Migrate all lodash' per-method-packages usage to lodash. #4274

dolphinigle · 2023-01-11T11:42:33Z

Murderlon · 2023-01-11T12:12:17Z

Thanks! One issue still:

 /home/runner/work/uppy/uppy/packages/@uppy/utils/src/emitSocketProgress.js
Error:   1:1  error  'lodash.throttle' should be listed in the project's dependencies. Run 'npm i -S lodash.throttle' to add it  import/no-extraneous-dependencies

@uppy/utils

dolphinigle · 2023-01-11T12:16:29Z

Whoops, fixed, thanks!

Murderlon · 2023-01-11T12:39:41Z

We still have one issue with the Webpack build:
https://github.com/transloadit/uppy/actions/runs/3892696019/jobs/6644534120

socket-security · 2023-04-27T17:22:45Z

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Next steps

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all

mifi · 2023-04-27T17:38:20Z

hmm, do we need to use .js suffix? e.g. lodash/throttle.js

socket-security · 2023-06-19T13:27:40Z

New and updated dependency changes detected. Learn more about Socket for GitHub ↗︎

Packages		Version	New capabilities	Transitives¹	Size	Publisher
@types/lodash	🆕	4.14.191	None	`+0`	1.72 MB	types

🚮 Removed packages: @types/lodash.merge@4.6.6

https://docs.socket.dev ↩

| Package | Version | Package | Version | | ---------------------- | ------- | ---------------------- | ------- | | @uppy/aws-s3 | 3.2.0 | @uppy/status-bar | 3.2.0 | | @uppy/aws-s3-multipart | 3.4.0 | @uppy/transloadit | 3.1.6 | | @uppy/companion | 4.5.1 | @uppy/tus | 3.1.1 | | @uppy/core | 3.2.1 | @uppy/url | 3.3.2 | | @uppy/dashboard | 3.4.1 | @uppy/utils | 5.4.0 | | @uppy/golden-retriever | 3.0.4 | @uppy/xhr-upload | 3.3.0 | | @uppy/locales | 3.2.2 | uppy | 3.10.0 | | @uppy/provider-views | 3.3.1 | | | - @uppy/aws-s3-multipart: fix the chunk size calculation (Antoine du Hamel / #4508) - @uppy/aws-s3: add `shouldUseMultipart` option (Antoine du Hamel / #4299) - @uppy/companion: switch from aws-sdk v2 to @aws-sdk/* (v3) (Scott Bessler / #4285) - @uppy/companion,@uppy/core,@uppy/dashboard,@uppy/golden-retriever,@uppy/status-bar,@uppy/utils: Migrate all lodash' per-method-packages usage to lodash. (LinusMain / #4274) - @uppy/core: Don't set late (throttled) progress event on a file that is 100% complete (Artur Paikin / #4507) - @uppy/companion: revert randomness from file names (Mikael Finstad / #4509) - @uppy/companion: Custom provider fixes (Mikael Finstad / #4498) - @uppy/transloadit: ensure `fields` is not nullish when there no uploaded files (Antoine du Hamel / #4487) - @uppy/aws-s3-multipart,@uppy/aws-s3,@uppy/tus,@uppy/utils,@uppy/xhr-upload: When file is removed (or all are canceled), controller.abort queued requests (Artur Paikin / #4504) - @uppy/provider-views: Fix range selection not resetting and computing correctly (Terence C / #4415) - meta: disallow use of `.only` in tests (Antoine du Hamel / #4494) - @uppy/companion: fix 500 when file name contains non-ASCII chars (Antoine du Hamel / #4493) - @uppy/locales: update `fr_FR.js` (Samuel De Backer / #4499) - @uppy/aws-s3-multipart,@uppy/tus,@uppy/xhr-upload: Don't close socket while upload is still in progress (Artur Paikin / #4479) - meta: bump `luxon` from 1.28.0 to 1.28.1 (dependabot[bot] / #4497) - @uppy/utils: rename `EventTracker` -> `EventManager` (Stephen Wooten / #4481) - meta: bump cookiejar from 2.1.3 to 2.1.4 (dependabot[bot] / #4496) - meta: make `pre-commit` use `corepack yarn` instead of `npm run` (Antoine du Hamel / #4495) - meta: bump ua-parser-js from 0.7.31 to 0.7.35 (dependabot[bot] / #4474) - meta: bump @sideway/formula from 3.0.0 to 3.0.1 (dependabot[bot] / #4473) - meta: bump http-cache-semantics from 4.1.0 to 4.1.1 (dependabot[bot] / #4472) - @uppy/companion: Use filename from content-disposition instead of relying on url, with fallback (Artur Paikin / #4489) - meta: bump `babel`, `esbuild`, and `vite` (dependabot[bot] / #4485) - @uppy/dashboard: include the old state when setting new (Artur Paikin / #4490) - @uppy/companion: fix companion implicitpath (Mikael Finstad / #4484) - @uppy/companion: fix undefined protocol and example page (Mikael Finstad / #4483) - meta: upgrade Cypress 12.9.0 -> 12.14.0 (Antoine du Hamel / #4491) - @uppy/core: remove `state` getter from types (Antoine du Hamel / #4477) - examples/php-xhr: Added filename sanitation and file size check before saving (neuronet77 / #4432) - examples/php-xhr: update PHP dependencies (dependabot[bot]) - @uppy/xhr-upload: add support for arrays in metadata (Vasiliy Matyushin / #4431) - @uppy/status-bar: Filtered ETA (stduhpf / #4458) - @uppy/aws-s3-multipart: fix `getUploadParameters` option (Antoine du Hamel / #4465)

* main: (61 commits) Release: uppy@3.10.0 (#4511) @uppy/aws-s3-multipart: fix the chunk size calculation (#4508) @uppy/aws-s3: add `shouldUseMultipart` option (#4299) @uppy/companion: switch from aws-sdk v2 to @aws-sdk/* (v3) (#4285) Migrate all lodash' per-method-packages usage to lodash. (#4274) @uppy/core: Don't set late (throttled) progress event on a file that is 100% complete (#4507) @uppy/companion: revert randomness from file names (#4509) Custom provider fixes (#4498) @uppy/transloadit: ensure `fields` is not nullish when there no uploaded files (#4487) When file is removed (or all are canceled), controller.abort queued requests (#4504) @uppy/provider-views: Fix range selection not resetting and computing correctly (#4415) meta: disallow use of `.only` in tests (#4494) @uppy/companion: fix 500 when file name contains non-ASCII chars (#4493) @uppy/locales: update `fr_FR.js` (#4499) Don't close socket while upload is still in progress (#4479) meta: bump `luxon` from 1.28.0 to 1.28.1 (#4497) @uppy/utils: rename `EventTracker` -> `EventManager` (#4481) meta: bump cookiejar from 2.1.3 to 2.1.4 (#4496) meta: make `pre-commit` use `corepack yarn` instead of `npm run` (#4495) meta: bump ua-parser-js from 0.7.31 to 0.7.35 (#4474) ...

* main: Release: uppy@3.10.0 (#4511) @uppy/aws-s3-multipart: fix the chunk size calculation (#4508) @uppy/aws-s3: add `shouldUseMultipart` option (#4299) @uppy/companion: switch from aws-sdk v2 to @aws-sdk/* (v3) (#4285) Migrate all lodash' per-method-packages usage to lodash. (#4274) @uppy/core: Don't set late (throttled) progress event on a file that is 100% complete (#4507) @uppy/companion: revert randomness from file names (#4509) Custom provider fixes (#4498) @uppy/transloadit: ensure `fields` is not nullish when there no uploaded files (#4487) When file is removed (or all are canceled), controller.abort queued requests (#4504) @uppy/provider-views: Fix range selection not resetting and computing correctly (#4415) meta: disallow use of `.only` in tests (#4494)

Migrate all lodash' per-method-packages usage to lodash.

0656b95

github-actions bot added the pending end-to-end tests label Jan 11, 2023

Murderlon added the safe to test Add this label on trustworthy PRs to spawn the e2e test suite label Jan 11, 2023

Fixed lodash.throttle still being imported after the migration in

7345bfc

@uppy/utils

github-actions bot removed pending end-to-end tests safe to test Add this label on trustworthy PRs to spawn the e2e test suite labels Jan 11, 2023

arturi requested a review from mifi April 27, 2023 14:38

Merge branch 'main' into lodash-migration

35a617b

github-actions bot added the pending end-to-end tests label Apr 27, 2023

mifi approved these changes Apr 27, 2023

View reviewed changes

Merge branch 'main' into lodash-migration

c4e4cf9

aduh95 self-assigned this May 24, 2023

Merge branch 'main' into lodash-migration

5e45ae8

aduh95 added 2 commits June 19, 2023 15:29

add file extension

489c0de

fixup! add file extension

e3432da

aduh95 added the safe to test Add this label on trustworthy PRs to spawn the e2e test suite label Jun 19, 2023

github-actions bot removed pending end-to-end tests safe to test Add this label on trustworthy PRs to spawn the e2e test suite labels Jun 19, 2023

aduh95 merged commit 38de438 into transloadit:main Jun 19, 2023
21 checks passed

github-actions bot mentioned this pull request Jun 19, 2023

Release: uppy@3.10.0 #4511

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Migrate all lodash' per-method-packages usage to lodash. #4274

Migrate all lodash' per-method-packages usage to lodash. #4274

dolphinigle commented Jan 11, 2023

Murderlon commented Jan 11, 2023

dolphinigle commented Jan 11, 2023

Murderlon commented Jan 11, 2023

socket-security bot commented Apr 27, 2023 •

edited

mifi commented Apr 27, 2023

socket-security bot commented Jun 19, 2023

Migrate all lodash' per-method-packages usage to lodash. #4274

Migrate all lodash' per-method-packages usage to lodash. #4274

Conversation

dolphinigle commented Jan 11, 2023

Murderlon commented Jan 11, 2023

dolphinigle commented Jan 11, 2023

Murderlon commented Jan 11, 2023

socket-security bot commented Apr 27, 2023 • edited

Next steps

mifi commented Apr 27, 2023

socket-security bot commented Jun 19, 2023

Footnotes

socket-security bot commented Apr 27, 2023 •

edited