psych-ds/pds-2020-validator-prototype

Upgrade serialize-javascript in local validator

Opened this issue ยท 2 comments

@axrhart, there is one dependency in validator-local, namely serialize-javascript, that GitHub is reporting as a potential security issue. I don't think it's critical, but it would be nice still to have it out of the way, and upgrade a couple dependencies while we're at it. The package is included transitively through react-scripts, and I think an upgrade of that package should solve it.

I'm happy to take a look if you don't have the time right now, but as I'm not familiar with the local validator code I'd be upgrading blindly.

$ yarn why serialize-javascript
yarn why v1.22.1
[1/4] ๐Ÿค”  Why do we have the module "serialize-javascript"...?
[2/4] ๐Ÿšš  Initialising dependency graph...
[3/4] ๐Ÿ”  Finding dependency...
[4/4] ๐Ÿšก  Calculating file sizes...
=> Found "serialize-javascript@1.9.1"
info Reasons this module exists
   - "react-scripts#terser-webpack-plugin" depends on it
   - Hoisted from "react-scripts#terser-webpack-plugin#serialize-javascript"
โœจ  Done in 0.97s.

Thanks for the notification @FelixHenninger

Actually, we can delete the validator-local for the moment. This is a very much outdated version and I switched my approach to electron a while ago. I also had a very unfortunate rm -rf accident a few weeks ago, which deleted multiple days of progress... so there is not much validator-local at the moment anyway. >.<

@axrhart Oh no, I'm sorry to hear that the computer swallowed your data! I really hope nothing more important got lost ๐Ÿ˜ฌ.

With regard to the validator-local, I think if you're planning to extend it there's no need to remove the directory -- if we know that the message that Github is sending is not acute, I don't think we'd need to erase things to get rid of it. I could also go in and just upgrade react-scripts in isolation if that would help -- in my experience it should be a straightforward change.

I'd be happy to help you build up your work again, if that would help!