search

FormidableLabs / spectacle

A React-based library for creating sleek presentations using JSX syntax that gives you the ability to live demo your code.
https://commerce.nearform.com/open-source/spectacle/
MIT License
9.7k stars 690 forks source link

upgrade loader-utils, ts-jest, & babel/core to fix security warnings #1321

Closed Burnett2k closed 3 months ago

Burnett2k commented 3 months ago

Unfortunately, upgrading loader-utils previously didn't fully remediate all warnings. In order to get to a non-vulnerable version, we need to bump major versions.

I ran the app locally to ensure it still works, and verified there's not any breaking changes in the new major version that would affect us.

Link to dependabot warning for loader-utils Link to dependabot warning(s) for json5. 173 & 172

image

loader-utils change log https://github.com/webpack/loader-utils/blob/master/CHANGELOG.md#200-2020-03-17

Babel change log https://github.com/babel/babel/blob/main/CHANGELOG.md#v7196-2022-10-20

fixes loader-utils & json5 vulnerability in version 1.4.2. Part of #1318

changeset-bot[bot] commented 3 months ago

🦋 Changeset detected

Latest commit: a8ca4c67ac3ca93b483244416794dd80a6d6f939

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages | Name | Type | | -------------------- | ----- | | spectacle | Patch | | spectacle-mdx-loader | Patch |

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

vercel[bot] commented 3 months ago

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
spectacle-docs-website ✅ Ready (Inspect) Visit Preview 💬 Add feedback Mar 11, 2024 4:33pm