Skip to content

[Snyk] Security upgrade octokit from 2.1.0 to 5.0.2 #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk] Security upgrade octokit from 2.1.0 to 5.0.2 #10

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion examples/notion-github-sync/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,6 @@
"@notionhq/client": "file:../../",
"dotenv": "^16.0.1",
"lodash": "^4.17.21",
"octokit": "^2.0.3"
"octokit": "^5.0.2"
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

Upgrading octokit from ^2.1.0 to ^5.0.2 is a major version change and introduces a critical new requirement: Node.js v14.17.0 or later.

Dependencies of octokit v5.0.2, such as @octokit/core v5.x, @octokit/plugin-paginate-rest v7.x, and @octokit/plugin-rest-endpoint-methods v9.x, explicitly require Node.js >= 14.17.0. The previous version, octokit v2.1.0, supported older Node.js versions (e.g., Node 10).

This could be a breaking change if the environment where this example is run, or if users attempting to run this example, are on an older Node.js version. The Snyk metadata for this PR also flags this as a breaking change (isBreakingChange:true).

To ensure the continued functionality and clarity of this example, could you please consider the following actions?

  1. Verify Functionality: Thoroughly test this notion-github-sync example with octokit v5.0.2 and a compatible Node.js version (>=14.17.0) to ensure the existing logic, especially the pagination part in index.js (lines 112-129), still works as expected. While the pagination code structure appears compatible, subtle API changes are always possible with major version bumps.
  2. Update Documentation: Modify the examples/notion-github-sync/README.md to clearly state the required Node.js version (e.g., Node.js 14.17.0 or later).
  3. Specify Engine (Recommended): Consider adding an engines field to this package.json to formally declare the Node.js version requirement. For example: 
    "engines": {
  "node": ">=14.17.0"
}
    This helps prevent runtime issues for users with incompatible Node.js versions.

Addressing these points will help maintain the example's usability and prevent unexpected failures for its users.

}
}