Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[E.cash] - Updated Lodash Dependency to Fix Vulnerability #1947

Merged
merged 6 commits into from
Mar 24, 2021

Conversation

Luke9389
Copy link
Contributor

@Luke9389 Luke9389 commented Mar 19, 2021

This PR is on [HOLD] pending the deployment of this PR.

cc @tgolen

Details

Rather than using individual packages for each lodash method, we are using the main lodash package and selectively loading the methods we need (using this handy syntax: lodash/orderby)

Fixed Issues

Fixes https://github.com/Expensify/Expensify/issues/157894

Tests

Our testing method for this is admittedly a bit primitive; comb the site looking for errors/broken stuff.

Tested On

  • Web
  • Mobile Web
  • Desktop
  • iOS
  • Android

@Luke9389 Luke9389 self-assigned this Mar 19, 2021
@Luke9389 Luke9389 requested a review from a team as a code owner March 19, 2021 20:57
@botify botify requested review from Gonals and removed request for a team March 19, 2021 20:57
@Luke9389
Copy link
Contributor Author

Testing on all platforms now. So far web & mobile web are clear

@Luke9389
Copy link
Contributor Author

All 5 platforms seem stable. I tried to hit all the pages that were using lodash.

@Luke9389 Luke9389 changed the title Updated Lodash Dependency to Fix Vulnerability [E.cash] - Updated Lodash Dependency to Fix Vulnerability Mar 19, 2021
@tgolen
Copy link
Contributor

tgolen commented Mar 19, 2021

Let's maybe hold this so that you can include the onyx upgrade in it too?

@Luke9389
Copy link
Contributor Author

That's a great point. I'll wait for the onyx one to get deployed and then retest this. 👍

@Luke9389 Luke9389 changed the title [E.cash] - Updated Lodash Dependency to Fix Vulnerability [HOLD] [E.cash] - Updated Lodash Dependency to Fix Vulnerability Mar 19, 2021
@roryabraham roryabraham changed the title [HOLD] [E.cash] - Updated Lodash Dependency to Fix Vulnerability [E.cash] - Updated Lodash Dependency to Fix Vulnerability Mar 23, 2021
@roryabraham
Copy link
Contributor

Looks like this change made in Onyx:

image

Is already available in Expensify.cash. I'm going hold this other PR on this one.

@Luke9389
Copy link
Contributor Author

Yea, I updated Onyx on monday before I was OOO today. Retesting this now

@Luke9389
Copy link
Contributor Author

Retested on all 5 and it's lookin good. We need to be clever about when this gets merged. It'd be bad if another PR using the wrong lodash package got merged right before this one. For this reason, I think it's best to reassign the reviewer role to someone in my time-zone, so we can be sure to merge this at the right moment. @tgolen or @roryabraham Would either of you be willing to swap in for @Gonals and become the reviewer of this PR?

@tgolen
Copy link
Contributor

tgolen commented Mar 24, 2021

Yeah, I don't mind reviewing and merging this. It looks fine!

@tgolen tgolen merged commit 65f5cac into master Mar 24, 2021
@tgolen tgolen deleted the luke-update-lodash-dependency branch March 24, 2021 17:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants