Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Dependencies #24

Merged
merged 12 commits into from
Apr 16, 2023

Conversation

barnardb
Copy link
Contributor

I have a project that has a dependency on GrammKit, and the current exact-version requirements in package.json are problematic as they pin older dependency versions that now have known vulnerabilities.

This PR upgrades a number of dependencies, and changes all dependencies in package.json to caret "compatible with version"-style dependencies for the benefit of projects depending on GrammKit.

I left bootstrap-css-only at 3.3.7 instead of upgrading to 4.4.1, as this broke the styling visible in the browser when running npm run dev.

I upgraded ohm-js to 15.5.0 instead of 17.0.4, as version 16 introduced a breaking change that I didn't want to tackle in this PR.

barnardb added 12 commits April 16, 2023 15:15
See reactwg/react-18#5

This resolves the warning about the legacy API that was displayed
in the browser console following the upgrade to react 18.
Ohm 17.0.4 is avaialable, but version 16 included a breaking change
that I don't want to handle right now:
https://ohmjs.org/docs/releases/ohm-js-16.0#default-semantic-actions
If there are ever bugfix/security updates to these dependencies,
this will allow users to pull them in automatically.
It looks like the changes from the dundalek fork have made it into
the original jtenner plugin.
barnardb added a commit to softwaretechnik-berlin/flexivis that referenced this pull request Apr 16, 2023
@dundalek
Copy link
Owner

Thanks!
It looks like the upgrade also broke the CLI, e.g. ./cli.js examples/sparql.ebnf. But it seems that downgrading commander makes it work again, and it does not report vulns.
I will merge the PR, downgrade commander and bump a release.

@dundalek dundalek merged commit a567279 into dundalek:master Apr 16, 2023
@dundalek
Copy link
Owner

Published 0.7.2

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants