[Pending Checklist] [Snyk] Security upgrade onfido-sdk-ui from 13.6.1 to 14.15.0

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json
- package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	631/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.2	Missing Release of Resource after Effective Lifetime SNYK-JS-INFLIGHT-6095116	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

Upwork Automation - Do Not Edit

Upwork Job URL: https://www.upwork.com/jobs/~01642311bedaee7bd5
Upwork Job ID: 1760616292247072768
Last Price Increase: 2024-02-22

This is a Snyk issue. Snyk is a tool that automatically tracks our repositories' dependencies and reports associated security vulnerabilities. It also automatically create PRs to fix these vulnerabilities.

    C+: Please follow these steps to test the linked PR before running through the reviewer checklist:
    - [ ] The first step is to understand the PR: what dependency is it upgrading, for which vulnerability, how it impacts our product & end users.
    - [ ] If the issue is not worth fixing, please add your reasoning in the issue and have the internal engineer review it.
    - [ ] Check the change log (which should be included in the PR description) to see all changes. We want to identify any breaking changes. If it is a minor version bump, it's unlikely that there are any breaking changes.
    - [ ] Test our feature(s) that make use of this package. If it does not work, we should understand what broke it. It is also a good idea to check our main flows to make sure they are not broken that you can add in the checklist screenshots/videos.

Job added to Upwork: https://www.upwork.com/jobs/~01642311bedaee7bd5

@getusha

Triggered auto assignment to Contributor Plus for review of internal employee PR - @getusha (Internal)

@DylanDylann

@DylanDylann already started the review/testing in this PR. Per this comment, I'm going to assign @DylanDylann to it. Apologies @getusha 🙇🏽

Working on it in this PR

@DylanDylann

Cool, thanks @DylanDylann! Seems the black border issue will be addressed in this PR, correct? i.e. we don't need to create another PR/GH to fix it

@fedirjh

Payment Summary

Upwork Job

ROLE: @fedirjh paid $(AMOUNT) via Upwork (LINK)
ROLE: @DylanDylann paid $(AMOUNT) via Upwork (LINK)

BugZero Checklist (@greg-schroeder)

I have verified the correct assignees and roles are listed above and updated the neccesary manual offers
I have verified that there are no duplicate or incorrect contracts on Upwork for this job (https://www.upwork.com/ab/applicants/1760616292247072768/hired)
I have paid out the Upwork contracts or cancelled the ones that are incorrect
I have verified the payment summary above is correct

@greg-schroeder

@greg-schroeder Bump for payment here

Apologies, I was OOO last week. Taking a look at this now!

@fedirjh

Offers sent to @fedirjh and @DylanDylann

Paid! Could one of you take care of the checklist? Then we can close this out

@greg-schroeder

@greg-schroeder I think BZ Checklists are not applicable in this case, as it is simply a package upgrade. We should just close it.

Thanks!

Navigation Menu

Repository navigation

[Pending Checklist] [Snyk] Security upgrade onfido-sdk-ui from 13.6.1 to 14.15.0 #37076

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Vulnerabilities that will be fixed

With an upgrade:

23 remaining items

Payment Summary

BugZero Checklist (@greg-schroeder)

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[Pending Checklist] [Snyk] Security upgrade onfido-sdk-ui from 13.6.1 to 14.15.0 #37076

Description

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Vulnerabilities that will be fixed

With an upgrade:

Activity

melvin-bot commented on Feb 22, 2024

melvin-bot commented on Feb 22, 2024

melvin-bot commented on Feb 22, 2024

marcochavezf commented on Feb 23, 2024

marcochavezf commented on Mar 4, 2024

23 remaining items

marcochavezf commented on Mar 14, 2024

melvin-bot commented on Mar 20, 2024

Payment Summary

BugZero Checklist (@greg-schroeder)

DylanDylann commented on Mar 22, 2024

greg-schroeder commented on Mar 25, 2024

greg-schroeder commented on Mar 25, 2024

greg-schroeder commented on Mar 25, 2024

fedirjh commented on Mar 25, 2024

greg-schroeder commented on Mar 26, 2024

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions