Upgrade dependencies and fix security alerts #3859
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Although github only showed 5 alerts,
yarn audit
complained about >85 vulnerable packages. Fortunately, ayarn upgrade
(which updates all packages as far as it is allowed by the package.json) fixed most of these issues. Of course there were libs that introduced breaking changes in minor versions (looking at you airbrake-js - that's why I needed to include thecross-fetch
dependency).There is one remaining alert by
yarn audit
, but there is an open PR in the library's repo which we should get viayarn upgrade
in the next weeks.I did some testing by myself and couldn't find any major issues.
Not sure whether we should execute the testing protocol, but as the libs with major version updates were all devDependencies, I would hope we won't need to execute it.
Related note: We should probably run
yarn upgrade
more often, it removed lots of very old package versions which should benefit the bundle size as well :)(I checked out of interest and can confirm: vendor-bundle got ~20% smaller locally - from 27MB to 22MB)
URL of deployed dev instance (used for testing):
Steps to test:
yarn audit
.Issues: