Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: upgrade image-webpack-loader to 8.1.0 #223

Merged
merged 1 commit into from
Jan 11, 2022

Conversation

adamstankiewicz
Copy link
Member

@adamstankiewicz adamstankiewicz commented Jan 11, 2022

This upstream PR was merged and released for image-webpack-loader to upgrade imagemin-webp from v6 to v7 to remove its dependency on trim-newlines which has a "High" security vulnerability at its current version.

As a result, we can upgrade to this new version of image-webpack-loader to resolve our security dependency.

@adamstankiewicz adamstankiewicz changed the title fix: upgrade image-webpack-loader fix: upgrade image-webpack-loader to 8.1.0 Jan 11, 2022
Copy link
Member

@ghassanmas ghassanmas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Kudos to you that you for pushing the upstream fix!.

@adamstankiewicz adamstankiewicz merged commit 52510fe into master Jan 11, 2022
@adamstankiewicz adamstankiewicz deleted the astankiewicz/image-webpack-loader-8.1.0 branch January 11, 2022 14:17
@edx-semantic-release
Copy link

🎉 This PR is included in version 9.0.6 🎉

The release is available on:

Your semantic-release bot 📦🚀

@regisb
Copy link
Contributor

regisb commented Jan 12, 2022

Should this PR be applied to the Maple release? If yes that would mean upgrading frontend-build in all MFEs, correct?

@ghassanmas
Copy link
Member

I guess if that is true, it would be nice if edx-tools would have a feature to update an npm package for MFEs, I anticipate something like:
The script gets as input the following;

  • The package name and its target version
  • The target MFEs that needs to be updated
  • Branch name
  • commit message

Then the flow would be something like

  • Check out branch
  • Commit a change with {"PacakgeName":"targetVersion"} for all the targeted MFEs
  • Open PR for the changes?.

It's just my speculation, if it's something common to update all MFEs then it makes sense to develop such a script. however I just wonder why "^" isn't used because it installs the latest patches by default, I guess there might a reason why, I am just wondering.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants