7 moderate severity vulnerabilities after last update

[onemen]

@raineorshine

When dependabot install updates I don't think it check for vulnerabilities

After installing version 22.2.1 there are 7 moderate severity vulnerabilities

I can open PR to update overrides

[raineorshine]

Thanks for bringing this to my attention.

What do you use to check for vulnerabilities? How can we create an automated workflow for it? We can either tie it to each dependabot update, or just run it before each release.

[onemen]

I do it manually npm audit

some vulnerabilities are not related to new version, npm report about new vulnerabilities as they discovered
you can configure github to send a weekly report about it

[raineorshine]

Thanks. Seems to already be enabled: