Vulnerable dependencies
leandro-lucarella-sociomantic opened this issue · 21 comments
See https://github.com/sociomantic-tsunami/flounder/network/alerts
Please update.
It looks like this project is abandoned. Shall we archive it to make that clear for the general public?
i have:
- a git fork
- the keys to the npm repo
- the keys to the slack community
so it does not bother me one way or another whether the Soc side of things stays active (Though i've enjoy working with Soc DH, it does appear abandoned from that side)
as we use it in some areas in Zalando i will continue to maintain and (occasionally) update my branch
If we don't use it internally, I would also be open to transfer the repo to another organization if you plan to keep maintaining it.
@leandro-lucarella-sociomantic we are still using an old version of flounder in some parts of the UI, but eventually it will be removed, and yes, the development/maintenance from our side is abandoned.
@damian-rodriguez-sociomantic so a transfer/archival should be OK as long as:
- the old versions are still provided by the new maintainer if we transfer it
- the old versions can be still checked out via git if we archive it
Right?
@leandro-lucarella-sociomantic yes, it should be fine
@mousemke can you confirm if you are interested in getting this repo transferred to you/Zalando? If you are then I need to find out if I can actually do it (at the Dunnhumby side). Otherwise we will archive it.
confirmed
We will move forward with the transfer, and then we fork it from you in our org to make sure we can access the code as long as we need. @mousemke should we transfer to https://github.com/zalando or to https://github.com/mousemke?
mousemke. thanks!
You should rename remove your fork then:
The target account must not have a repository with the same name, or a fork in the same network.
https://help.github.com/en/articles/transferring-a-repository
All users of this repo should also read that whole guide, as they should update their git URLs in their clones for example.
If you are uncomfortable with that we could also just add a note to the README saying the project moved and archive this one.
renamed
ah. saw the edit. one sec
removed
You can only transfer a repository from an organization to yourself at this time
Really, GitHub? 🙄
Is not even mentioned in the guide, so I wonder if it is a temporary limitation or an undocumented limitation. I could try asking to GH support, I'll try.
lol it's always something
OK, GitHub never got back to me so I went through the triangle. You should get a transfer request from my user.
OK, just for the records, transfer done. This issue is now on your hands @mousemke :)