Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade dependencies to fix vulnerabilities #1

Merged
merged 5 commits into from
Jul 22, 2019

Conversation

carlosms
Copy link
Contributor

@carlosms carlosms commented Feb 4, 2019

If you try to build and submit a new extension to the marketplace it will be rejected with the message "Extension failed Virus check. Please submit a valid extension.".

With the current code yarn audit returns:

27 vulnerabilities found - Packages audited: 31684
Severity: 8 Low | 18 High | 1 Critical

yarn upgrade is not so straightforward because react-scripts-ts was discontinued and the latest version still leaves vulnerabilities.

I followed this guide to migrate from react-scripts-ts to react-scripts.

The new versions changed the way the build assets are createed, splitting them in a way that makes it hard to rebuild in _getHtmlForWebview. I followed this workaround to disable the code splitting, fixing the <script /> link.

@adamwatters
Copy link

any reason this hasn't been merged?

@rebornix
Copy link
Owner

the only reason is I didn't see this notification in my inbox. Thanks all for the contribution!

@rebornix rebornix merged commit b29ece8 into rebornix:master Jul 22, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants