How to submit a Gatsby plugins security vulnerabilities patch?

[jpventura]

TL; DR

Modifications submitted on PR #31251

Details

I was updating a Gatsby Starter package and it was not possible running npm audit fix due a circular dependency on gatsby.

Also I could not figure out how to run the local tests only on the problematic packages, but (according Circle CI report), only e2e_tests_pnp tests failed.

My starter direct dependencies are:

• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]

NPM Audit Report

The data from this report was generated by npm audit --json and the packages linked to Snyk I/O as possible.

name	severity	fix available
babel-plugin-remove-graphql-queries	high	[email protected]
engine.io-client	high	[email protected]
gatsby	high	[email protected]
gatsby-plugin-manifest	high	[email protected]
gatsby-plugin-material-ui	high	[email protected]
gatsby-plugin-offline	high	[email protected]
gatsby-plugin-page-creator	high	undefined@undefined
gatsby-plugin-react-helmet	high	[email protected]
gatsby-plugin-sharp	high	[email protected]
gatsby-plugin-typescript	high
gatsby-plugin-utils	high	[email protected]
gatsby-source-filesystem	high	[email protected]
gatsby-transformer-sharp	high	[email protected]
socket.io-client	high	[email protected]
xmlhttprequest-ssl	high	[email protected]

[LekoArts]

Please see #31266 (comment) for why you need to take such reports with a grain of salt. Additionally, I don't see how e.g. gatsby-plugin-react-helmet has a "high" severity? Synk doesn't show anything -- so not sure what you're trying to say here :)