-
Notifications
You must be signed in to change notification settings - Fork 17
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Address dependabot alerts #130
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM 👍
Any reason not to use a more current version of yarn?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
lgtm!
For posterity, these are the reasons each of these resolutions was added. They should all work fine; semver is a little concerning becuase deps are depending on two different major versions there, but we can only have a single resolution, but according to the changelog the only breaking change was dropping support for older versions of node. 1. @babel/traverse: GHSA-67hx-6x53-jw92 ``` yarn why v1.22.19 [1/4] 🤔 Why do we have the module "@babel/traverse"...? [2/4] 🚚 Initialising dependency graph... [3/4] 🔍 Finding dependency... [4/4] 🚡 Calculating file sizes... => Found "@babel/[email protected]" info Has been hoisted to "@babel/traverse" info Reasons this module exists - Hoisted from "@Docusaurus#core#@babel#traverse" - Hoisted from "@Docusaurus#core#@Docusaurus#mdx-loader#@babel#traverse" - Hoisted from "@Docusaurus#core#@babel#core#@babel#traverse" - Hoisted from "@Docusaurus#core#@babel#core#@babel#helpers#@babel#traverse" => Found "@svgr/webpack#@babel/[email protected]" info Reasons this module exists - "@Docusaurus#core#@svgr#webpack#@babel#preset-typescript#@babel#plugin-transform-typescript#@babel#helper-create-class-features-plugin#@babel#helper-replace-supers" depends on it - Hoisted from "@Docusaurus#core#@svgr#webpack#@babel#preset-typescript#@babel#plugin-transform-typescript#@babel#helper-create-class-features-plugin#@babel#helper-replace-supers#@babel#traverse" ``` 2. follow-redirects: GHSA-jchw-25xp-jwwc ``` yarn why v1.22.19 [1/4] 🤔 Why do we have the module "follow-redirects"...? [2/4] 🚚 Initialising dependency graph... [3/4] 🔍 Finding dependency... [4/4] 🚡 Calculating file sizes... => Found "[email protected]" info Reasons this module exists - "@Docusaurus#core#webpack-dev-server#http-proxy-middleware#http-proxy" depends on it - Hoisted from "@Docusaurus#core#webpack-dev-server#http-proxy-middleware#http-proxy#follow-redirects" ✨ Done in 0.23s. ``` 3. semver: GHSA-c2qf-rxjj-qqgw ``` yarn why v1.22.19 [1/4] 🤔 Why do we have the module "semver"...? [2/4] 🚚 Initialising dependency graph... [3/4] 🔍 Finding dependency... [4/4] 🚡 Calculating file sizes... => Found "[email protected]" info Has been hoisted to "semver" info Reasons this module exists - Hoisted from "@babel#helper-create-class-features-plugin#semver" - Hoisted from "@babel#helper-create-regexp-features-plugin#semver" - Hoisted from "@Docusaurus#core#@babel#core#semver" - Hoisted from "@Docusaurus#core#@babel#plugin-transform-runtime#semver" - Hoisted from "@Docusaurus#core#@babel#preset-env#semver" - Hoisted from "@Docusaurus#core#@babel#core#@babel#helper-compilation-targets#semver" - Hoisted from "@Docusaurus#core#@babel#plugin-transform-runtime#babel-plugin-polyfill-corejs2#semver" => Found "@docusaurus/core#[email protected]" info This module exists because "@Docusaurus#core" depends on it. => Found "update-notifier#[email protected]" info This module exists because "@Docusaurus#core#update-notifier" depends on it. => Found "css-loader#[email protected]" info This module exists because "@Docusaurus#core#css-loader" depends on it. => Found "postcss-loader#[email protected]" info This module exists because "@Docusaurus#core#postcss-loader" depends on it. => Found "fork-ts-checker-webpack-plugin#[email protected]" info This module exists because "@Docusaurus#core#react-dev-utils#fork-ts-checker-webpack-plugin" depends on it. => Found "semver-diff#[email protected]" info This module exists because "@Docusaurus#core#update-notifier#semver-diff" depends on it. => Found "package-json#[email protected]" info This module exists because "@Docusaurus#core#update-notifier#latest-version#package-json" depends on it. ✨ Done in 0.24s. ```
I think you know more about this than I do! I'm used to yarn v1 since it's been the react-native default for so long. |
c4abe07
to
d88887e
Compare
For posterity, these are the reasons each of these resolutions was added. They should all work fine; semver is a little concerning becuase deps are depending on two different major versions there, but we can only have a single resolution, but according to the changelog the only breaking change was dropping support for older versions of node. 1. @babel/traverse: GHSA-67hx-6x53-jw92 ``` yarn why v1.22.19 [1/4] 🤔 Why do we have the module "@babel/traverse"...? [2/4] 🚚 Initialising dependency graph... [3/4] 🔍 Finding dependency... [4/4] 🚡 Calculating file sizes... => Found "@babel/[email protected]" info Has been hoisted to "@babel/traverse" info Reasons this module exists - Hoisted from "@Docusaurus#core#@babel#traverse" - Hoisted from "@Docusaurus#core#@Docusaurus#mdx-loader#@babel#traverse" - Hoisted from "@Docusaurus#core#@babel#core#@babel#traverse" - Hoisted from "@Docusaurus#core#@babel#core#@babel#helpers#@babel#traverse" => Found "@svgr/webpack#@babel/[email protected]" info Reasons this module exists - "@Docusaurus#core#@svgr#webpack#@babel#preset-typescript#@babel#plugin-transform-typescript#@babel#helper-create-class-features-plugin#@babel#helper-replace-supers" depends on it - Hoisted from "@Docusaurus#core#@svgr#webpack#@babel#preset-typescript#@babel#plugin-transform-typescript#@babel#helper-create-class-features-plugin#@babel#helper-replace-supers#@babel#traverse" ``` 2. follow-redirects: GHSA-jchw-25xp-jwwc ``` yarn why v1.22.19 [1/4] 🤔 Why do we have the module "follow-redirects"...? [2/4] 🚚 Initialising dependency graph... [3/4] 🔍 Finding dependency... [4/4] 🚡 Calculating file sizes... => Found "[email protected]" info Reasons this module exists - "@Docusaurus#core#webpack-dev-server#http-proxy-middleware#http-proxy" depends on it - Hoisted from "@Docusaurus#core#webpack-dev-server#http-proxy-middleware#http-proxy#follow-redirects" ✨ Done in 0.23s. ``` 3. semver: GHSA-c2qf-rxjj-qqgw ``` yarn why v1.22.19 [1/4] 🤔 Why do we have the module "semver"...? [2/4] 🚚 Initialising dependency graph... [3/4] 🔍 Finding dependency... [4/4] 🚡 Calculating file sizes... => Found "[email protected]" info Has been hoisted to "semver" info Reasons this module exists - Hoisted from "@babel#helper-create-class-features-plugin#semver" - Hoisted from "@babel#helper-create-regexp-features-plugin#semver" - Hoisted from "@Docusaurus#core#@babel#core#semver" - Hoisted from "@Docusaurus#core#@babel#plugin-transform-runtime#semver" - Hoisted from "@Docusaurus#core#@babel#preset-env#semver" - Hoisted from "@Docusaurus#core#@babel#core#@babel#helper-compilation-targets#semver" - Hoisted from "@Docusaurus#core#@babel#plugin-transform-runtime#babel-plugin-polyfill-corejs2#semver" => Found "@docusaurus/core#[email protected]" info This module exists because "@Docusaurus#core" depends on it. => Found "update-notifier#[email protected]" info This module exists because "@Docusaurus#core#update-notifier" depends on it. => Found "css-loader#[email protected]" info This module exists because "@Docusaurus#core#css-loader" depends on it. => Found "postcss-loader#[email protected]" info This module exists because "@Docusaurus#core#postcss-loader" depends on it. => Found "fork-ts-checker-webpack-plugin#[email protected]" info This module exists because "@Docusaurus#core#react-dev-utils#fork-ts-checker-webpack-plugin" depends on it. => Found "semver-diff#[email protected]" info This module exists because "@Docusaurus#core#update-notifier#semver-diff" depends on it. => Found "package-json#[email protected]" info This module exists because "@Docusaurus#core#update-notifier#latest-version#package-json" depends on it. ✨ Done in 0.24s. ```
For posterity, these are the reasons each of these resolutions was added. They should all work fine; semver is a little concerning becuase deps are depending on two different major versions there, but we can only have a single resolution, but according to the changelog the only breaking change was dropping support for older versions of node. 1. @babel/traverse: GHSA-67hx-6x53-jw92 ``` yarn why v1.22.19 [1/4] 🤔 Why do we have the module "@babel/traverse"...? [2/4] 🚚 Initialising dependency graph... [3/4] 🔍 Finding dependency... [4/4] 🚡 Calculating file sizes... => Found "@babel/[email protected]" info Has been hoisted to "@babel/traverse" info Reasons this module exists - Hoisted from "@Docusaurus#core#@babel#traverse" - Hoisted from "@Docusaurus#core#@Docusaurus#mdx-loader#@babel#traverse" - Hoisted from "@Docusaurus#core#@babel#core#@babel#traverse" - Hoisted from "@Docusaurus#core#@babel#core#@babel#helpers#@babel#traverse" => Found "@svgr/webpack#@babel/[email protected]" info Reasons this module exists - "@Docusaurus#core#@svgr#webpack#@babel#preset-typescript#@babel#plugin-transform-typescript#@babel#helper-create-class-features-plugin#@babel#helper-replace-supers" depends on it - Hoisted from "@Docusaurus#core#@svgr#webpack#@babel#preset-typescript#@babel#plugin-transform-typescript#@babel#helper-create-class-features-plugin#@babel#helper-replace-supers#@babel#traverse" ``` 2. follow-redirects: GHSA-jchw-25xp-jwwc ``` yarn why v1.22.19 [1/4] 🤔 Why do we have the module "follow-redirects"...? [2/4] 🚚 Initialising dependency graph... [3/4] 🔍 Finding dependency... [4/4] 🚡 Calculating file sizes... => Found "[email protected]" info Reasons this module exists - "@Docusaurus#core#webpack-dev-server#http-proxy-middleware#http-proxy" depends on it - Hoisted from "@Docusaurus#core#webpack-dev-server#http-proxy-middleware#http-proxy#follow-redirects" ✨ Done in 0.23s. ``` 3. semver: GHSA-c2qf-rxjj-qqgw ``` yarn why v1.22.19 [1/4] 🤔 Why do we have the module "semver"...? [2/4] 🚚 Initialising dependency graph... [3/4] 🔍 Finding dependency... [4/4] 🚡 Calculating file sizes... => Found "[email protected]" info Has been hoisted to "semver" info Reasons this module exists - Hoisted from "@babel#helper-create-class-features-plugin#semver" - Hoisted from "@babel#helper-create-regexp-features-plugin#semver" - Hoisted from "@Docusaurus#core#@babel#core#semver" - Hoisted from "@Docusaurus#core#@babel#plugin-transform-runtime#semver" - Hoisted from "@Docusaurus#core#@babel#preset-env#semver" - Hoisted from "@Docusaurus#core#@babel#core#@babel#helper-compilation-targets#semver" - Hoisted from "@Docusaurus#core#@babel#plugin-transform-runtime#babel-plugin-polyfill-corejs2#semver" => Found "@docusaurus/core#[email protected]" info This module exists because "@Docusaurus#core" depends on it. => Found "update-notifier#[email protected]" info This module exists because "@Docusaurus#core#update-notifier" depends on it. => Found "css-loader#[email protected]" info This module exists because "@Docusaurus#core#css-loader" depends on it. => Found "postcss-loader#[email protected]" info This module exists because "@Docusaurus#core#postcss-loader" depends on it. => Found "fork-ts-checker-webpack-plugin#[email protected]" info This module exists because "@Docusaurus#core#react-dev-utils#fork-ts-checker-webpack-plugin" depends on it. => Found "semver-diff#[email protected]" info This module exists because "@Docusaurus#core#update-notifier#semver-diff" depends on it. => Found "package-json#[email protected]" info This module exists because "@Docusaurus#core#update-notifier#latest-version#package-json" depends on it. ✨ Done in 0.24s. ```
For posterity, these are the reasons each of these resolutions was
added. They should all work fine; semver is a little concerning becuase
deps are depending on two different major versions there, but we can
only have a single resolution, but according to the changelog the only
breaking change was dropping support for older versions of node.