Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.
Sign upbase yarn.lock off upstream #46
Merged
Conversation
This yarn.lock is broken/doesn't correspond with package.json, but having this commit makes the following commits (which diverge from upstream) much clearer.
This is basically just `yarn && git add yarn.lock && git commit`. We hold @material-ui/core at 1.0.0 because this is what upstream does, and moving it to 1.5.3 or whatever seriously breaks things. (It expects React 16.) Holding @material-ui/core at 1.0.0 does not cause vulnerability problems. This yarn.lock has plenty of security vulnerabilities that will be resolved in the following commits.
This upgrades set-value, mixin-deep, and union-value to avoid vulnerabilities in set-value and mixin-deep.
snyk-mvn-plugin has a hard dependency on lodash 4.17.11, which has a high-severity vulnerability. To upgrade to a version that uses a newer version of lodash, we must upgrade snyk to >= 1.209.0.
ganache-core ~2.5.7 has a hard dependency on lodash 4.17.11, which has a high-severity vulnerablity. We can upgrade to ganache-core 2.6.1 to resolve the issue and finally remove the vulnerable version of lodash from the dependency tree.
|
Thanks, nice work. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
cg505 commentedAug 13, 2019
•
edited
This PR reverts to the yarn.lock provided by metamask, and then makes the changes we need for things to work and to avoid vulnerabilities.
This fixes the issues with
yarn test:unit. It also fixes the issues withmaterial-uithrowing a fit about react 16 when usingyarn dev:brave. Finally, it fixes the weird infura network errors that prevent some stuff from working (like loading erc20 tokens).There are 10 low-severity vulnerabilities left after these changes.
web3, for which a patch hasn't been released.marked, and 5 arebraces. These can't be resolved without heavy modification to the dependency tree. I tried.These are all also present in master, except for the
markedpackage that jsdoc depends on (which is present anyway via another package).The commits are separated to make this easier to review. The first commit can be ignored, it just copies the yarn.lock from metamask. The other commits are incremental changes that you should be able to make sense of.