Several security vulnerabilities seen in `amp-github-apps` repo about amp-github-apps HOT 8 CLOSED

There had been a renovate PR for a while for Probot, but it broke owners, so I finally got to the bottom of that and fixed it. Jest, I don't recall seeing a renovate PR, and there was nothing pending. According to npm outdated, test-status was fine; it was just that set-value was a transitive dependency of a few direct dependencies that hadn't yet upgraded themselves.

from amp-github-apps.

/cc @danielrozenberg @erwinmombay @estherkim

from amp-github-apps.

renovate-bot is already on for this repo, and all renovate-bot PRs that I haven't approved are assigned to @estherkim, @erwinmombay, and @rcebulko

from amp-github-apps.

The purpose of this issue is to track the fixing of security vulnerabilities. I've edited the description. Reopening until the alerts are gone.

from amp-github-apps.

Is there a way for us to see open vulnerabilities, or only repo admins/owners?

from amp-github-apps.

@rcebulko You should have access once you become a part of @ampproject/wg-infra. Let's chat offline about how we can make that happen.

Edit: You've been invited.

from amp-github-apps.

/cc @rsimha

from amp-github-apps.

Curious: For all the packages that you manually upgraded, were there renovate PRs that we couldn't merge for some reason or the other?

from amp-github-apps.