Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update jest, parcel for dependabot notice #1072

Merged
merged 2 commits into from Nov 16, 2021
Merged

Update jest, parcel for dependabot notice #1072

merged 2 commits into from Nov 16, 2021

Conversation

palemtnrider
Copy link
Contributor

Closes: 2 dependabot issues

What changed?
parcel and jest in package.json and package-lock.json

Why?
GitHub reported vulnerabilities with ansi-html, and set-value which are used by the older versions of these packages.

How did you test it?
I ran the UI manually against my GitOps cluster and ran the UI tests locally.

Release notes
N/A

Documentation Changes
N/A

josecordaz
josecordaz approved these changes Nov 12, 2021
View reviewed changes
Copy link
Contributor

@josecordaz josecordaz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@josecordaz
Copy link
Contributor

josecordaz commented Nov 12, 2021 •
edited

@palemtnrider I just saw you are going to need to run npm i so package-lock.json reflects the changes made in package.json. This will help to pass the lint issue in CI. You probably did this already but running it on my machine it still shows some changes in the package-lock.json file.

@palemtnrider
Copy link
Contributor Author

@palemtnrider I just saw you are going to need to run npm i so package-lock.json reflects the changes made in package.json. This will help to pass the lint issue in CI.

Thanks @josecordaz I was just looking into that 👍

jpellizzari
jpellizzari approved these changes Nov 12, 2021
View reviewed changes
Copy link
Contributor

@jpellizzari jpellizzari left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. I was surprised there weren't more changes necessary for the jest upgrade. Looks like it was only minor breakages: https://jestjs.io/blog/2021/05/25/jest-27#features-coming-with-breaking-changes

Re the failing Git State check, if you do all of the npm install operations via the Makefile it should resolve that. LMK if you need some help troubleshooting.

package.json
@@ -72,7 +72,8 @@
},
"modulePathIgnorePatterns": [
"<rootDir>/dist/"
]
],
"testEnvironment": "jsdom"
},
"resolutions": {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 You can also force resolutions to specific versions here. It tends to be a little less risky compared up updating major versions.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, @jpellizzari I think I have it figured out.

@palemtnrider palemtnrider force-pushed the dependabot-fixes branch 4 times, most recently from bce0c18 to 23b2a4b Compare November 13, 2021 15:31
@palemtnrider palemtnrider merged commit af1a531 into main Nov 16, 2021
@palemtnrider palemtnrider deleted the dependabot-fixes branch November 16, 2021 14:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jpellizzari jpellizzari jpellizzari approved these changes

@josecordaz josecordaz josecordaz approved these changes

@foot foot Awaiting requested review from foot

Assignees
No one assigned
Labels
exclude from release notes
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@palemtnrider @josecordaz @jpellizzari