Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update outdated dependencies #319

Open
wants to merge 2 commits into
base: develop
Choose a base branch
from
Open

Conversation

dkotter
Copy link
Collaborator

@dkotter dkotter commented Nov 14, 2024

Description of the Change

This PR updates all of our outdated direct node dependencies.

It also resolves two security issues with dependencies other dependencies are including. Dependabot normally fixes those but it seems to be having issues with these two (for those with access, can see this under the Security > Dependabot setting).

Here's what I did:

  1. For any dependencies we are directly managing in our package.json file, bump those to the latest version, except for mochawesome-json-to-md as this is known to break our E2E workflow
  2. Remove the existing package-lock.json file
  3. Run npm install to bring in all the latest versions of packages
  4. Run npm audit to see if any security issues remain
  5. Two issues were flagged, one with @sentry/node and one with puppeteer-core. These are dependencies used by the lighthouse dependency, which is relied on by @wordpress/scripts. We're already using the latest version of @wordpress/scripts so updating that won't fix things. Instead, I directly updated those dependencies to their latest in the package-lock.json file. This fixes the security issues for now though those updates will be wiped out the next time we update @wordpress/scripts

How to test the Change

Verify all tests pass on this PR

Changelog Entry

Security - Bump @10up/cypress-wp-utils from 0.2.0 to 0.4.0
Security - Bump @sentry/node from 6.19.7 to 8.38.0
Security - Bump @wordpress/env from 9.2.0 to 10.11.0
Security - Bump cypress from 13.2.0 to 13.15.2
Security - Bump cypress-mochawesome-reporter from 3.6.0 to 3.8.2
Security - Bump puppeteer-core from 23.3.0 to 23.8.0

Credits

Props @dkotter

Checklist:

@dkotter dkotter added this to the 2.8.3 milestone Nov 14, 2024
@dkotter dkotter self-assigned this Nov 14, 2024
@github-actions github-actions bot added the needs:code-review This requires code review. label Nov 14, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
needs:code-review This requires code review.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant