Update various dependencies to fix vulnerabilities - #2618
lucas-koehler wants to merge 4 commits into
Conversation
✅ Deploy Preview for jsonforms-examples ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
0a4ff0f to
7a64043
Compare
sdirix
left a comment
There was a problem hiding this comment.
Works for me. Just minor suggestions which could also be done in a follow up.
| @@ -88,7 +88,7 @@ | |||
| "dependencies": { | |||
| "@date-io/dayjs": "^3.0.0", | |||
| "dayjs": "1.10.7", | |||
There was a problem hiding this comment.
dayjs is the one production dependency left untouched here while dev dayjs moved to ^1.11.11 in angular-material and vue-vuetify. Was skipping it deliberate? We should also use a caret here, I think.
| "@babel/plugin-proposal-nullish-coalescing-operator": "^7.16.5", | ||
| "@babel/plugin-proposal-optional-chaining": "^7.16.5", | ||
| "@babel/plugin-proposal-nullish-coalescing-operator": "^7.18.6", | ||
| "@babel/plugin-proposal-optional-chaining": "^7.21.0", |
There was a problem hiding this comment.
These two are deprecated by Babel, but the better move is dropping them rather than bumping. They are only reachable via webpack.base.js (dev server only, build and build:examples-app use rollup) and via the NODE_ENV === 'test' branch in vue / vue-vanilla, where @vue/cli-plugin-babel/preset already pulls in preset-env, which ships both transforms already.
| "@angular/platform-browser-dynamic": "^20.3.31", | ||
| "@angular/router": "^20.3.31", | ||
| "@babel/plugin-proposal-nullish-coalescing-operator": "^7.18.6", | ||
| "@babel/plugin-proposal-optional-chaining": "^7.21.0", |
There was a problem hiding this comment.
These two are dead here. angular-material has no babel config and no reference to babel in its sources or build config (Angular CLI runs its own pipeline), so these devDeps are never used. Dropping them is better than bumping.
Uh oh!
There was an error while loading. Please reload this page.