpopelka]

😕
So, will the GH action for deploying PRs work without it?
(The last run went OK, but the preview is already unavailable)

[mfocko]

😕 So, will the GH action for deploying PRs work without it? (The last run went OK, but the preview is already unavailable)

yes :) actually mentioned in the commit message, but it didn't get to the PR because of multiple commits :/
I hit some issues when trying to get it to work, so I installed it almost everywhere and I must've missed the commit when dropping the debugging changes, etc. Surge is installed »globally« and »within« the action, so we shouldn't need it in the frontend itself.

[mfocko]

https://github.com/packit/dashboard/pull/325/files#diff-da6498268e99511d9ba0df3c13e439d10556a812881c9d03955b2ef7c6c1c655R12-R17

@SpyTec shouldn't those be included only in the dev dependencies? 🤔 we got it tagged as security vulnerability from one of its dependencies (ejs)

[Venefilyn]

#325 (files)

@SpyTec shouldn't those be included only in the dev dependencies? 🤔 we got it tagged as security vulnerability from one of its dependencies (ejs)

Yeah it could be added there, will mean less dependencies installed on prod. Luckily the attack surface for the dashboard is extremely low due to the nature of the application, so I didn't give it much thought

There is one reason to have it in the dependencies and that would be if we want to build and deploy Storybook as well to try it out we'd need it in dependencies -- though no need for that atm

[mfocko]

Yeah it could be added there, will mean less dependencies installed on prod. Luckily the attack surface for the dashboard is extremely low due to the nature of the application, so I didn't give it much thought

There is one reason to have it in the dependencies and that would be if we want to build and deploy Storybook as well to try it out we'd need it in dependencies -- though no need for that atm

Thanks a lot :) it's included in both deps and dev deps, i'll remove it from deps to counter the false-positives for now

[softwarefactory-project-zuul]

Build succeeded.
https://softwarefactory-project.io/zuul/t/packit-service/buildset/14f2f8aef5634f04be5b1e023cec9d97

✔️ pre-commit SUCCESS in 1m 30s