-
Notifications
You must be signed in to change notification settings - Fork 0
[Snyk] Upgrade typescript from 3.4.3 to 3.9.10 #626
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Conversation
Snyk has created this PR to upgrade typescript from 3.4.3 to 3.9.10. See this package in npm: typescript See this project in Snyk: https://app.snyk.io/org/newtonombese1/project/7dde8a7b-37cc-48f5-ac69-6e551b5a4e78?utm_source=github&utm_medium=referral&page=upgrade-pr
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Summary of Changes
Hello @nejidevelops, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!
This pull request, automatically generated by Snyk, updates the "typescript" dependency from version "3.4.3" to "3.9.10". The primary goal of this upgrade is to mitigate a large number of identified security vulnerabilities across various packages within the project's dependency tree, thereby enhancing the overall security posture of the application.
Highlights
- Dependency Upgrade: Updates the "typescript" package from version "3.4.3" to "3.9.10".
- Security Fixes: Addresses a wide array of security vulnerabilities, including multiple instances of Regular Expression Denial of Service (ReDoS), Prototype Pollution, Arbitrary File Write/Overwrite, Remote Code Execution (RCE), Cross-site Scripting (XSS), and other critical, high, and medium severity issues.
- Automated Maintenance: This change is an automated security update initiated by Snyk to keep dependencies up-to-date and secure.
Using Gemini Code Assist
The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.
Invoking Gemini
You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command>
or @gemini-code-assist <command>
. Below is a summary of the supported commands.
Feature | Command | Description |
---|---|---|
Code Review | /gemini review |
Performs a code review for the current pull request in its current state. |
Pull Request Summary | /gemini summary |
Provides a summary of the current pull request in its current state. |
Comment | @gemini-code-assist | Responds in comments when explicitly tagged, both in issue comments and review comments. |
Help | /gemini help |
Displays a list of available commands. |
Customization
To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/
folder in the base of the repository. Detailed instructions can be found here.
Limitations & Feedback
Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.
You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.
Footnotes
-
Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Code Review
This PR upgrades TypeScript to 3.9.10
to fix security vulnerabilities. This is a positive change, but this version of TypeScript is still very old. The underlying issue is that the entire toolchain, particularly react-scripts
, is outdated. My recommendation is to perform a more comprehensive upgrade of react-scripts
to a modern version. This will improve the project's long-term maintainability and security posture by updating multiple dependencies at once, including TypeScript.
@@ -15,7 +15,7 @@ | |||
"semantic-ui-css": "^2.4.1", | |||
"semantic-ui-react": "^0.86.0", | |||
"styled-components": "^4.3.2", | |||
"typescript": "3.4.3" | |||
"typescript": "3.9.10" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
While this upgrade to 3.9.10
is a good step for security, this TypeScript version is still several years old. The project's toolchain, especially react-scripts@2.1.8
, is significantly outdated, which poses maintainability and security risks.
I strongly recommend a more comprehensive upgrade. Ideally, update react-scripts
to a modern version (e.g., 5.x). This will bring in a much newer TypeScript version and address a wider range of issues.
If a react-scripts
upgrade is too large a step for now, consider at least upgrading TypeScript to the latest 4.x version. Note that this would require upgrading react-scripts
to at least 4.0.0
.
Snyk has created this PR to upgrade typescript from 3.4.3 to 3.9.10.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 326 versions ahead of your current version.
The recommended version was released 4 years ago.
Issues fixed by the recommended upgrade:
SNYK-JS-ACORN-559469
SNYK-JS-ACORN-559469
SNYK-JS-AJV-584908
SNYK-JS-ANSIREGEX-1583908
SNYK-JS-MIXINDEEP-450212
SNYK-JS-NODEFORGE-598677
SNYK-JS-TAR-1579152
SNYK-JS-TAR-1579155
SNYK-JS-TMPL-1583443
SNYK-JS-TRIM-1017038
SNYK-JS-SEMVER-3247795
SNYK-JS-SEMVER-3247795
SNYK-JS-SEMVER-3247795
SNYK-JS-SEMVER-3247795
SNYK-JS-INI-1048974
SNYK-JS-ELLIPTIC-8172694
SNYK-JS-ESLINTUTILS-460220
SNYK-JS-FOLLOWREDIRECTS-6141137
SNYK-JS-HANDLEBARS-1056767
SNYK-JS-HANDLEBARS-173692
SNYK-JS-HANDLEBARS-174183
SNYK-JS-HANDLEBARS-469063
SNYK-JS-HANDLEBARS-480388
SNYK-JS-HANDLEBARS-534478
SNYK-JS-ANSIREGEX-1583908
SNYK-JS-ASYNC-2441827
SNYK-JS-BODYPARSER-7926860
SNYK-JS-BROWSERIFYSIGN-6037026
SNYK-JS-DECODEURICOMPONENT-3149970
SNYK-JS-DNSPACKET-1293563
SNYK-JS-ELLIPTIC-571484
SNYK-JS-SETVALUE-1540541
SNYK-JS-SETVALUE-450213
SNYK-JS-SETVALUE-1540541
SNYK-JS-SETVALUE-450213
SNYK-JS-SSRI-1246392
SNYK-JS-TAR-1536528
SNYK-JS-TAR-1536531
SNYK-JS-TAR-1579147
SNYK-JS-TAR-1579152
SNYK-JS-TAR-1579155
SNYK-JS-TAR-174125
SNYK-JS-TAR-1536528
SNYK-JS-TAR-1536531
SNYK-JS-TAR-1579147
SNYK-JS-QS-3153490
SNYK-JS-URLPARSE-2407770
SNYK-JS-WEBSOCKETEXTENSIONS-570623
SNYK-JS-WS-7266574
SNYK-JS-Y18N-1021887
SNYK-JS-Y18N-1021887
SNYK-JS-IP-6240864
SNYK-JS-JSONSCHEMA-1920922
SNYK-JS-LODASH-1040724
SNYK-JS-LODASH-450202
SNYK-JS-LODASH-567746
SNYK-JS-LODASH-608086
SNYK-JS-LODASH-6139239
SNYK-JS-MERGEDEEP-1070277
SNYK-JS-MINIMIST-559764
SNYK-JS-MINIMIST-559764
SNYK-JS-MINIMIST-559764
SNYK-JS-NODENOTIFIER-1035794
npm:mem:20180117
SNYK-JS-EVENTSOURCE-2823375
SNYK-JS-EXPRESS-6474509
SNYK-JS-EXPRESS-7926867
SNYK-JS-FOLLOWREDIRECTS-2332181
SNYK-JS-FOLLOWREDIRECTS-6444610
SNYK-JS-HANDLEBARS-1279029
SNYK-JS-HOSTEDGITINFO-1088355
SNYK-JS-BABELHELPERS-9397697
SNYK-JS-COLORSTRING-1082939
SNYK-JS-COOKIE-8163060
SNYK-JS-DOTPROP-543489
SNYK-JS-ELLIPTIC-1064899
SNYK-JS-ELLIPTIC-511941
SNYK-JS-NWSAPI-2841516
SNYK-JS-ONHEADERS-10773729
SNYK-JS-PATHPARSE-1077067
SNYK-JS-PATHTOREGEXP-7925106
SNYK-JS-PATHTOREGEXP-7925106
SNYK-JS-PATHTOREGEXP-8482416
SNYK-JS-POSTCSS-1090595
SNYK-JS-URLPARSE-1078283
SNYK-JS-URLPARSE-1533425
SNYK-JS-URLPARSE-2401205
SNYK-JS-URLPARSE-2407759
SNYK-JS-URLPARSE-2412697
SNYK-JS-WS-1296835
npm:chownr:20180731
SNYK-JS-ISSVG-1085627
SNYK-JS-ISSVG-1243891
SNYK-JS-JQUERY-565129
SNYK-JS-JQUERY-567880
SNYK-JS-LODASH-1018905
SNYK-JS-MINIMIST-2429795
SNYK-JS-MINIMIST-2429795
SNYK-JS-SEND-7926862
npm:debug:20170905
SNYK-JS-ELLIPTIC-7577916
SNYK-JS-ELLIPTIC-7577917
SNYK-JS-ELLIPTIC-7577918
SNYK-JS-ELLIPTIC-8720086
SNYK-JS-HANDLEBARS-567742
SNYK-JS-FOLLOWREDIRECTS-2396346
SNYK-JS-HANDLEBARS-534988
SNYK-JS-HTTPPROXY-569139
SNYK-JS-BABELTRAVERSE-5962462
SNYK-JS-BRACEEXPANSION-9789073
SNYK-JS-SERVESTATIC-7926865
SNYK-JS-TAR-1536758
SNYK-JS-TAR-1536758
SNYK-JS-PBKDF2-10495496
SNYK-JS-PBKDF2-10495498
npm:debug:20170905
SNYK-JS-KINDOF-537849
SNYK-JS-MINIMIST-2429795
Release notes
Package name: typescript
This release ships both an overall performance improvement, along with a mitigation for a performance regression when upgrading to Node.js 16. See the change for more details.
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information:
[//]: # 'snyk:metadata:{"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"typescript","from":"3.4.3","to":"3.9.10"}],"env":"prod","hasFixes":true,"isBreakingChange":false,"isMajorUpgrade":false,"issuesToFix":["SNYK-JS-ACORN-559469","SNYK-JS-ACORN-559469","SNYK-JS-AJV-584908","SNYK-JS-ANSIREGEX-1583908","SNYK-JS-MIXINDEEP-450212","SNYK-JS-NODEFORGE-598677","SNYK-JS-TAR-1579152","SNYK-JS-TAR-1579155","SNYK-JS-TMPL-1583443","SNYK-JS-TRIM-1017038","SNYK-JS-SEMVER-3247795","SNYK-JS-SEMVER-3247795","SNYK-JS-SEMVER-3247795","SNYK-JS-SEMVER-3247795","SNYK-JS-INI-1048974","SNYK-JS-ELLIPTIC-8172694","SNYK-JS-ESLINTUTILS-460220","SNYK-JS-FOLLOWREDIRECTS-6141137","SNYK-JS-HANDLEBARS-1056767","SNYK-JS-HANDLEBARS-173692","SNYK-JS-HANDLEBARS-174183","SNYK-JS-HANDLEBARS-469063","SNYK-JS-HANDLEBARS-480388","SNYK-JS-HANDLEBARS-534478","SNYK-JS-ANSIREGEX-1583908","SNYK-JS-ASYNC-2441827","SNYK-JS-BODYPARSER-7926860","SNYK-JS-BROWSERIFYSIGN-6037026","SNYK-JS-DECODEURICOMPONENT-3149970","SNYK-JS-DNSPACKET-1293563","SNYK-JS-ELLIPTIC-571484","SNYK-JS-SETVALUE-1540541","SNYK-JS-SETVALUE-450213","SNYK-JS-SETVALUE-1540541","SNYK-JS-SETVALUE-450213","SNYK-JS-SSRI-1246392","SNYK-JS-TAR-1536528","SNYK-JS-TAR-1536531","SNYK-JS-TAR-1579147","SNYK-JS-TAR-1579152","SNYK-JS-TAR-1579155","SNYK-JS-TAR-174125","SNYK-JS-TAR-1536528","SNYK-JS-TAR-1536531","SNYK-JS-TAR-1579147","SNYK-JS-QS-3153490","SNYK-JS-URLPARSE-2407770","SNYK-JS-WEBSOCKETEXTENSIONS-570623","SNYK-JS-WS-7266574","SNYK-JS-Y18N-1021887","SNYK-JS-Y18N-1021887","SNYK-JS-IP-6240864","SNYK-JS-JSONSCHEMA-1920922","SNYK-JS-LODASH-1040724","SNYK-JS-LODASH-450202","SNYK-JS-LODASH-567746","SNYK-JS-LODASH-608086","SNYK-JS-LODASH-6139239","SNYK-JS-MERGEDEEP-1070277","SNYK-JS-MINIMIST-559764","SNYK-JS-MINIMIST-559764","SNYK-JS-MINIMIST-559764","SNYK-JS-NODENOTIFIER-1035794","npm:mem:20180117","SNYK-JS-EVENTSOURCE-2823375","SNYK-JS-EXPRESS-6474509","SNYK-JS-EXPRESS-7926867","SNYK-JS-FOLLOWREDIRECTS-2332181","SNYK-JS-FOLLOWREDIRECTS-6444610","SNYK-JS-HANDLEBARS-1279029","SNYK-JS-HOSTEDGITINFO-1088355","SNYK-JS-BABELHELPERS-9397697","SNYK-JS-COLORSTRING-1082939","SNYK-JS-COOKIE-8163060","SNYK-JS-DOTPROP-543489","SNYK-JS-ELLIPTIC-1064899","SNYK-JS-ELLIPTIC-511941","SNYK-JS-NWSAPI-2841516","SNYK-JS-ONHEADERS-10773729","SNYK-JS-PATHPARSE-1077067","SNYK-JS-PATHTOREGEXP-7925106","SNYK-JS-PATHTOREGEXP-7925106","SNYK-JS-PATHTOREGEXP-8482416","SNYK-JS-POSTCSS-1090595","SNYK-JS-URLPARSE-1078283","SNYK-JS-URLPARSE-1533425","SNYK-JS-URLPARSE-2401205","SNYK-JS-URLPARSE-2407759","SNYK-JS-URLPARSE-2412697","SNYK-JS-WS-1296835","npm:chownr:20180731","SNYK-JS-ISSVG-1085627","SNYK-JS-ISSVG-1243891","SNYK-JS-JQUERY-565129","SNYK-JS-JQUERY-567880","SNYK-JS-LODASH-1018905","SNYK-JS-MINIMIST-2429795","SNYK-JS-MINIMIST-2429795","SNYK-JS-SEND-7926862","npm:debug:20170905","SNYK-JS-ELLIPTIC-7577916","SNYK-JS-ELLIPTIC-7577917","SNYK-JS-ELLIPTIC-7577918","SNYK-JS-ELLIPTIC-8720086","SNYK-JS-HANDLEBARS-567742","SNYK-JS-FOLLOWREDIRECTS-2396346","SNYK-JS-HANDLEBARS-534988","SNYK-JS-HTTPPROXY-569139","SNYK-JS-BABELTRAVERSE-5962462","SNYK-JS-BRACEEXPANSION-9789073","SNYK-JS-SERVESTATIC-7926865","SNYK-JS-TAR-1536758","SNYK-JS-TAR-1536758","SNYK-JS-PBKDF2-10495496","SNYK-JS-PBKDF2-10495498","npm:debug:20170905","SNYK-JS-KINDOF-537849","SNYK-JS-MINIMIST-2429795"],"prId":"6f4230ac-2323-46f5-8857-a70b34ba40db","prPublicId":"6f4230ac-2323-46f5-8857-a70b34ba40db","packageManager":"npm","priorityScoreList":[375,405,482,686,472,639,639,696,482,696,686,415,365,472,457,365,365,365,375,512,482,410,375,696,385,492,686,686,482,624,624,639,726,482,512,517,482,472,537,430,681,686,731,686,696,376,601,280,255,432,305,255,372,432,387,372,452,372,315,422,340,295,310,230,372,452,452,372,265,372,427,427,417,372,434,372,372,529,496,586,506,105,292,562,562,562,557,432,130,490,432,786,436,105,410,562,455,506],"projectPublicId":"7dde8a7b-37cc-48f5-ac69-6e551b5a4e78","projectUrl":"https://app.snyk.io/org/newtonombese1/project/7dde8a7b-37cc-48f5-ac69-6e551b5a4e78?utm_source=github&utm_medium=referral&page=upgrade-pr","prType":"upgrade","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":["priorityScore"],"type":"auto","upgrade":["SNYK-JS-ACORN-559469","SNYK-JS-ACORN-559469","SNYK-JS-AJV-584908","SNYK-JS-ANSIREGEX-1583908","SNYK-JS-MIXINDEEP-450212","SNYK-JS-NODEFORGE-598677","SNYK-JS-TAR-1579152","SNYK-JS-TAR-1579155","SNYK-JS-TMPL-1583443","SNYK-JS-TRIM-1017038","SNYK-JS-SEMVER-3247795","SNYK-JS-SEMVER-3247795","SNYK-JS-SEMVER-3247795","SNYK-JS-SEMVER-3247795","SNYK-JS-INI-1048974","SNYK-JS-ELLIPTIC-8172694","SNYK-JS-ESLINTUTILS-460220","SNYK-JS-FOLLOWREDIRECTS-6141137","SNYK-JS-HANDLEBARS-1056767","SNYK-JS-HANDLEBARS-173692","SNYK-JS-HANDLEBARS-174183","SNYK-JS-HANDLEBARS-469063","SNYK-JS-HANDLEBARS-480388","SNYK-JS-HANDLEBARS-534478","SNYK-JS-ANSIREGEX-1583908","SNYK-JS-ASYNC-2441827","SNYK-JS-BODYPARSER-7926860","SNYK-JS-BROWSERIFYSIGN-6037026","SNYK-JS-DECODEURICOMPONENT-3149970","SNYK-JS-DNSPACKET-1293563","SNYK-JS-ELLIPTIC-571484","SNYK-JS-SETVALUE-1540541","SNYK-JS-SETVALUE-450213","SNYK-JS-SETVALUE-1540541","SNYK-JS-SETVALUE-450213","SNYK-JS-SSRI-1246392","SNYK-JS-TAR-1536528","SNYK-JS-TAR-1536531","SNYK-JS-TAR-1579147","SNYK-JS-TAR-1579152","SNYK-JS-TAR-1579155","SNYK-JS-TAR-174125","SNYK-JS-TAR-1536528","SNYK-JS-TAR-1536531","SNYK-JS-TAR-1579147","SNYK-JS-QS-3153490","SNYK-JS-URLPARSE-2407770","SNYK-JS-WEBSOCKETEXTENSIONS-570623","SNYK-JS-WS-7266574","SNYK-JS-Y18N-1021887","SNYK-JS-Y18N-1021887","SNYK-JS-IP-6240864","SNYK-JS-JSONSCHEMA-1920922","SNYK-JS-LODASH-1040724","SNYK-JS-LODASH-450202","SNYK-JS-LODASH-567746","SNYK-JS-LODASH-608086","SNYK-JS-LODASH-6139239","SNYK-JS-MERGEDEEP-1070277","SNYK-JS-MINIMIST-559764","SNYK-JS-MINIMIST-559764","SNYK-JS-MINIMIST-559764","SNYK-JS-NODENOTIFIER-1035794","npm:mem:20180117","SNYK-JS-EVENTSOURCE-2823375","SNYK-JS-EXPRESS-6474509","SNYK-JS-EXPRESS-7926867","SNYK-JS-FOLLOWREDIRECTS-2332181","SNYK-JS-FOLLOWREDIRECTS-6444610","SNYK-JS-HANDLEBARS-1279029","SNYK-JS-HOSTEDGITINFO-1088355","SNYK-JS-BABELHELPERS-9397697","SNYK-JS-COLORSTRING-1082939","SNYK-JS-COOKIE-8163060","SNYK-JS-DOTPROP-543489","SNYK-JS-ELLIPTIC-1064899","SNYK-JS-ELLIPTIC-511941","SNYK-JS-NWSAPI-2841516","SNYK-JS-ONHEADERS-10773729","SNYK-JS-PATHPARSE-1077067","SNYK-JS-PATHTOREGEXP-7925106","SNYK-JS-PATHTOREGEXP-7925106","SNYK-JS-PATHTOREGEXP-8482416","SNYK-JS-POSTCSS-1090595","SNYK-JS-URLPARSE-1078283","SNYK-JS-URLPARSE-1533425","SNYK-JS-URLPARSE-2401205","SNYK-JS-URLPARSE-2407759","SNYK-JS-URLPARSE-2412697","SNYK-JS-WS-1296835","npm:chownr:20180731","SNYK-JS-ISSVG-1085627","SNYK-JS-ISSVG-1243891","SNYK-JS-JQUERY-565129","SNYK-JS-JQUERY-567880","SNYK-JS-LODASH-1018905","SNYK-JS-MINIMIST-2429795","SNYK-JS-MINIMIST-2429795","SNYK-JS-SEND-7926862","npm:debug:20170905","SNYK-JS-ELLIPTIC-7577916","SNYK-JS-ELLIPTIC-7577917","SNYK-JS-ELLIPTIC-7577918","SNYK-JS-ELLIPTIC-8720086","SNYK-JS-HANDLEBARS-567742","SNYK-JS-FOLLOWREDIRECTS-2396346","SNYK-JS-HANDLEBARS-534988","SNYK-JS-HTTPPROXY-569139","SNYK-JS-BABELTRAVERSE-5962462","SNYK-JS-BRACEEXPANSION-9789073","SNYK-JS-SERVESTATIC-7926865","SNYK-JS-TAR-1536758","SNYK-JS-TAR-1536758","SNYK-JS-PBKDF2-10495496","SNYK-JS-PBKDF2-10495498","npm:debug:20170905","SNYK-JS-KINDOF-537849","SNYK-JS-MINIMIST-2429795"],"upgradeInfo":{"versionsDiff":326,"publishedDate":"2021-06-16T22:50:12.465Z"},"vulns":["SNYK-JS-ACORN-559469","SNYK-JS-ACORN-559469","SNYK-JS...