chore: update NPM dependencies #685
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jamaljsr
force-pushed
the
update-deps
branch
from
1f82b98 to
babf70b
Compare
itsrachelfish
approved these changes
Nov 27, 2023
ViktorT-11
approved these changes
Nov 30, 2023
the dependencies of react-scripts are not used in production, so it makes sense to move them to dev dependencies to minimize the false positives when running `yarn audit --groups dependencies`. After making this change, I needed to add some module resolutions in order to keep storybook and jest working.
jamaljsr
force-pushed
the
update-deps
branch
from
babf70b to
b61a20b
Compare
|
Thanks for the reviews. Just rebased on |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I've updated some of the NPM packages to resolve known security vulnerabilities in dependencies.
Since this project uses
create-react-app, not all of the dependencies are used in the production build. Many of them, especially the dependencies ofreact-scripts, are only used in the development environment or during CI builds. Vulnerabilities found in these dev dependencies are less of a threat because 99% of the time, the vulnerability cannot be exploited via the build output (html/js) that runs in the browser.Here are more detailed explanations of the situation:
facebook/create-react-app#11174
https://overreacted.io/npm-audit-broken-by-design/
To ensure that we are addressing any true security concerns, we should be sure to keep any user facing code listed in the
dependencieslist and all build-time dependencies indevDependencies. Then we can use the commandyarn audit --groups dependenciesto easily list all packages that we are using with known vulnerabilities.Here's the output of this command before the changes in this PR:
Here's the output of this command after the changes in this PR. The warnings are due to us now forcing updates to our dependency's dependencies.