[CU] Update dependencies - Githubissues

department-of-veterans-affairs / va-mobile-library

https://department-of-veterans-affairs.github.io/va-mobile-library/

ISC License

0 stars 0 forks source link

[CU] Update dependencies #185

Closed narin closed 4 months ago

narin commented 4 months ago

Ticket #142

Description of Change

Updated all dependencies with the exception of 5 RN packages required for Expo 50 compatibility.

Used yarn upgrade-interactive
Checked all breaking changes for major version updates
- @typescript-eslint/eslint-plugin
- @typescript-eslint/parser
- react-i18next
- babel-loader
- copy-webpack-plugin
Add semver@^7.5.3 to overrides to resolve dependabot security alert
Also some minor to storybook web config for performance improvements

Testing Packages

0.6.1-alpha.0

Screenshots/Video

iOS

https://github.com/department-of-veterans-affairs/va-mobile-library/assets/786704/a0231c1f-9531-47c2-98a0-1de392946a85

Android

https://github.com/department-of-veterans-affairs/va-mobile-library/assets/786704/d1a10c12-99ec-46b4-be6f-92b26b4ff3fc

VA Mobile App

https://github.com/department-of-veterans-affairs/va-mobile-library/assets/786704/ab9b7150-391e-4957-96dd-f3e1ec0cf49b

Testing

[x] Tested on iOS
[x] Tested on Android
[x] Tested on Web
[x] Tested in VA Mobile App

PR Checklist

Code reviewer validation:

General
- [x] PR is linked to ticket(s)
- [x] PR has changelog label applied if it's to be included in the changelog
- [x] Acceptance criteria:
  - All satisfied or
  - Documented reason for not being performed or
  - Split to separate ticket and ticket is linked by relevant AC(s)
- [x] Above PR sections adequately filled out
- [x] If any breaking changes, in accordance with the pre-1.0.0 versioning guidelines: a CU ticket has been created for the VA Mobile App detailing necessary adjustments with the package version that will be published by this ticket
Code
- [x] Tests are included if appropriate (or split to separate ticket)
- [x] New functions have proper TSDoc annotations

Publish

If changes warrant a new version per the versioning guidelines and the PR is approved and ready to merge:

[x] Merge main into branch
[x] Merge branch to main
[x] Publish new version after merging

TimRoe commented 4 months ago

Approved although AC

All security alerts moderate or higher are gone

technically is not true I don't think, but the lingering one of

NPM IP package vulnerable to Server-Side Request Forgery (SSRF) attacks High

is also present on the flagship app repo which was made public.