fix: [#4684] Update some dependencies to latest version (#4737)

* Fix remaining security issues * Add semver resolution * Fix missing webpack update * Update yarn.lock * Fix yarn.lock
microsoft · Sep 10, 2024 · 9e5e1bb · 9e5e1bb
1 parent 46fb7f4
commit 9e5e1bb
Show file tree

Hide file tree

Showing 5 changed files with 71 additions and 335 deletions.
diff --git a/libraries/botframework-connector/package.json b/libraries/botframework-connector/package.json
@@ -35,7 +35,6 @@
     "base64url": "^3.0.0",
     "botbuilder-stdlib": "4.1.6",
     "botframework-schema": "4.1.6",
-    "browserify-fs": "^1.0.0",
     "buffer": "^6.0.3",
     "cross-fetch": "^4.0.0",
     "crypto-browserify": "^3.12.0",

diff --git a/libraries/botframework-connector/tsup.config.ts b/libraries/botframework-connector/tsup.config.ts
@@ -28,7 +28,6 @@ export default defineConfig({
         };
         options.alias = {
             crypto: 'crypto-browserify',
-            fs: 'browserify-fs',
             http: 'stream-http',
             https: 'https-browserify',
             stream: 'stream-browserify',
@@ -40,7 +39,7 @@ export default defineConfig({
                 buffer: false,
                 child_process: true,
                 crypto: false,
-                fs: false,
+                fs: true,
                 http: false,
                 https: false,
                 net: true,

diff --git a/package.json b/package.json
@@ -45,11 +45,13 @@
     "@types/ramda": "0.26.0",
     "babel-traverse": "npm:@babel/traverse@^7.24.7",
     "lodash.pick": "file:overrides/lodash.pick",
-    "**/nightwatch/ejs": "^3.1.10"
+    "**/nightwatch/ejs": "^3.1.10",
+    "**/nightwatch/semver": "^7.5.2"
   },
   "resolutionComments": {
     "lodash.pick": "Remove the resolution and override project when supporting Node >=18. Because we can't update nightwatch due to jsdom requires node >= 18. https://github.com/lodash/lodash/issues/5809#issuecomment-1910560681",
-    "**/nightwatch/ejs": "Remove the resolution when supporting Node >=18. Because we can't update nightwatch due to jsdom requires node >= 18. https://github.com/lodash/lodash/issues/5809#issuecomment-1910560681"
+    "**/nightwatch/ejs": "Remove the resolution when supporting Node >=18. Because we can't update nightwatch due to jsdom requires node >= 18. https://github.com/lodash/lodash/issues/5809#issuecomment-1910560681",
+    "**/nightwatch/semver": "Remove the resolution when nightwatch is updated to a latest version"
   },
   "devDependencies": {
     "@types/node": "18.19.47",

diff --git a/testing/browser-functional/browser-echo-bot/yarn.lock b/testing/browser-functional/browser-echo-bot/yarn.lock
@@ -3856,17 +3856,10 @@ debug@2.6.9:
   dependencies:
     ms "2.0.0"
 
-debug@4, debug@^4.0.0, debug@^4.3.1:
-  version "4.3.5"
-  resolved "https://registry.yarnpkg.com/debug/-/debug-4.3.5.tgz#e83444eceb9fedd4a1da56d671ae2446a01a6e1e"
-  integrity sha512-pt0bNEmneDIvdL1Xsd9oDQ/wrQRkXDT4AUWlNZNPKvW5x/jyO9VFXkJUP07vQ2upmw5PlaITaPKc31jK13V+jg==
-  dependencies:
-    ms "2.1.2"
-
-debug@^4.1.0, debug@^4.1.1:
-  version "4.2.0"
-  resolved "https://registry.yarnpkg.com/debug/-/debug-4.2.0.tgz#7f150f93920e94c58f5574c2fd01a3110effe7f1"
-  integrity sha512-IX2ncY78vDTjZMFUdmsvIRFY2Cf4FnD0wRs+nQwJU8Lu99/tPFdb0VybiiMTPe3I6rQmwsqQqRBvxU+bZ/I8sg==
+debug@4, debug@^4.0.0, debug@^4.1.0, debug@^4.1.1, debug@^4.3.1:
+  version "4.3.6"
+  resolved "https://registry.yarnpkg.com/debug/-/debug-4.3.6.tgz#2ab2c38fbaffebf8aa95fdfe6d88438c7a13c52b"
+  integrity sha512-O/09Bd4Z1fBrU4VzkhFqVgpPzaGbw6Sm9FEkBT1A/YBXQFGuuSxa1dN2nxgxS34JmKXqYx8CZAwEVoJFImUXIg==
   dependencies:
     ms "2.1.2"
 
@@ -6887,9 +6880,9 @@ semver@^6.3.0, semver@^6.3.1:
   integrity sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==
 
 semver@^7.3.4, semver@^7.5.4:
-  version "7.6.2"
-  resolved "https://registry.yarnpkg.com/semver/-/semver-7.6.2.tgz#1e3b34759f896e8f14d6134732ce798aeb0c6e13"
-  integrity sha512-FNAIBWCx9qcRhoHcgcJ0gvU7SN1lYU2ZXuSfl04bSC5OpvDHFyJCjdNHomPXxjQlCBU67YW64PzY7/VIEH7F2w==
+  version "7.6.3"
+  resolved "https://registry.yarnpkg.com/semver/-/semver-7.6.3.tgz#980f7b5550bc175fb4dc09403085627f9eb33143"
+  integrity sha512-oVekP1cKtI+CTDvHWYFUcMtsK/00wmAEfyqKfNdARm8u1wNVhSgaX7A8d4UuIlUI5e84iEwOhs7ZPYRmzU9U6A==
 
 send@0.18.0:
   version "0.18.0"