This PR updates some of the packages that contain critical and high-severity vulnerabilities. Here is the list of the packages that did not get updated and can be treated as separate task:
Development deps, should not be impacting build (considered lower priority):
dns-packet used by webpack-dev-server
ua-parser-js used by storybook
decode-uri-component used by @testing-library source maps, etc.
glob-parent used by gulp, eslint and storybook
High risk and high/unknown upgrade effort:
http-cache-semantics used by electron
json5 used by many packages e.g. svg-inline-loader, storybook, eslint-plugin-import (svg-inline-loader is no longer maintained)
d3-color used by recharts
terser used by @storybook and webpack (we already have the latest version of webpack)
This PR updates some of the packages that contain critical and high-severity vulnerabilities. Here is the list of the packages that did not get updated and can be treated as separate task:
Development deps, should not be impacting build (considered lower priority):
dns-packet
used bywebpack-dev-server
ua-parser-js
used bystorybook
decode-uri-component
used by@testing-library
source maps, etc.glob-parent
used bygulp
,eslint
andstorybook
High risk and high/unknown upgrade effort:
http-cache-semantics
used byelectron
json5
used by many packages e.g.svg-inline-loader
,storybook
,eslint-plugin-import
(svg-inline-loader is no longer maintained)d3-color
used byrecharts
terser
used by@storybook
andwebpack
(we already have the latest version ofwebpack
)Testing Checklist
Review Checklist
Basics
input-output-hk/daedalus-dev
andinput-output-hk/daedalus-qa
assigned as PR reviewersrun Chromatic
label to PR to trigger the run)release-vNext
,feature
/bug
/chore
,WIP
)yarn manage:translations
produces no changes)yarn storybook
)yarn.lock
file is updatedCode Quality
Testing
After Review