Vulnerabilities Alerts

[alex-hedley]

Is it worth turning on in Vulnerabilities Alerts in the repo settings?

---

Example

• https://github.com/alex-hedley/design-history/security/dependabot

liquidjs Version < 10.0.0 Upgrade to ~> 10.0.0
Defined in package-lock.json
Vulnerabilities CVE-2022-25948 Moderate severity

request Version <= 2.88.2
Defined in package-lock.json

tough-cookieVersion< 4.1.3 Upgrade to ~> 4.1.3
Defined in package-lock.json
Vulnerabilities CVE-2023-26136 Moderate severity

[frankieroberto]

I think it actually is enabled already. There are 7 alerts (although not for the packages listed above), all for things that can't be updated due to conflicting dependencies... 😬

We should probably spend some time working through all these.

[alex-hedley]

@frankieroberto I'm not seeing anything on the Security tab, is this a permissions issue?