Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): bump foundation-sites from 5.5.2 to 5.5.3 #11349

Merged

Conversation

dacook
Copy link
Member

@dacook dacook commented Aug 8, 2023

Better 7 years late than never...

What? Why?

This partially resolves CWE-79: https://security.snyk.io/vuln/npm:foundation-sites:20150619

What should we test?

This is a minor update to the library used for styles on the shopfront (admin interface is not affected).
A quick look through the customer-facing frontend to see if there's regressions should be enough.

Release notes

Changelog Category: Technical changes

The title of the pull request will be included in the release notes.

@dacook
Copy link
Member Author

dacook commented Aug 8, 2023

I've noticed only one thing changed:

  1. Font size on "update" button in Edit cart screen has increased.

Screen Shot 2023-08-08 at 3 09 34 pm

Should be an easy fix.

@dacook
Copy link
Member Author

dacook commented Aug 8, 2023

Actually, it turns out it didn't fully resolve the vulnerability, so there's no point upgrading this for that reason.
It's 7 years old so I don't think there's any point upgrading for new features or further support, either.

So I suggest we don't bother with this.

"foundation-sites": "^5.5.2",
"foundation-sites": "^5.5.3",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we lock the version to 5.X.X?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Probably, but do you think we should do this update? (and any other highly unlikely updates to v5?)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not? It would remove the question of updating in the future if we are on the latest already. 😄

But as you say, it's unlikely that there will be more. So no big impact either way. But we may as well finish this and lock the version in and then nobody will question it again, I guess.

@dacook dacook marked this pull request as ready for review September 7, 2023 01:55
@dacook
Copy link
Member Author

dacook commented Sep 7, 2023

I'm unable to replicate the update cart button issue now, perhaps something just didn't load properly in my dev environment. Still, it would be good to have a manual test on a staging environment.

@filipefurtad0 filipefurtad0 added the pr-staged-uk staging.openfoodnetwork.org.uk label Sep 7, 2023
@filipefurtad0 filipefurtad0 self-assigned this Sep 7, 2023
@filipefurtad0
Copy link
Contributor

Hey @dacook,

Thanks for spotting that minor regression!

Indeed, I could reproduce it throughout Chrome/Firefox/Safari:

Before
image

After
image

Other than that, I've noticed no other changes whatsoever. So, merging.
And opening an issue, to fix the update button.

@filipefurtad0 filipefurtad0 merged commit b64c1c2 into openfoodfoundation:master Sep 7, 2023
52 checks passed
dacook added a commit to dacook/openfoodnetwork that referenced this pull request Sep 8, 2023
This was broken when upgrading [Foundation](openfoodfoundation#11349). For some reason the button.expand class now sets larger font size and padding, which overrides the button.small class. It's probably a bug but we'll have to work around it.
@dacook dacook mentioned this pull request Sep 8, 2023
4 tasks
@filipefurtad0 filipefurtad0 removed the pr-staged-uk staging.openfoodnetwork.org.uk label Sep 8, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Archived in project
Development

Successfully merging this pull request may close these issues.

None yet

3 participants