Cwa-website: [svengbr] cypress-plugin-snapshots causes GitHub Dependabot message

[MikeMcC399]

Where to find the issue

https://github.com/corona-warn-app/cwa-website/blob/master/package.json

Line 54

"devDependencies": {
   ...
    "cypress-plugin-snapshots": "^1.4.3",
   ...  
}

Describe the issue

This is a follow-on to Differences in package-lock.json from nodejs concerning the web test environment.

cypress-plugin-snapshots defined in the devDependencies object of package.json causes the github Dependabot to warn that jpeg-js needs to be updated to >=0.4.0, however that is not possible because of dependencies defined in the package [email protected].

Dependabot advises:
[email protected] requires jpeg-js@^0.3.4 via a transitive dependency on @jimp/[email protected]

There is further information in https://github.com/advisories/GHSA-w7q9-p3jq-fmhm.

[DawChihLiou]

Link to PR https://github.com/meinaart/cypress-plugin-snapshots/pull/159 in cypress-plugin-snapshots

[MikeMcC399]

@DawChihLiou
Thanks for drawing the attention to the issue in the cypress-plugin-snapshots repo!

https://github.com/oliver-moran/jimp/blob/master/README.md#notice-of-potentially-breaking-change includes:

Notice of potentially breaking change

As of v0.10.4, core-js is no longer included with jimp or its extensions. If you rely on core-js, install it with either yarn add core-js or npm i core-js

which may make fixing the dependencies more complicated.

At least now the issue has been reported in the correct place.

[DawChihLiou]

Glad to help!
Updating @jimp alone should be sufficient. I double checked and there's no dependencies depend on core-js other than @jimp in the plugin.

[MikeMcC399]

@DawChihLiou
Nobody has responded to your PR https://github.com/meinaart/cypress-plugin-snapshots/pull/159 yet. In fact, the repo https://github.com/meinaart/cypress-plugin-snapshots/pulse/monthly shows little activity, and there haven't been any commits pushed to master there in the last month. 😞