search

appsembler / figures

Reporting and data retrieval app for Open edX
MIT License
44 stars 37 forks source link

Bump shell-quote and react-dev-utils in /frontend #466

Closed dependabot[bot] closed 2 years ago

dependabot[bot] commented 2 years ago

Bumps shell-quote and react-dev-utils. These dependencies needed to be updated together. Updates shell-quote from 1.6.1 to 1.7.3

Release notes

Sourced from shell-quote's releases.

v1.7.2

  • Fix a regression introduced in 1.6.3. This reverts the Windows path quoting fix. (144e1c2)

v1.7.1

  • Fix $ being removed when not part of an environment variable name. (@​Adman in #32)

v1.7.0

  • Add support for parsing >> and >& redirection operators. (@​forivall in #16)
  • Add support for parsing <( process substitution operator. (@​cuonglm in #15)

v1.6.3

  • Fix Windows path quoting problems. (@​dy in #34)

v1.6.2

  • Remove dependencies in favour of native methods. (@​zertosh in #21)
Changelog

Sourced from shell-quote's changelog.

1.7.3

  • Fix a security issue where the regex for windows drive letters allowed some shell meta-characters to escape the quoting rules. (CVE-2021-42740)

1.7.2

  • Fix a regression introduced in 1.6.3. This reverts the Windows path quoting fix. (144e1c2)

1.7.1

  • Fix $ being removed when not part of an environment variable name. (@​Adman in #32)

1.7.0

  • Add support for parsing >> and >& redirection operators. (@​forivall in #16)
  • Add support for parsing <( process substitution operator. (@​cuonglm in #15)

1.6.3

  • Fix Windows path quoting problems. (@​dy in #34)

1.6.2

  • Remove dependencies in favour of native methods. (@​zertosh in #21)
Commits


Updates react-dev-utils from 5.0.3 to 12.0.1

Changelog

Sourced from react-dev-utils's changelog.

2.0.3 and Newer Versions

Please refer to CHANGELOG-2.x.md for the 2.x range, and https://github.com/facebook/create-react-app/blob/main/CHANGELOG.md for the newer versions.

1.1.5 (August 24, 2018)

  • react-scripts

    • Update the webpack-dev-server dependency

  • react-dev-utils

    • #4866 Fix a Windows-only vulnerability (CVE-2018-6342) in the development server (@​acdlite)
    • Update the sockjs-client dependency

Committers: 1

Migrating from 1.1.4 to 1.1.5

Inside any created project that has not been ejected, run:

npm install --save --save-exact react-scripts@1.1.5

or

yarn add --exact react-scripts@1.1.5

1.1.4 (April 3, 2018)

:bug: Bug Fix

Committers: 1

Migrating from 1.1.3 to 1.1.4

Inside any created project that has not been ejected, run:

</tr></table>

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by iansu, a new releaser for react-dev-utils since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/appsembler/figures/network/alerts).
johnbaldwin commented 2 years ago

This PR is doing this update, a production code dependency

    "react-dev-utils": "^5.0.2",
    "react-dev-utils": "^12.0.1",

This update causes version compatibility issues. PR tests are failing on Node incompatibility. To note, Figures React version is also quite out of date, running v16.5: https://github.com/appsembler/figures/blob/main/frontend/package.json#L50 , two versions behind the current React v18.2.

Created an issue to track this - https://github.com/appsembler/figures/issues/468

error react-dev-utils@12.0.1: The engine "node" is incompatible with this module. Expected version ">=14". Got "12.22.12"

Something to to understand clearly is how dependent Figures needs to be on front end package versions running off the edx-platform release.

johnbaldwin commented 2 years ago

@OmarIthawi wrote

Seems like a big/breaking change. I don't think we should merge it.

Yep. My comment above elaborates on this problem and I created a GH issue to track it

dependabot[bot] commented 2 years ago

OK, I won't notify you again about this release, but will get in touch when a new version is available.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

johnbaldwin commented 2 years ago

Rejecting PR