Upgrade serialize-javascript in local validator
Opened this issue ยท 2 comments
@axrhart, there is one dependency in validator-local
, namely serialize-javascript
, that GitHub is reporting as a potential security issue. I don't think it's critical, but it would be nice still to have it out of the way, and upgrade a couple dependencies while we're at it. The package is included transitively through react-scripts
, and I think an upgrade of that package should solve it.
I'm happy to take a look if you don't have the time right now, but as I'm not familiar with the local validator code I'd be upgrading blindly.
$ yarn why serialize-javascript
yarn why v1.22.1
[1/4] ๐ค Why do we have the module "serialize-javascript"...?
[2/4] ๐ Initialising dependency graph...
[3/4] ๐ Finding dependency...
[4/4] ๐ก Calculating file sizes...
=> Found "serialize-javascript@1.9.1"
info Reasons this module exists
- "react-scripts#terser-webpack-plugin" depends on it
- Hoisted from "react-scripts#terser-webpack-plugin#serialize-javascript"
โจ Done in 0.97s.
Thanks for the notification @FelixHenninger
Actually, we can delete the validator-local
for the moment. This is a very much outdated version and I switched my approach to electron a while ago. I also had a very unfortunate rm -rf
accident a few weeks ago, which deleted multiple days of progress... so there is not much validator-local
at the moment anyway. >.<
@axrhart Oh no, I'm sorry to hear that the computer swallowed your data! I really hope nothing more important got lost ๐ฌ.
With regard to the validator-local
, I think if you're planning to extend it there's no need to remove the directory -- if we know that the message that Github is sending is not acute, I don't think we'd need to erase things to get rid of it. I could also go in and just upgrade react-scripts
in isolation if that would help -- in my experience it should be a straightforward change.
I'd be happy to help you build up your work again, if that would help!