[Snyk] Upgrade react-monaco-editor from 0.50.1 to 0.54.0

[sarabala1979]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade react-monaco-editor from 0.50.1 to 0.54.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 4 versions ahead of your current version.
• The recommended version was released 21 days ago, on 2023-07-26.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Information Exposure SNYK-JS-NODEFETCH-2342118	325/1000 Why? CVSS 6.5	No Known Exploit
	Denial of Service SNYK-JS-NODEFETCH-674311	325/1000 Why? CVSS 6.5	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[agilgur5]

I think we'd still want to upgrade this dep. Going to need to manually fix two typing errors in the build though.

I'd leave this open as a tracker until we have a superseding PR

[agilgur5]

The build failure is unfortunately not resolvable. react-monaco-editor had a recent refactor (react-monaco-editor/react-monaco-editor#625) that broke some things, including refs that we use (e.g. in object-editor.tsx).

I left a comment on an open issue in react-monaco-editor about the refactor and upgrade: react-monaco-editor/react-monaco-editor#660 (comment).
As I mentioned there, react-monaco-editor also has no changelog, so I had to manually inspect the diff between versions to see what had changed. Not much else changed other than the refactor though.

There is another library, @monaco-editor/react (which does not seem to be official(??) despite using @monaco-editor 😬), but using that would also require significant refactoring, which is not currently worth the effort.

As such, just going to close this out as this upgrade is not needed and would require significant rework.

[agilgur5]

Also the install warning on React peerDeps can be ignored. See react-monaco-editor/react-monaco-editor#659.

The install warning on monaco-editor peerDeps seems to be mostly ignoreable too

[agilgur5]

The recommended version fixes:

Severity Issue PriorityScore () Exploit Maturity
Information Exposure
SNYK-JS-NODEFETCH-2342118 325/1000
Why? CVSS 6.5 No Known Exploit
Denial of Service
SNYK-JS-NODEFETCH-674311 325/1000
Why? CVSS 6.5 No Known Exploit
() Note that the real score may have changed since the PR was raised.

Not really sure why Snyk is mentioning these CVEs with regard to react-monaco-editor. It does not use node-fetch and only has a single dependency on React's prop-types library.

The yarn.lock changes also do not update node-fetch either.

So those CVEs seem unrelated. Maybe a Snyk bug.