@lizpearl
Can I get confirmation that we can dismiss the following warning:

• 49: PostCSS line return parsing error - postcss already recommended stable version 8.4.31 in main

And dismiss or not resolve the following warning:

• 80: Uncontrolled resource consumption in braces The braces vulnerability is from dependencies in @uswds/compile. We can't resolve this vulnerability until it's resolved on their end.

@erinysong it's unclear to me that the first acceptance criteria was met here. Can you explain why that initial link still has several vulnerable dependencies?

If sensitive, feel free to share elsewhere. cc: @lizpearl @abroddrick

thank you for the heads up @h-m-f-t. hm it looks duplicate warnings got created for each dependabot vulnerability. For example open warning 116 is identical to the resolved warning 117. Just cross checked with every open dependency and aside from the exceptions listed above, each one has an identical vulnerability warning marked as fixed.

I would lean resolving the duplicate vulnerability warnings that didn't get marked fixed since updating our dependencies should resolve them but also open to other suggestions

Thanks Erin! That makes sense.

update - I was wrong and the open issues were actually because the warnings were being caught in different files. Manually updating our Python dependencies should fix this and will do that right now. Thank you @lizpearl for finding the source!

Open Django warnings have been resolved in #3277 - thank you for bringing this to attention!