-
Notifications
You must be signed in to change notification settings - Fork 114
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Resolved npm vulnerabilities #153
Conversation
Co-authored-by: Doug Bunting <6431421+dougbu@users.noreply.github.com>
@Pilchie do you think that my assessment here for bumping up to v4.0 is reasonable? Essentially, my point is that because we have changed the license, let's bump up the major version. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
looks fine to me. I am not attempting to answer the 3.3.0
versus 4.0.0
question.
Bumping to 4.0.0 seems reasonable to me. @ChrisSfanos - any thoughts? |
I'm good with moving to 4.0.0 |
Thanks everyone! |
The only way I found for resolving npm audit warnings was by forcing the usage of the latest version of the
gulp-parent
dependency.For that I've used a new
override
support in Node v8: https://docs.npmjs.com/cli/v8/configuring-npm/package-json#overridesHere is the output from
npm audit
after the change:I've also updated the license header of the jquery-validation-unobtrusive.js file so that it is aligned with our current (MIT) license as well as is written in JSDoc style, as that's what the new gulp-uglify dependency requires. Otherwise, the license comments will be stripped out from the generated
.min.js
file.Keeping this as
draft
for now to validate the fix before actually proceeding with merging, given that I've updated the dependencies to their latest versions.** Validation **
Did some basic validation and it works: