Skip to content

Commit

Permalink
Update various JS dependencies (#20890)
Browse files Browse the repository at this point in the history
Clean up JS dependencies, mainly those complained about by `pnpm audit`.

* Remove unneeded pnpm.overrides.

  * `@automattic/calypso-build` no longer depends on `node-sass`.
  * Nothing we depend on depends on `terser-webpack-plugin` 2.3.1 anymore.

  And fix syntax for a few others. Looks like pnpm 6.10.2 broke the syntax
  we were using before.

* Update browserslist.

  Add an override for `react-dev-utils` which unnecessarily depends on a
  specific version instead of allowing updates.

* Update cheerio.

  New version fixes dep on vulnerable `css-what`.

* Update tar.

* Update postcss.

  Only the 7.0.35 deps needed updating for vulnerabilities, but may as
  well do the 8.2.15 too.

* Update path-parse.

* Add override for trim@0.0.1.

  `@storybook/csf-tools` depends on `@mdx-js/mdx`, which is [refusing to
  fix the old dep in its 1.x branch][1] and hasn't released 2.0 yet.

* Upgrade copy-webpack-plugin.

  Depends on a vulnerable version of glob-parent.

* Update glob-parent where we can.

  Unfortunately we can't do them all.

  * storybook still has some deps. One they [removed in "next"][2].
    Another is still there. Plus it has some webpack 4 deps it seemingly
    doesn't actually use.
  * `gulp` devs [actively refuse to update dependencies][3] when they
    believe they're not hitting the vulnerability, apparently as protest
    against `npm audit` which they consider "broken".

[1]: mdx-js/mdx#1553
[2]: storybookjs/storybook#15174
[3]: gulpjs/glob-stream#108

Committed via a GitHub action: https://github.com/Automattic/jetpack/actions/runs/1190571780
  • Loading branch information
anomiex authored and matticbot committed Sep 1, 2021
1 parent 6ee8f02 commit 0e19264
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions CHANGELOG.md
Expand Up @@ -11,6 +11,7 @@ This is an alpha version! The changes listed here are not final.

### Other changes <!-- Non-user-facing changes go here. This section will not be copied to readme.txt. -->
- Updates to-test.md.
- Update `copy-webpack-plugin` dep.

## 10.1-beta - 2021-08-31
### Major Enhancements
Expand Down

0 comments on commit 0e19264

Please sign in to comment.