update some vulnerable dependencies - #58
Conversation
- ran `npm audit fix` - Bump lodash from 4.17.21 to 4.17.23 - Bump webpack from 5.97.1 to 5.105.2
15c5418 update vulnerable deps (#133) 5053402 Sync a few config files with their counterparts in core (#129) git-subtree-dir: src/create-process-test git-subtree-split: 15c54182fb26553b2f12f013d105591530c8ba15
15c5418 update vulnerable deps (#133) 5053402 Sync a few config files with their counterparts in core (#129) git-subtree-dir: src/theme-selector git-subtree-split: 15c54182fb26553b2f12f013d105591530c8ba15
15c5418 update vulnerable deps (#133) 5053402 Sync a few config files with their counterparts in core (#129) git-subtree-dir: src/verse-ref-view git-subtree-split: 15c54182fb26553b2f12f013d105591530c8ba15
- ran `npm audit fix` - remaining known vulnerability `ajv` is dev-only (linting)
tjcouch-sil
left a comment
tjcouch-sil
left a comment
There was a problem hiding this comment.
Everything but top-level package-lock.json looks great! The top-level package-lock.json looks like it has tons of really big changes - ~20,000 lines added according to GitHub. Is that expected? I didn't think that many packages got updated. Did you do the npm i on merge conflicts trick, or did you delete and recreate the lock file? The lower-level package-lock.json files have ~500 lines changed. Seems like a surprisingly large difference. Of course, the lower-level ones aren't being used and so probably don't have as much stuff, but it just drew my attention.
@tjcouch-sil reviewed 19 files and all commit messages, and made 1 comment.
Reviewable status: 19 of 20 files reviewed, all discussions resolved.
irahopkinson
left a comment
irahopkinson
left a comment
There was a problem hiding this comment.
Yep, the top 2/3 of the file is all addition of ../paranext-core/lib/platform-bible-utils/node_modules stuff. I don't see that as an issue to anything in this repo. I didn't do anything special to the lock file. After each round of template updates and conflict resolution (for the lock file I just take what is existing) I do an npm i to fix up the lock file then commit and repeat.
@irahopkinson made 1 comment.
Reviewable status: 19 of 20 files reviewed, all discussions resolved (waiting on tjcouch-sil).
tjcouch-sil
left a comment
tjcouch-sil
left a comment
There was a problem hiding this comment.
Ok perfect, thanks! Just checking :) also quick reminder to merge without squashing :)
@tjcouch-sil reviewed 1 file and made 1 comment.
Reviewable status:complete! all files reviewed, all discussions resolved (waiting on irahopkinson).
2 participants
npm audit fixajvis dev-only (linting)Tested 3 of the 4 sample extensions.
This change is