Anyone know about this issue. It was about GitHub ...

# javascript

[Tóth István Zoltán]

Anyone know about this issue. It was about GitHub reporting vulnerabilities because of Yarn lock.

I'm upgrading my Gradle config and I cannot find this issue on YouTrack, maybe I'm looking at the wrong place?

https://youtrack.jetbrains.com/issue/KT-50848/Kotlin-JS-inner-build-routines-are-using-vulnerable-NPM-dependencies-and-now-that-we-have-kotlin-js-store-github-audit-this

[Edoardo Luppi]

Can't see the issue, the visibility is probably restricted.

[Tóth István Zoltán]

Yes, hence I'm asking. :D

[Edoardo Luppi]

Where did you find it? But yeah it happens if it's security-related.
No idea what it is about tho.

[Tóth István Zoltán]

It was public once (a year ago I think). I added a workaround into my Gradle config based on this issue (which still works, I mean the workaround). Now I'm optimising my Gradle setup and wanted to update and/or remove the workaround.

[Tóth István Zoltán]

It is not an actual vulnerability, it is about Github reporting a vulnerability.

[Edoardo Luppi]

What was the workaround? Just curious.

[Tóth István Zoltán]

fun Project.skipYarnLock() {
    // this is ugly but I don't use JS dependencies anyway,
    // <https://youtrack.jetbrains.com/issue/KT-50848/Kotlin-JS-inner-build-routines-are-using-vulnerable-NPM-dependencies-and-now-that-we-have-kotlin-js-store-github-audit-this>
    rootProject.plugins.withType<org.jetbrains.kotlin.gradle.targets.js.yarn.YarnPlugin> {
        rootProject.the<org.jetbrains.kotlin.gradle.targets.js.yarn.YarnRootExtension>().lockFileName = "skip-yarn-lock"
    }
}

[Edoardo Luppi]

Ahh ok, you simply rename the lockfile so it doesn't get picked up by GitHub.

[Tóth István Zoltán]

Yes, nothing major.

[Tóth István Zoltán]

And I typically add the issue in a comment, so that's how I had the URL.

[Edoardo Luppi]

Does GitHub still complain if you remove the workaround? I guess dependencies are now more up to date and probably have no vulnerabilities.

[Tóth István Zoltán]

I don't know, but it is a good idea, I'll try that, thanks.

[Edoardo Luppi]

I found that Archive.org archived that URL in 2022 (tho not working), so definitely try removing the workaround as deps have changed.