Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[DDW-1149] Update part of vulnerable packages #3120

Open
wants to merge 2 commits into
base: develop
Choose a base branch
from

Conversation

przemyslaw-wlodek
Copy link
Contributor

@przemyslaw-wlodek przemyslaw-wlodek commented May 2, 2023

This PR updates some of the packages that contain critical and high-severity vulnerabilities. Here is the list of the packages that did not get updated and can be treated as separate task:

Development deps, should not be impacting build (considered lower priority):

  • dns-packet used by webpack-dev-server
  • ua-parser-js used by storybook
  • decode-uri-component used by @testing-library source maps, etc.
  • glob-parent used by gulp, eslint and storybook

High risk and high/unknown upgrade effort:

  • http-cache-semantics used by electron
  • json5 used by many packages e.g. svg-inline-loader, storybook, eslint-plugin-import (svg-inline-loader is no longer maintained)
  • d3-color used by recharts
  • terser used by @storybook and webpack (we already have the latest version of webpack)

Testing Checklist


Review Checklist

Basics

  • PR assigned to the PR author(s)
  • input-output-hk/daedalus-dev and input-output-hk/daedalus-qa assigned as PR reviewers
  • If there are UI changes, Alexander Rukin assigned as an additional reviewer
  • All visual regression testing has been reviewed (assign run Chromatic label to PR to trigger the run)
  • PR has appropriate labels (release-vNext, feature/bug/chore, WIP)
  • PR link is added to a Jira ticket, ticket moved to In Review
  • PR is updated to the most recent version of the target branch (and there are no conflicts)
  • PR has a good description that summarizes all changes
  • PR contains screenshots (in case of UI changes)
  • CHANGELOG entry has been added to the top of the appropriate section (Features, Fixes, Chores) and is linked to the correct PR on GitHub
  • There are no missing translations (running yarn manage:translations produces no changes)
  • Text changes are proofread and approved (Jane Wild / Amy Reeve)
  • Japanese text changes are proofread and approved (Junko Oda)
  • Storybook works and no stories are broken (yarn storybook)
  • In case of dependency changes yarn.lock file is updated

Code Quality

  • Important parts of the code are properly commented and documented
  • Code is properly typed with typescript types
  • React components are split-up enough to avoid unnecessary re-renderings
  • Any code that only works in main process is neatly separated from components

Testing

  • New feature/change is covered by acceptance tests
  • New feature/change is manually tested and approved by QA team
  • All existing acceptance tests are still up-to-date
  • New feature/change is covered by Daedalus Testing scenario
  • All existing Daedalus Testing scenarios are still up-to-date

After Review

  • Update Slack QA thread by marking it with a green checkmark

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants