Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore: Bump dependencies to reduce vulnerabilities in /ui #4654

Merged
merged 7 commits into from
Oct 20, 2024
Merged

chore: Bump dependencies to reduce vulnerabilities in /ui #4654

merged 7 commits into from
Oct 20, 2024

Commits on Oct 20, 2024

  1. chore: Bump transitive word-wrap from 1.2.3 to 1.2.5 in /ui 

    This resolves a vulnerability in word-wrap:
GHSA-j8xg-fqg3-53r7.

Signed-off-by: Harri Lehtola <[email protected]>
    @peruukki
    peruukki committed Oct 20, 2024
    Configuration menu
    Copy the full SHA
    0e3334a View commit details
    Browse the repository at this point in the history

  2. chore: Bump protobufjs-cli from 1.0.2 to 1.1.3 in /ui 

    The older version depended on taffydb that has a vulnerability with no
patched version available. The latest version no longer uses it.

Signed-off-by: Harri Lehtola <[email protected]>
    @peruukki
    peruukki committed Oct 20, 2024
    Configuration menu
    Copy the full SHA
    b21b723 View commit details
    Browse the repository at this point in the history

  3. chore: Bump transitive dependencies of msw in /ui 

    This resolves 1 critical and 1 high level vulnerability in @xmldom/xmldom
and path-to-regexp.

Signed-off-by: Harri Lehtola <[email protected]>
    @peruukki
    peruukki committed Oct 20, 2024
    Configuration menu
    Copy the full SHA
    b238165 View commit details
    Browse the repository at this point in the history

  4. chore: Bump vulnerable rollup packages to latest versions in /ui 

    This resolves 1 high and 9 moderate level vulnerabilities reported by
`yarn audit`.

Signed-off-by: Harri Lehtola <[email protected]>
    @peruukki
    peruukki committed Oct 20, 2024
    Configuration menu
    Copy the full SHA
    b5fca32 View commit details
    Browse the repository at this point in the history

  5. chore: Bump @babel packages to latest in /ui 

    This resolves 16 high level vulnerabilities reported by `yarn audit`.

Signed-off-by: Harri Lehtola <[email protected]>
    @peruukki
    peruukki committed Oct 20, 2024
    Configuration menu
    Copy the full SHA
    34f16e0 View commit details
    Browse the repository at this point in the history

  6. chore: Use browserslist default configuration in Feast UI 

    "defaults" (https://browsersl.ist/#q=defaults) is the recommended starting
point these days, it's a shorthand for "> 0.5%, last 2 versions, Firefox
ESR, not dead". Using it gets rid of a couple autoprefixer related warnings
that started appearing after dependency updates.

Check the previous production configuration at
https://browsersl.ist/#q=%3E0.2%25%2C+not+dead%2C+not+op_mini+all if you
want to compare what changed.

Signed-off-by: Harri Lehtola <[email protected]>
    @peruukki
    peruukki committed Oct 20, 2024
    Configuration menu
    Copy the full SHA
    18fa434 View commit details
    Browse the repository at this point in the history

  7. chore: Bump react-scripts from 5.0.0 to 5.0.1 in /ui 

    This resolves 2 critical, 11 high, 7 moderate and 1 low level vulnerability
reported by `yarn audit`.

@babel/plugin-proposal-private-property-in-object is added to
devDependencies due to this warning when running the tests:

> One of your dependencies, babel-preset-react-app, is importing the
> "@babel/plugin-proposal-private-property-in-object" package without
> declaring it in its dependencies. This is currently working because
> "@babel/plugin-proposal-private-property-in-object" is already in your
> node_modules folder for unrelated reasons, but it may break at any time.
>
> babel-preset-react-app is part of the create-react-app project, which
> is not maintianed (sic) anymore. It is thus unlikely that this bug will
> ever be fixed. Add "@babel/plugin-proposal-private-property-in-object" to
> your devDependencies to work around this error. This will make this message
> go away.

Signed-off-by: Harri Lehtola <[email protected]>
    @peruukki
    peruukki committed Oct 20, 2024
    Configuration menu
    Copy the full SHA
    6d702cf View commit details
    Browse the repository at this point in the history