Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update the lodash JS library #1460

Open
5 tasks
ccostino opened this issue Apr 19, 2024 · 1 comment
Open
5 tasks

Update the lodash JS library #1460

ccostino opened this issue Apr 19, 2024 · 1 comment
Assignees
Labels
dependencies Pull requests that update a dependency file engineering security

Comments

@ccostino
Copy link
Contributor

We need to update the lodash JS library (see Dependabot for details).

This might result in opening a much larger can of worms with our JS dependencies, so hopefully we can keep it to just this for now but use it as a basis for updating other libraries in the new future.

Implementation Sketch and Acceptance Criteria

  • Investigate what it would take to get lodash updated on our side, and just lodash and whatever it requires.
  • Make the necessary changes
  • Make sure the site still builds properly (especially static assets)
  • Make sure the site still functions correctly
  • Make sure all tests pass

Security Considerations

  • We need to make sure we're keeping our libraries up-to-date to address security advisories.
@ccostino ccostino added engineering security dependencies Pull requests that update a dependency file labels Apr 19, 2024
@terrazoon terrazoon self-assigned this Apr 26, 2024
@terrazoon
Copy link
Contributor

I think this is a false alarm from dependabot:

The latest version of lodash is 4.17.21 ... we are on it
The latest version of lodash.template is 4.5.0 ... we are on it

I think dependabot is confusing lodash.template with lodash and thinking it should be 4.17.21, but that's not possible.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file engineering security
Projects
Status: 👀 In review
Development

No branches or pull requests

2 participants