Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade serialize-javascript in local validator #19

Open
FelixHenninger opened this issue Mar 10, 2020 · 2 comments
Open

Upgrade serialize-javascript in local validator #19

FelixHenninger opened this issue Mar 10, 2020 · 2 comments

Comments

@FelixHenninger
Copy link
Collaborator

FelixHenninger commented Mar 10, 2020

@axrhart, there is one dependency in validator-local, namely serialize-javascript, that GitHub is reporting as a potential security issue. I don't think it's critical, but it would be nice still to have it out of the way, and upgrade a couple dependencies while we're at it. The package is included transitively through react-scripts, and I think an upgrade of that package should solve it.

I'm happy to take a look if you don't have the time right now, but as I'm not familiar with the local validator code I'd be upgrading blindly.

$ yarn why serialize-javascript
yarn why v1.22.1
[1/4] 🤔  Why do we have the module "serialize-javascript"...?
[2/4] 🚚  Initialising dependency graph...
[3/4] 🔍  Finding dependency...
[4/4] 🚡  Calculating file sizes...
=> Found "[email protected]"
info Reasons this module exists
   - "react-scripts#terser-webpack-plugin" depends on it
   - Hoisted from "react-scripts#terser-webpack-plugin#serialize-javascript"
✨  Done in 0.97s.
@axrhart
Copy link
Collaborator

axrhart commented Mar 10, 2020

Thanks for the notification @FelixHenninger

Actually, we can delete the validator-local for the moment. This is a very much outdated version and I switched my approach to electron a while ago. I also had a very unfortunate rm -rf accident a few weeks ago, which deleted multiple days of progress... so there is not much validator-local at the moment anyway. >.<

@FelixHenninger
Copy link
Collaborator Author

@axrhart Oh no, I'm sorry to hear that the computer swallowed your data! I really hope nothing more important got lost 😬.

With regard to the validator-local, I think if you're planning to extend it there's no need to remove the directory -- if we know that the message that Github is sending is not acute, I don't think we'd need to erase things to get rid of it. I could also go in and just upgrade react-scripts in isolation if that would help -- in my experience it should be a straightforward change.

I'd be happy to help you build up your work again, if that would help!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants