Update various dependencies to fix vulnerabilities - #2618
lucas-koehler wants to merge 6 commits into
Conversation
✅ Deploy Preview for jsonforms-examples ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
coverage: 84.582% (+0.002%) from 84.58% — lk/update-deps into master |
0a4ff0f to
7a64043
Compare
sdirix
left a comment
sdirix
left a comment
There was a problem hiding this comment.
Works for me. Just minor suggestions which could also be done in a follow up.
| @@ -88,7 +88,7 @@ | |||
| "dependencies": { | |||
| "@date-io/dayjs": "^3.0.0", | |||
| "dayjs": "1.10.7", | |||
There was a problem hiding this comment.
dayjs is the one production dependency left untouched here while dev dayjs moved to ^1.11.11 in angular-material and vue-vuetify. Was skipping it deliberate? We should also use a caret here, I think.
There was a problem hiding this comment.
Agreed, it should align with the others. It was left untouched by the automatic pnpm audit fix. I'll align it.
| "@babel/plugin-proposal-nullish-coalescing-operator": "^7.16.5", | ||
| "@babel/plugin-proposal-optional-chaining": "^7.16.5", | ||
| "@babel/plugin-proposal-nullish-coalescing-operator": "^7.18.6", | ||
| "@babel/plugin-proposal-optional-chaining": "^7.21.0", |
There was a problem hiding this comment.
These two are deprecated by Babel, but the better move is dropping them rather than bumping. They are only reachable via webpack.base.js (dev server only, build and build:examples-app use rollup) and via the NODE_ENV === 'test' branch in vue / vue-vanilla, where @vue/cli-plugin-babel/preset already pulls in preset-env, which ships both transforms already.
| "@angular/platform-browser-dynamic": "^20.3.31", | ||
| "@angular/router": "^20.3.31", | ||
| "@babel/plugin-proposal-nullish-coalescing-operator": "^7.18.6", | ||
| "@babel/plugin-proposal-optional-chaining": "^7.21.0", |
There was a problem hiding this comment.
These two are dead here. angular-material has no babel config and no reference to babel in its sources or build config (Angular CLI runs its own pipeline), so these devDeps are never used. Dropping them is better than bumping.
Also removes obsolete dayjs year padding workaround in the material-renderers package. dayjs pads 'YYYY' to 4 digits since 1.11.8
Replace usage of @babel/plugin-proposal-nullish-coalescing-operator and @babel/plugin-proposal-optional-chaining with @babel/preset-env
7a64043 to
27b472c
Compare
|
@sdirix Thanks for the review and the comments! They all made sense to me and I addressed all of them. |
This branch has not been deployed
3 participants
Uh oh!
There was an error while loading. Please reload this page.