Commit 8a73e81
build(build-tools): Update danger dependency (start of CVE remediation) (microsoft#25081)
## Description
Updates the `danger` dependency in build-tools to the latest version to
get rid of the transitive dependency on `parse-git-config` which is
affected by https://nvd.nist.gov/vuln/detail/CVE-2025-25975. A
[PR](jonschlinkert/parse-git-config#15) was
opened in their repo to fix it but the maintainer has not responded in
several months. `danger` decided to replace it with something else in
v13.0.0 (see
[CHANGELOG](https://github.com/danger/danger-js/blob/main/CHANGELOG.md)).
The breaking change announced there doesn't seem like something that
should affect us as consumers of `danger`.
Note: since build-tools has a dev dependency on a previous version of
itself, fully addressing the Component Governance alert (getting rid of
all references to danger<13.0.0 in lockfiles) will need us to release
build-tools with this fix, and update the dev dep to that version.
## Reviewer Guidance
The review process is outlined on [this wiki
page](https://github.com/microsoft/FluidFramework/wiki/PR-Guidelines#guidelines).
[AB#35181](https://dev.azure.com/fluidframework/235294da-091d-4c29-84fc-cdfc3d90890b/_workitems/edit/35181)1 parent 9715039 commit 8a73e81
2 files changed
+83
-15
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
98 | 98 | | |
99 | 99 | | |
100 | 100 | | |
101 | | - | |
| 101 | + | |
102 | 102 | | |
103 | 103 | | |
104 | 104 | | |
| |||
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
0 commit comments