Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

dep: remove font-awesome-webpack #10401

Merged
merged 1 commit into from
Nov 11, 2021
Merged

Conversation

vince-fugnitto
Copy link
Member

What it does

Fixes: #10400

The pull-request removes font-awesome-webpack as a dependency since:

  • the dependency is outdated and no longer maintained
  • the dependency has high security vulnerabilities
  • the dependency does not support newer versions of webpack

The change now uses the already used css-loader and url-loader to load font-awesome icons and fonts.

How to test

1, confirm that the build and start of the application is successful
2. confirm that yarn audit --level=high does not yield vulnerability results for font-awesome-webpack
3. confirm that the use of font-awesome icons still works correctly (ex: replacing a codicon with the previous fa)

Review checklist

Reminder for reviewers

Signed-off-by: vince-fugnitto [email protected]

The commit removes `font-awesome-webpack` as a dependency since:
- the dependency was outdated
- the dependency is no longer maintained
- the dependency has high security vulnerabilities
- the dependency does not support newer versions of webpack

The change now uses the already used `css-loader` and `url-loader` to
load font-awesome icons and fonts.

Signed-off-by: vince-fugnitto <[email protected]>
@vince-fugnitto vince-fugnitto added quality issues related to code and application quality security issues related to security dependencies pull requests that update a dependency file labels Nov 9, 2021
@vince-fugnitto vince-fugnitto self-assigned this Nov 9, 2021
Copy link
Member

@msujew msujew left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The changes look good to me, font-awesome icons continue to work correctly:

image

One question before approving. When running yarn audit --level=high, I receive this output:

35 vulnerabilities found - Packages audited: 1810
Severity: 15 Low | 20 Moderate

Am I right in the assumption that this eliminates all high-rated vulnerabilities?

@vince-fugnitto
Copy link
Member Author

One question before approving. When running yarn audit --level=high, I receive this output:

35 vulnerabilities found - Packages audited: 1810
Severity: 15 Low | 20 Moderate

Am I right in the assumption that this eliminates all high-rated vulnerabilities?

@msujew that's correct, the summary is always present after the audit, the new report now shows that all high level (and higher) vulnerabilities have been removed :) (along with work from #10381, #10391)

Before the changes:

Severity: 15 Low | 24 Moderate | 4 High

After:

Severity: 15 Low | 20 Moderate

Copy link
Member

@msujew msujew left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Alright, looks good! Great work with resolving all of the security vulnerabilities 👍

@vince-fugnitto vince-fugnitto merged commit bb5a436 into master Nov 11, 2021
@vince-fugnitto vince-fugnitto deleted the vf/font-awesome-webpack branch November 11, 2021 15:22
@github-actions github-actions bot added this to the 1.20.0 milestone Nov 11, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies pull requests that update a dependency file quality issues related to code and application quality security issues related to security
Projects
None yet
Development

Successfully merging this pull request may close these issues.

dep: outdated font-awesome-webpack dependency
2 participants