npm: update devdependencies to remove low security alerts #697
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
grenault73
approved these changes
Mar 24, 2020
|
I live it open for now, waiting for the |
|
A PR fixing the bug has been merged (karma-runner/karma#3451) but still no release yet... |
|
Done. But I also updated RxJS to 6.5.5 (which seems to fix a memory leak in As RxJS 6.5.4 broke compatibility with IE11, we'll have to check that one. Worst case scenario, we could just add polyfills in our demo before any code is added. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There were 2 low security alerts for a little more than a week that are linked to our devdependencies.
No urgency here as the risk for the RxPlayer is minimal. The alerts are:
acornwhich we do not use directlyanimist, which is only used indirectly by karma - our integration and memory tests runner - and had thus few risks to impact the RxPlayer in any ways as well as no relation to our buildsThe alert for
animistis still there. That module is a dependency of the now-abandonned optimist module, itself a dependency of karma-js.Karma-js has not yet resolved the problem but were alerted, and a PR is under way.