Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Revert Package Versions #876

Open
wants to merge 13 commits into
base: master
Choose a base branch
from
Open

Conversation

HappyViki
Copy link
Collaborator

@HappyViki HappyViki commented Jun 30, 2020

Moment broke after this merge: #873

I'm reverting as much as possible, and only updating packages that need to be updated.

Before: all packages got updated
After:

  1. "webpack-dev-server": "^3.11.0" (as before)
  2. "jest": "^24.7.1"
  3. npx npm-force-resolutions with this in package.json:
  "resolutions": {
    "minimist": "^1.2.3"
  },
  1. Move jest to devDependencies in docs' package.json
  2. Alphabetized some propTypes to resolve eslint errors
  3. Updated setupTestFrameworkScriptFile to setupFilesAfterEnv in package.json to resolve Jest Deprecation Warning

npm audit (only some audits)

# Run  npm update http-proxy --depth 3  to resolve 1 vulnerability
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Denial of Service                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ http-proxy                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ webpack-dev-server [dev]                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ webpack-dev-server > http-proxy-middleware > http-proxy      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1486                            │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ jest [dev]                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ jest > jest-cli > @jest/core > jest-runner > jest-haste-map  │
│               │ > sane > @cnakazawa/watch > minimist                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

@HappyViki
Copy link
Collaborator Author

HappyViki commented Jun 30, 2020

@sambev Should we use older versions of minimist for some dependancies?
https://www.npmjs.com/advisories/1179

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant