Skip to content

Conversation

Kocal
Copy link
Member

@Kocal Kocal commented Aug 21, 2024

We have some vulnerability alerts raised by Dependabot https://github.com/symfony/webpack-encore/security/dependabot?q=is%3Aopen+manifest%3Ayarn.lock

The PR won't impact the end users, they probably already updated the dependencies themselves, it's only some maintenance... :)

The following dependencies are updated to their patched version:

  • braces
  • webpack-dev-middleware
  • express
  • follow-redirects

The following dependencies are not updated, as it requires major updates that can break user-land:

  • ws, used by webpack-dev-server (need one major update)
  • @adobe/css-tools, used by stylus (needs three major updates)
  • tough-cookie and request, used by the archived package zombie, there are no new releases, so we must find a replacment
  • vue-template-compiler, we must drop Vue 2 support before

@Kocal Kocal closed this Aug 21, 2024
@Kocal Kocal deleted the chore/upd-vuln-deps branch August 23, 2024 07:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant