Bump @contentful/f36-components from 4.0.17 to 4.56.2 in /subhub-link-checker#443
Conversation
Login menu update
Fix failed start up due to Contentful type changes
…search-stage-url RSM-3036: stage: replace search with url
…rsion Update linting.yml
Feature/rsm 3250 search logic
Bumps [@contentful/f36-components](https://github.com/contentful/forma-36) from 4.0.17 to 4.56.2. - [Release notes](https://github.com/contentful/forma-36/releases) - [Changelog](https://github.com/contentful/forma-36/blob/main/CHANGELOG.md) - [Commits](https://github.com/contentful/forma-36/compare/@contentful/f36-components@4.0.17...@contentful/f36-components@4.56.2) --- updated-dependencies: - dependency-name: "@contentful/f36-components" dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
the
dependencies
lugn621
force-pushed
the
dependabot/npm_and_yarn/subhub-link-checker/contentful/f36-components-4.56.2
branch
from
6d65397 to
b2854e5
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| name: Run linters | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: Check out Git repository | ||
| uses: actions/checkout@v2 | ||
|
|
||
| - name: Set up Node.js | ||
| uses: actions/setup-node@v1 | ||
| with: | ||
| node-version: 18 | ||
|
|
||
| - name: Install Node.js dependencies | ||
| working-directory: ./research-hub-web | ||
| run: npm ci --force | ||
|
|
||
| - name: Install Angular CLI | ||
| run: npm install -g @angular/cli | ||
|
|
||
| - name: ng lint | ||
| working-directory: ./research-hub-web | ||
| run: ng lint |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 9 days ago
In general, this should be fixed by adding a permissions block that limits the GITHUB_TOKEN to the least privileges required. For a linting workflow that only checks out code and runs linters, read access to repository contents is sufficient, so contents: read is an appropriate minimal setting.
The best fix without changing existing functionality is to add a permissions block at the workflow root level, directly under the name: Lint line. This will apply to all jobs in the workflow (there is only run-linters), and restrict GITHUB_TOKEN to read-only contents access. No other code changes, imports, or steps are required.
Concretely, in .github/workflows/linting.yml, insert:
permissions:
contents: readbetween line 1 (name: Lint) and line 3 (on:). This documents the intended minimal permissions and ensures the workflow remains least-privilege even if repository or organization defaults change.
| @@ -1,4 +1,6 @@ | ||
| name: Lint | ||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| # Trigger the workflow on push or pull request, |
| name: Create Sentry Release | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: Check out Git repository | ||
| uses: actions/checkout@v2 | ||
| - name: Get Branch | ||
| id: var | ||
| run: echo ::set-output name=branch::${GITHUB_REF#refs/*/} | ||
| - name: Output Branch | ||
| run: echo ${{ steps.var.outputs.branch }} | ||
| - name: Notify Sentry | ||
| # https://github.com/getsentry/action-release | ||
| uses: getsentry/action-release@v1.1.6 | ||
| env: | ||
| SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} | ||
| SENTRY_ORG: university-of-auckland-7o | ||
| SENTRY_PROJECT: research-hub | ||
| with: | ||
| environment: ${{ steps.var.outputs.branch }} No newline at end of file |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 9 days ago
To fix the problem, add an explicit permissions block that restricts the GITHUB_TOKEN to the least privilege needed. Since this workflow only checks out the code and then calls Sentry’s release action (which uses an explicit Sentry token, not GITHUB_TOKEN), it should be sufficient to grant read-only access to repository contents.
The best, minimal-impact fix is to add a workflow‑level permissions section directly under the name (or on) key, so it applies to all jobs by default. In .github/workflows/sentry.yml, between lines 1–3 (after name: Sentry Release and before on:), insert:
permissions:
contents: readNo imports or extra definitions are required. This change documents the workflow’s needs and ensures the GITHUB_TOKEN remains read‑only even if org/repo defaults change.
| @@ -1,5 +1,8 @@ | ||
| name: Sentry Release | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| push: | ||
| branches: |
| run: echo ${{ steps.var.outputs.branch }} | ||
| - name: Notify Sentry | ||
| # https://github.com/getsentry/action-release | ||
| uses: getsentry/action-release@v1.1.6 |
Check warning
Code scanning / CodeQL
Unpinned tag for a non-immutable Action in workflow Medium
|
|
||
| module.exports.search = async (event, context) => { | ||
| try { | ||
| console.log(`Received query: ${event.body}`); |
Check warning
Code scanning / CodeQL
Log injection Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 9 days ago
In general, to fix log injection you should avoid writing raw user input directly to logs. At minimum, remove characters that can affect log structure (like \n and \r), and clearly label user-controlled sections in log messages. For logs that might be rendered as HTML, HTML-encode user inputs before logging.
For this specific case in hub-search-proxy/handler.js, the best fix is to sanitize event.body before interpolating it into the log message. We can create a sanitized version of the string by converting event.body to a string (to be safe) and removing any newline and carriage return characters using String.prototype.replace with a regular expression. Then log the sanitized string instead of the raw body. This change should be done immediately before the console.log call at line 53, and no new imports are necessary. Existing behavior is preserved, except that log output will no longer contain embedded line breaks injected by the caller.
Concretely:
- In the
module.exports.searchfunction, replace the directconsole.log(\Received query: ${event.body}`);` with:- A new local variable, e.g.
const safeBody = String(event.body).replace(/[\r\n]/g, ''); - A log statement using
safeBodyinstead ofevent.body.
No other parts of the function need to change.
- A new local variable, e.g.
| @@ -50,7 +50,8 @@ | ||
|
|
||
| module.exports.search = async (event, context) => { | ||
| try { | ||
| console.log(`Received query: ${event.body}`); | ||
| const safeBody = String(event.body).replace(/[\r\n]/g, ''); | ||
| console.log(`Received query: ${safeBody}`); | ||
| const requestBody = JSON.parse(event.body); | ||
| let queryString = ''; | ||
| let size = 10; |
7 participants
Bumps @contentful/f36-components from 4.0.17 to 4.56.2.
Changelog
Sourced from
@contentful/f36-components's changelog.... (truncated)
Commits
3621453feat(Text): addletterSpacingsupport (#2633)f3c3530chore: adjustnpm-package-publisheraction (#2632)898e498docs: update changelog on repository and website05071e6docs(changelog): add changelogs for 35be000ac [skip ci]35be000fix(Flex): map gap 'none' to 0px (#2625)fac5462chore: add npm-package-publisher (#2631)b9b5989chore: add changelog to alpha packages (#2630)991d7eechore: adjust release token + vault policy (#2629)0965800chore: replace npm registry with GitHub packages (#2628)9d277bafeat(DensityContainer): add package (#2618)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)