Investigate upgrading react-datepicker

opensearch-project / oui

OpenSearch UI Framework

Apache License 2.0

32 stars 69 forks source link

Investigate upgrading react-datepicker #205

Open BSFishy opened 1 year ago

BSFishy commented 1 year ago

Elastic forked react-datepicker in order to add some accessibility improvements. It was forked on version 2.0.0, where the latest version is 4.8.0. As of now, lots of CVEs are coming from that package, so it may make sense to see if we can just switch to using it off NPM and upgrading to the latest version, rather than trying to fix the CVEs in what we have now.

BSFishy commented 1 year ago

Here are the main things I've found so far:

The fork changes instances of Date to Moment
A prop, utcOffset was added
In the package from NPM, ref doesn't work out of the box for some reason

Changing these things would most likely require a major version bump, or a rework of how some of the date picker component works. For fixing CVE's, the work is too much. However, we still probably want to look into updating to the version from NPM in the future.