Skip to content

Conversation

jeffbax
Copy link
Collaborator

@jeffbax jeffbax commented Mar 12, 2025

  1. Fixes the Dependabot warnings (still impacting RS) and upgrades most build-related packages to the latest.
  2. Replaces various proposal packages with the real ones (found via yarn npm audit)
  3. Removes packages that were unnecessary
  • Confirmed storybook still build and runs:
image
  • Does not upgrade any UI packages

jeffbax added 2 commits March 12, 2025 14:04
Resolves Dependabots:

Babel has inefficient RexExp complexity in generated code with .replace when transpiling named capturing groups
https://github.com/user-interviews/ui-design-system/security/dependabot/129

Cross-site Scripting (XSS) in serialize-javascript
https://github.com/user-interviews/ui-design-system/security/dependabot/128

esbuild enables any website to send any requests to the development server and read the response
https://github.com/user-interviews/ui-design-system/security/dependabot/126
@jeffbax jeffbax requested review from kyleshike and domschab23 March 12, 2025 20:07
],
"plugins": [
"@babel/plugin-transform-runtime",
"@babel/plugin-proposal-object-rest-spread",
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

these were all promoted

"@babel/plugin-proposal-private-property-in-object": "^7.21.11",
"@babel/plugin-transform-runtime": "^7.25.9",
"@babel/preset-env": "^7.26.7",
"@babel/core": "^7.26.10",
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

upgraded anything babel related

"babel-preset-react": "^6.24.1",
"bootstrap": "5.1.3",
"chromatic": "^11.25.1",
"chromatic": "^11.27.0",
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

figured since it will run and test anyway

"classnames": "^2.5.1",
"css-loader": "^7.1.2",
"eslint": "^9.19.0",
"eslint": "^9.22.0",
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lint seemed to work ok

@jeffbax jeffbax requested a review from jasonbasuil March 12, 2025 20:13
Copy link
Collaborator

@jasonbasuil jasonbasuil left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

@jeffbax jeffbax merged commit 19d4030 into main Mar 12, 2025
4 checks passed
@jeffbax jeffbax deleted the dependabot-sweep branch March 12, 2025 22:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants