Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update lodash #1533

Merged
merged 2 commits into from May 21, 2018
Merged

Update lodash #1533

merged 2 commits into from May 21, 2018

Conversation

chrisdukakis
Copy link
Contributor

@chrisdukakis chrisdukakis commented May 16, 2018

Fixes #1532 . Updates lodash in all deps, in light of https://nodesecurity.io/advisories/577, just in case.
Pls review and merge this or #1528 , we all need it.

package.json Outdated
@@ -19,7 +19,7 @@
"utility"
],
"dependencies": {
"lodash": "^4.14.0",
"lodash": "^4.17.5",
"lodash-es": "^4.14.0"
Copy link
Collaborator

@hargasinski hargasinski May 17, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does lodash-es need to be updated too?

Copy link
Contributor Author

@chrisdukakis chrisdukakis May 17, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lodash-es doesn't depend on lodash, it's fine as is

Copy link
Collaborator

@hargasinski hargasinski May 17, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As far as I know, lodash-es is built from lodash.

Either way, it's probably a good idea to keep them synced. Could you update it to v4.17.5? The PR will be good to go afterwards.

Copy link
Contributor Author

@chrisdukakis chrisdukakis May 17, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You are right! Done!

@@ -48,7 +48,7 @@
"karma-mocha-reporter": "^2.2.0",
"mocha": "^3.1.2",
"native-promise-only": "^0.8.0-a",
"nyc": "^7.0.0",
"nyc": "^11.8.0",
Copy link
Collaborator

@hargasinski hargasinski May 17, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm assuming this is because the old version of nyc was using an older version of lodash?

Copy link
Contributor Author

@chrisdukakis chrisdukakis May 17, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

that's correct

@hargasinski
Copy link
Collaborator

@hargasinski hargasinski commented May 17, 2018

Thanks for the PR! I just added a couple of quick comments.

I'm okay with merging this for a quick patch release until #1528 gets merged and released in v3.

@chrisdukakis
Copy link
Contributor Author

@chrisdukakis chrisdukakis commented May 17, 2018

Thank you @hargasinski ! I only updated packages using lodash, there are more cases that you might want to look into, but all of those are dev deps. I wasn't familiar with those tools, so I didn't push further changes and brake anything. You can try an npm audit and check the log.

@aearly
Copy link
Collaborator

@aearly aearly commented May 21, 2018

Going to merge this for a patch, will remove Lodash in 3.0

@aearly aearly merged commit d28b725 into caolan:master May 21, 2018
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants