goatandsheep / rc Goto Github PK

View Code? Open in Web Editor NEW

7.0 7.0 1.0 122 KB

The non-configurable configuration loader for lazy people.

Home Page: https://www.npmjs.com/package/run-con

License: Other

JavaScript 100.00%

config hacktoberfest rc runtime-config

rc's People

Contributors

Stargazers

Watchers

Forkers

gabibguti

rc's Issues

CVE-2021-44906 due to dependency on `minimist-1.2.5`

Our vulnerability tracking software has flagged that run-con-1.2.0 has CVE-2021-44906 because it depends onminimist-1.2.5.

Now that minimist-1.2.6 is available, suggest bumping to minimist-1.2.6 in package.json and publishing run-con-1.2.1.

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

fix(deps): update dependency ini to v4.1.2

Ignored or Blocked

These are blocked by an existing closed PR and will not be recreated unless you click a checkbox below.

fix(deps): update dependency strip-json-comments to v5

Detected dependencies

circleci

.circleci/config.yml

node 5.2.0

github-actions

.github/workflows/coverage.yml

actions/checkout v4

actions/setup-node v4

codecov/codecov-action v4

.github/workflows/dependabot.yml

actions/checkout v4

.github/workflows/issuehunt.yml

actions/checkout v4

npm

package.json

deep-extend ^0.6.0

ini ~4.1.0

minimist ^1.2.8

strip-json-comments ~3.1.1

Check this box to trigger a request for Renovate to run again on this repository

Dependabot PR Bump ini from 3.0.0 to 4.1.0 opened

Dependabot has opened PR #40
Link: https://api.github.com/repos/goatandsheep/rc/pulls/40

Set least privilege permissions for GitHub Workflow tokens

Proposal

Hello, I'm working on behalf of Google and the Open Source Security Foundation to help open-source projects improve their supply-chain security.

I see we are not setting minimum permissions for the GitHub Workflows in this project. And how does that matter? Setting minimum permission is interesting to prevent attackers from using a compromised GITHUB_TOKEN with write access to push malicious code into the project. And how do we do that? By setting permissions on each workflow to read only, or the least access they need.

This is considered a security best practice and therefore helps improve the project's security posture.

Would you be interested in a PR to do this?

Additional Context

Setting least privilege permissions is recommended by:

Let me know if you have any questions!