From 52ce6551b8b4ff92f1b73efda54e2c88cd28aa46 Mon Sep 17 00:00:00 2001 From: Roy Johnson Date: Wed, 28 Jun 2023 15:30:45 -0500 Subject: [PATCH] Upgrade insecure packages (#1937) * Upgrade styled-components to ^4 * Resolve high risk vulnerability packages * Move react-scripts to devDependencies Per https://stackoverflow.com/a/69576030 this will reduce the vulnerability warnings * Upgrade workbox packages * Upgrade aws, babel, formatjs, sentry * Upgraded @types packages * Upgrade html-entities and date-fns * Upgrade node-fetch * Upgrade ts-utils --- craco.config.js | 2 +- package.json | 53 +- src/app/auth/init/establishState.ts | 3 +- .../__snapshots__/DotMenu.spec.tsx.snap | 20 +- .../__snapshots__/Dropdown.spec.tsx.snap | 6 +- .../__snapshots__/routes.spec.tsx.snap | 12 +- .../Topbar/__snapshots__/index.spec.tsx.snap | 32 +- .../AssignedTopBar.spec.tsx.snap | 4 +- .../__snapshots__/Attribution.spec.tsx.snap | 24 +- .../__snapshots__/BookBanner.spec.tsx.snap | 12 +- .../__snapshots__/Content.spec.tsx.snap | 180 +- .../__snapshots__/PrevNextBar.spec.tsx.snap | 10 +- .../__snapshots__/Wrapper.spec.tsx.snap | 4 +- .../__snapshots__/ChapterFilter.spec.tsx.snap | 22 +- .../__snapshots__/ColorFilter.spec.tsx.snap | 20 +- .../popUp/__snapshots__/Filters.spec.tsx.snap | 32 +- .../__snapshots__/PrintButton.spec.tsx.snap | 4 +- .../__snapshots__/ContextMenu.spec.tsx.snap | 38 +- .../__snapshots__/Filters.spec.tsx.snap | 36 +- .../HighlightsHelpInfo.spec.tsx.snap | 2 +- .../ColorIndicator.spec.tsx.snap | 4 +- .../__snapshots__/ColorPicker.spec.tsx.snap | 20 +- .../__snapshots__/DisplayNote.spec.tsx.snap | 18 +- .../KeyboardShortcutsPopup.spec.tsx.snap | 2 +- .../__snapshots__/Filters.spec.tsx.snap | 26 +- .../__snapshots__/FinalScreen.spec.tsx.snap | 2 +- .../PracticeQuestionsPopup.spec.tsx.snap | 6 +- .../__snapshots__/index.spec.tsx.snap | 12 +- .../UsingThisGuide.spec.tsx.snap | 6 +- .../__snapshots__/Filters.spec.tsx.snap | 50 +- .../__snapshots__/Home.spec.tsx.snap | 20 +- .../__snapshots__/ErrorBoundary.spec.tsx.snap | 16 +- .../__snapshots__/ErrorModal.spec.tsx.snap | 4 +- yarn.lock | 3414 +++++++++-------- 34 files changed, 2221 insertions(+), 1895 deletions(-) diff --git a/craco.config.js b/craco.config.js index ba4c3b8f3d..7be3cb2bb9 100644 --- a/craco.config.js +++ b/craco.config.js @@ -8,7 +8,7 @@ module.exports = { alias: { // ts-utils uses the `exports` package.json options, which is not supported in webpack 4 // this can be removed if we update react-scripts - '@openstax/ts-utils': '@openstax/ts-utils/dist' + '@openstax/ts-utils': '@openstax/ts-utils/dist/cjs' }, }, plugins: [{ diff --git a/package.json b/package.json index 4820b14786..cfe03650bb 100644 --- a/package.json +++ b/package.json @@ -7,19 +7,19 @@ }, "dependencies": { "@craco/craco": "<7", - "@formatjs/intl-pluralrules": "^5.1.10", + "@formatjs/intl-pluralrules": "^5.2.3", "@openstax/event-capture-client": "^2.0.2", "@openstax/highlighter": "1.13.0", "@openstax/open-search-client": "0.1.0-build.7", - "@openstax/ts-utils": "1.1.12", - "@sentry/integrations": "^7.44.2", - "@sentry/react": "^7.44.2", + "@openstax/ts-utils": "1.1.43", + "@sentry/integrations": "^7.54.0", + "@sentry/react": "^7.54.0", "color": "^3.1.2", "details-element-polyfill": "^2.4.0", "flat": "~5.0", "focus-within-polyfill": "^5.2.1", "history": "4.7.2", - "html-entities": "^2.3.3", + "html-entities": "^2.3.5", "js-cookie": "~2.2", "lodash": "^4.17.21", "mdn-polyfills": "^5.20.0", @@ -33,23 +33,22 @@ "react-intl": "<5.13", "react-loadable": "~5.5", "react-redux": "~7.1", - "react-scripts": "^4.0.3", "redux": "4.0.1", "reselect": "4.0.0", "scroll-to-element": "^2.0.3", "stacktrace-js": "~2.0", - "styled-components": "~4.3", + "styled-components": "^4", "styled-icons": "8.1.0", "typesafe-actions": "^4.4.2", "typescript": "<4.3.0", "url": "^0.11.0", "uuid": "~7.0", "weak-map": "^1.0.8", - "workbox-core": "^6.5.4", - "workbox-expiration": "^6.5.4", - "workbox-precaching": "^6.5.4", - "workbox-routing": "^6.5.4", - "workbox-strategies": "^6.5.4" + "workbox-core": "^7.0.0", + "workbox-expiration": "^7.0.0", + "workbox-precaching": "^7.0.0", + "workbox-routing": "^7.0.0", + "workbox-strategies": "^7.0.0" }, "scripts": { "trust-localhost": "./script/trust-localhost.bash", @@ -102,19 +101,19 @@ "not op_mini all" ], "devDependencies": { - "@aws-sdk/client-cloudformation": "^3.295.0", - "@aws-sdk/client-s3": "^3.295.0", - "@aws-sdk/client-sqs": "^3.295.0", - "@aws-sdk/credential-providers": "^3.295.0", - "@babel/core": "^7.21.3", + "@aws-sdk/client-cloudformation": "^3.348.0", + "@aws-sdk/client-s3": "^3.348.0", + "@aws-sdk/client-sqs": "^3.348.0", + "@aws-sdk/credential-providers": "^3.348.0", + "@babel/core": "^7.22.5", "@babel/plugin-proposal-class-properties": "^7.1.0", "@babel/plugin-proposal-object-rest-spread": "^7.0.0", "@babel/plugin-proposal-optional-chaining": "^7.13.12", - "@babel/plugin-transform-runtime": "^7.1.0", - "@babel/preset-env": "^7.20.2", - "@babel/preset-react": "<7.17", - "@babel/preset-typescript": "^7.21.0", - "@babel/register": "^7.0.0", + "@babel/plugin-transform-runtime": "^7.22.5", + "@babel/preset-env": "^7.22.5", + "@babel/preset-react": "7.22.5", + "@babel/preset-typescript": "^7.22.5", + "@babel/register": "^7.22.5", "@openstax/types": "^3.1.0", "@types/color": "^3.0.3", "@types/express": "~4.17", @@ -147,7 +146,7 @@ "babel-core": "7.0.0-bridge.0", "babel-plugin-transform-dynamic-import": "^2.1.0", "codecov": "^3.8.3", - "date-fns": "^2.29.3", + "date-fns": "^2.30.0", "date-fns-tz": "^2.0.0", "express": "~4.17", "glob": "<9", @@ -164,6 +163,7 @@ "pretty": "^2.0.0", "progress": "^2.0.3", "puppeteer": "~5.4", + "react-scripts": "^4.0.3", "react-test-renderer": "~16.9", "resize-observer-polyfill": "^1.5.1", "semver-sort": "~0.0", @@ -179,6 +179,11 @@ "tslint": "6.1.3", "yargs": "~13.2" }, + "resolutions": { + "fast-xml-parser": "4.2.4", + "node-fetch": "~2.6", + "xml2js": "0.5.0" + }, "jest": { "testEnvironment": "jsdom", "moduleFileExtensions": [ @@ -190,7 +195,7 @@ ], "moduleNameMapper": { "//comment//": "remove this when CRA upgrades jest above 28", - "(.*)@openstax/ts-utils(.*)": "$1@openstax/ts-utils/dist$2" + "(.*)@openstax/ts-utils(.*)": "$1@openstax/ts-utils/dist/cjs$2" }, "setupFilesAfterEnv": [ "/src/test/setup.ts" diff --git a/src/app/auth/init/establishState.ts b/src/app/auth/init/establishState.ts index 982f95312d..4feebe88e0 100644 --- a/src/app/auth/init/establishState.ts +++ b/src/app/auth/init/establishState.ts @@ -1,6 +1,7 @@ import { Initializer } from '../../types'; import { receiveLoggedOut, receiveUser } from '../actions'; import { formatUser } from '../utils'; +import { AccountsUser } from '../../../gateways/createUserLoader'; const initializer: Initializer = async({dispatch, userLoader}) => { if (typeof(document) === 'undefined') { @@ -10,7 +11,7 @@ const initializer: Initializer = async({dispatch, userLoader}) => { const user = await userLoader.getCurrentUser(); if (user) { - dispatch(receiveUser(formatUser(user))); + dispatch(receiveUser(formatUser(user as AccountsUser))); } else { dispatch(receiveLoggedOut()); } diff --git a/src/app/components/__snapshots__/DotMenu.spec.tsx.snap b/src/app/components/__snapshots__/DotMenu.spec.tsx.snap index d9577197ee..5e7d900ca5 100644 --- a/src/app/components/__snapshots__/DotMenu.spec.tsx.snap +++ b/src/app/components/__snapshots__/DotMenu.spec.tsx.snap @@ -2,13 +2,13 @@ exports[`Dropdown matches snapshot 1`] = `