Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

build: switch npm to yarn and resolve vulnerabilities #1827

Open
wants to merge 14 commits into
base: production
Choose a base branch
from

Conversation

eitjuh
Copy link
Contributor

@eitjuh eitjuh commented May 16, 2022

Hi folks 👋

We have discussed before whether to switch from NPM to Yarn, and we ended up not switching, because NPM was generally easier to debug.

Hereby I still make the suggestion to switch, because:

  • faster
  • adds the possibility to add resolutions to package.json, to resolve vulnerabilities in external dependencies

The following actually resolves the axios dependency.
We could directly ask ignite frontend team to update starport/vuex to update dependency @confio/relayer . That would fix it in a better way, but this is a temporary fix:

  "resolutions": {
    "**/@starport/vuex/@confio/relayer/axios": "0.21.2"
  },

@eitjuh eitjuh marked this pull request as draft May 16, 2022 17:38
@github-actions
Copy link

github-actions bot commented May 16, 2022

Visit the preview URL for this PR (updated for commit ee6979b):

https://emeris-app--pr1827-build-move-npm-to-ya-r5ludcud.web.app

(expires Mon, 13 Jun 2022 10:37:26 GMT)

🔥 via Firebase Hosting GitHub Action 🌎

@Dawntraoz
Copy link
Contributor

Nice idea! Code wise LGTM 💃🏼 Let's see what others say 💜

@pranaybaldev
Copy link
Contributor

Not in support of the switch but don't feel too strongly about it (It'll be fine if we do). Can't we just use overrides?

'overrides' is only available in version 8.x.

@eitjuh eitjuh marked this pull request as ready for review June 6, 2022 10:39
@faboweb
Copy link
Contributor

faboweb commented Jun 7, 2022

overrides in my experience don't work that well @pranaybaldev. Do you have good experiences with them?

@fl-y
Copy link
Contributor

fl-y commented Jun 8, 2022

I also don't feel strongly about switching, however I remember @clockworkgr expressing that using npm made debugging easier. I'll be more comfortable with the PR with Alex's blessing

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants