audit log issues: review + merge dependabot's pull requests

[patrickp-rthinfo]

Hello,

despite cz-customizable being a dev dependency, it would be great if someone with write access could review + merge the pull requests filed by dependabot. As of now, cz-customizable is flagged within npm audit for having several vulnerable dependencies (some of them direct, some transitive).

[leonardoanalista]

yes, I am keen to improve he security @patrickp-rthinfo.
I've been merging some upgrade PR's.
How can we proceed? any suggestions?

[patrickp-rthinfo]

Personally, I like snyk. You might also consider dependency tracker.

[leonardoanalista]

I created a PR to add Trivy yesterday: #194 (still open)
What do you think about Trivy. That's what we are using at work. Is snyk better than trivy?

This repo also has codeQL.

Your initial question was around dependency and sec. Yes, I am going to address both.

• I created a PR to remove several: feat: remove several deps improve testing code #188
• I updated all dependencies: chore: update many deps #195
• converted all tests to Jest (code coverage is still a WIP)