Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Resolved npm vulnerabilities #153

Merged
merged 6 commits into from
Jul 5, 2022
Merged

Resolved npm vulnerabilities #153

merged 6 commits into from
Jul 5, 2022

Conversation

mkArtakMSFT
Copy link
Member

@mkArtakMSFT mkArtakMSFT commented Jun 30, 2022

The only way I found for resolving npm audit warnings was by forcing the usage of the latest version of the gulp-parent dependency.

For that I've used a new override support in Node v8: https://docs.npmjs.com/cli/v8/configuring-npm/package-json#overrides

Here is the output from npm audit after the change:
image

I've also updated the license header of the jquery-validation-unobtrusive.js file so that it is aligned with our current (MIT) license as well as is written in JSDoc style, as that's what the new gulp-uglify dependency requires. Otherwise, the license comments will be stripped out from the generated .min.js file.

Keeping this as draft for now to validate the fix before actually proceeding with merging, given that I've updated the dependencies to their latest versions.

** Validation **
Did some basic validation and it works:
image

package.json Outdated Show resolved Hide resolved
package.json Outdated Show resolved Hide resolved
package.json Outdated Show resolved Hide resolved
@mkArtakMSFT mkArtakMSFT marked this pull request as ready for review July 1, 2022 19:55
@mkArtakMSFT mkArtakMSFT requested review from dougbu, ChrisSfanos and Pilchie and removed request for ChrisSfanos July 5, 2022 17:19
@mkArtakMSFT
Copy link
Member Author

@Pilchie do you think that my assessment here for bumping up to v4.0 is reasonable? Essentially, my point is that because we have changed the license, let's bump up the major version.

Copy link
Member

@dougbu dougbu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks fine to me. I am not attempting to answer the 3.3.0 versus 4.0.0 question.

@Pilchie
Copy link

Pilchie commented Jul 5, 2022

Bumping to 4.0.0 seems reasonable to me. @ChrisSfanos - any thoughts?

@ChrisSfanos
Copy link
Contributor

I'm good with moving to 4.0.0

@mkArtakMSFT
Copy link
Member Author

Thanks everyone!

@mkArtakMSFT mkArtakMSFT merged commit 5e49a4a into main Jul 5, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants