Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[chore] Update dependencies #542

Merged
merged 10 commits into from
Mar 27, 2023
Merged

Conversation

bitmovin-kenny
Copy link
Contributor

@bitmovin-kenny bitmovin-kenny commented Mar 20, 2023

Our dependencies were a bit outdated, so I updated all which did not cause severe problems.

The postcss-svg package upgrade from 1.0.6 to 3.0.0 changed the functionality by replacing url(relativePathToSvgFromScssFoder) instead of the previous svg(relativePathFromProjectRoot) so the scss files had to be updated.

We can't update the del package since it does not support require imports anymore, which we need in the gulpfile

Stuff I tested which still works:

  • gulp
  • gulp serve
  • all UI variants in the playground
  • older player versions with the updated UI

This PR drastically improves the output of npm i

  • with this PR: 22 vulnerabilities (5 moderate, 14 high, 3 critical) (there are still some outdated minimist dependencies which i could not get rid of)
  • on main branch: 40 vulnerabilities (9 moderate, 22 high, 9 critical)

also some deprecation warnings are no longer appearing:

npm WARN deprecated gulp-header@2.0.5: Removed event-stream from gulp-header
npm WARN deprecated clone@1.0.2: XSS vulnerability fixed in v1.0.3
npm WARN deprecated xmldom@0.1.19: Deprecated due to CVE-2021-21366 resolved in 0.5.0
npm WARN deprecated gulp-util@3.0.8: gulp-util is deprecated - replace it, following the guidelines at https://medium.com/gulpjs/gulp-util-ca3b1f9f9ac5
npm WARN deprecated buffer@4.9.1: This version of 'buffer' is out-of-date. You must update to v4.9.2 or newer
npm WARN deprecated svgo@0.5.6: This SVGO version is no longer supported. Upgrade to v2.x.x.

@bitmovin-kenny bitmovin-kenny self-assigned this Mar 21, 2023
@bitmovin-kenny bitmovin-kenny marked this pull request as ready for review March 21, 2023 13:46
@bitmovin-kenny bitmovin-kenny merged commit a9c578e into develop Mar 27, 2023
@bitmovin-kenny bitmovin-kenny deleted the chore/update-dependencies branch March 27, 2023 10:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants