mirror of
https://github.com/lightninglabs/lightning-terminal.git
synced 2026-08-13 12:33:36 +02:00
5ed07dbf71
Sweeps the build-time dependency tree, which is where most of what `yarn audit` reports actually lives. This takes the frontend from 419 findings across 42 packages down to 16 across 9. Most of it is lockfile-only. `yarn upgrade` does not re-resolve transitive entries in yarn 1, so the affected entries were dropped from yarn.lock and reinstalled, which picks the newest version each parent's existing range already allows. That covers the four open dependabot PRs (shell-quote, websocket-driver, @babel/core and @babel/plugin-transform-modules-systemjs) along with @babel/helpers, ajv, async, brace-expansion, form-data, glob, js-yaml, json5, nanoid, terser and ws. Re-resolving express to 4.22.2 pulls patched body-parser, cookie, path-to-regexp and qs with it, and clears the stale minimatch 3.0.4 and semver 7.0.0 pins at the same time. browserslist and caniuse-lite had to move too. @babel/core 7.29 emits 'opera_mobile' as a compilation target and the pinned @babel/helper-compilation-targets 7.17.7 rejects it, which broke the production build until the whole toolchain was aligned. storybook goes to 7.6.24 and webpack to 5.109.2, both direct devDependencies pinned to vulnerable versions. The `resolutions` additions are for packages whose parent pins a range with no patched version in it. Each was verified against a build: - svgo 2.8.3 removes the svgo 1.x subtree that @svgr/plugin-svgo drags in. react-scripts sets `svgo: false`, so that plugin never runs, and the production bundle is byte for byte identical with and without it. - resolve-url-loader 5.0.0 is the only way to drop postcss 7. The emitted CSS is unchanged, same content hash. - @tootallnate/once, esbuild, nth-check, serialize-javascript, tar and uuid are straightforward version forces. What is left is either unfixable or would break the build: - protoc-gen-js pulls got, http-cache-semantics, adm-zip and decompress through the unmaintained `download` package. decompress has no published fix. None of it runs outside `yarn protos`. - webpack-dev-server 5 drops the onBeforeSetupMiddleware and onAfterSetupMiddleware hooks that react-scripts 5.0.1 calls directly, so forcing it would break `yarn start`. - ip and lodash.pick have no patched version published. - react-router needs v7, which is a separate migration. |
||
|---|---|---|
| .. | ||
| .storybook | ||
| build | ||
| public | ||
| scripts | ||
| src | ||
| .eslintignore | ||
| .eslintrc | ||
| .gitignore | ||
| Dockerfile | ||
| gen_app_docker.sh | ||
| package.json | ||
| tsconfig.json | ||
| yarn.lock | ||