Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update outdated dependencies #319

Merged
merged 2 commits into from
Nov 15, 2024
Merged

Update outdated dependencies #319

merged 2 commits into from
Nov 15, 2024

Conversation

dkotter
Copy link
Collaborator

@dkotter dkotter commented Nov 14, 2024

Description of the Change

This PR updates all of our outdated direct node dependencies.

It also resolves two security issues with dependencies other dependencies are including. Dependabot normally fixes those but it seems to be having issues with these two (for those with access, can see this under the Security > Dependabot setting).

Here's what I did:

  1. For any dependencies we are directly managing in our package.json file, bump those to the latest version, except for mochawesome-json-to-md as this is known to break our E2E workflow
  2. Remove the existing package-lock.json file
  3. Run npm install to bring in all the latest versions of packages
  4. Run npm audit to see if any security issues remain
  5. Two issues were flagged, one with @sentry/node and one with puppeteer-core. These are dependencies used by the lighthouse dependency, which is relied on by @wordpress/scripts. We're already using the latest version of @wordpress/scripts so updating that won't fix things. Instead, I directly updated those dependencies to their latest in the package-lock.json file. This fixes the security issues for now though those updates will be wiped out the next time we update @wordpress/scripts

How to test the Change

Verify all tests pass on this PR

Changelog Entry

Security - Bump @10up/cypress-wp-utils from 0.2.0 to 0.4.0
Security - Bump @sentry/node from 6.19.7 to 8.38.0
Security - Bump @wordpress/env from 9.2.0 to 10.11.0
Security - Bump cypress from 13.2.0 to 13.15.2
Security - Bump cypress-mochawesome-reporter from 3.6.0 to 3.8.2
Security - Bump puppeteer-core from 23.3.0 to 23.8.0

Credits

Props @dkotter

Checklist:

@dkotter dkotter added this to the 2.8.3 milestone Nov 14, 2024
@dkotter dkotter self-assigned this Nov 14, 2024
@dkotter dkotter requested a review from jeffpaul as a code owner November 14, 2024 21:59
@github-actions github-actions bot added the needs:code-review This requires code review. label Nov 14, 2024
@dkotter dkotter merged commit 892aeea into develop Nov 15, 2024
15 checks passed
@dkotter dkotter deleted the fix/update-dependencies branch November 15, 2024 18:07
@jeffpaul
Copy link
Member

Great description, thanks for getting these updated!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
needs:code-review This requires code review.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants