Skip to content

Add Gatsby lockfile example and verified case study#494

Merged
sonukapoor merged 1 commit into
OWASP:mainfrom
Ayush7614:ayush7
Jun 2, 2026
Merged

Add Gatsby lockfile example and verified case study#494
sonukapoor merged 1 commit into
OWASP:mainfrom
Ayush7614:ayush7

Conversation

@Ayush7614
Copy link
Copy Markdown
Contributor

Summary

  • Adds lockfile-only snapshot examples/gatsby/ from gatsbyjs/gatsby@1f38c85 (package.json + Yarn Classic yarn.lock).
  • Documents a verified baseline scan in website/docs/case-studies/gatsby.md (3,568 packages, 128 findings, yarn audit comparison).
  • Hosts the Gatsby monogram locally at website/static/img/gatsby-logo.svg so the case study image loads reliably on the docs site.
  • Includes full case study sections: Remaining risk, Baseline findings (128-row table), and Want your project reviewed?

Test plan

  • npm run build && node dist/index.js examples/gatsby --verbose --all — 128 findings (9 critical · 66 high · 42 medium · 11 low)
  • cd examples/gatsby && yarn audit — comparison numbers documented in case study
  • cd website && npm run build — Docusaurus build succeeds
  • Case study page loads with logo at /cve-lite-cli/docs/case-studies/gatsby

Made with Cursor

@Ayush7614
Copy link
Copy Markdown
Contributor Author

cc: @sonukapoor

Copy link
Copy Markdown
Collaborator

@sonukapoor sonukapoor left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Gatsby study is solid — the Yarn Classic path limitation note sets honest expectations, the 5-direct/123-transitive split is well-explained, and the multi-major js-yaml situation is a nice detail. One thing before this merges: the branch has 3 commits. Please squash them into one (git rebase -i origin/main, then git push --force-with-lease) so the history stays clean.

Copy link
Copy Markdown
Collaborator

@sonukapoor sonukapoor left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good content and structure — a few missing pieces before merge:

README not updated. The case studies list in README.md and the in-repo fixtures line ("Astro, Turborepo, and Visual Studio Code live under examples/...") both need entries for this project. Follow the pattern of the existing entries.

CHANGELOG entry missing. No CHANGELOG.md update in the diff. Add a line to the [Unreleased] section under ### Docs following the same one-line format as the other case study entries.

Add a row to website/docs/case-studies/index.md. A case studies index page was added after your branch was cut — it's on main now but missing an entry for this project. After rebasing you'll find it at website/docs/case-studies/index.md. Use the format from the existing rows as a guide.

Please also rebase against main before pushing — the branch is behind the v1.18.2 release.

Snapshot gatsbyjs/gatsby Yarn Classic lockfile (3,568 packages, 128 findings)
with full case study, local logo, yarn audit comparison, case studies index,
README and CHANGELOG updates.
@Ayush7614
Copy link
Copy Markdown
Contributor Author

Thanks for the review @sonukapoor — addressed the requested updates:

  • Squashed to a single commit and rebased onto latest main
  • Added Gatsby to the README case studies list and in-repo fixtures line
  • Added [Unreleased] CHANGELOG entry under ### Docs
  • Added Gatsby row to website/docs/case-studies/index.md

I will update anything else you flag on this PR. Please take another look when you have a moment.

Copy link
Copy Markdown
Collaborator

@sonukapoor sonukapoor left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All feedback addressed — README, CHANGELOG, and index.md all updated, rebased cleanly against main. Good to merge.

@sonukapoor sonukapoor merged commit 237341a into OWASP:main Jun 2, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants