mirror of
https://github.com/lightninglabs/lightning-terminal.git
synced 2026-08-13 12:33:36 +02:00
b6646d7868
Bumps the two production dependencies flagged by `yarn audit` that have fixes available. http-proxy-middleware goes to 2.0.10 for the Host-header routing bypass. It also needs a `resolutions` entry, otherwise yarn keeps a second copy at 2.0.9 under react-scripts > webpack-dev-server because the existing `^2.0.0` range is already satisfied. react-router-dom goes to 6.30.4 for the untrusted-path open redirect. It is pinned exactly rather than with a caret: @remix-run/router is a direct dependency at an exact version and react-router-dom pins its own copy exactly too, so a caret here would let a future patch release install a second copy of the router and hand <HistoryRouter> a history built by a different module instance. That bump pulls in a few related changes: - react-router 6.4 folded the `history` package into @remix-run/router, so the store now imports `createBrowserHistory` from there. Passing our own history object is discouraged and would bundle history twice. - @remix-run/router's type declarations use accessors in interfaces, which needs TypeScript 4.3 or newer, so typescript goes to 4.9.5. TS 4.4 also began typing `catch` variables as `unknown`, so `handleError` now takes `unknown` and narrows before reading `.message`, and the five sites that read it directly narrow first as well. - @types/history and @types/react-router-dom are v5-era leftovers that now conflict with the types react-router-dom ships itself. - The new history only accepts one active listener, but RouterStore and <HistoryRouter> both need one, so RouterStore subscribes once and fans updates out. It also needs `v5Compat` so listeners fire on push() and replace() rather than only on back/forward. reactour still pulls in a vulnerable lodash.pick with no patched version published. reactour 1.18.0 is the end of the v1 line and v2 is a rewrite, so that one is left alone for now. |
||
|---|---|---|
| .. | ||
| .storybook | ||
| build | ||
| public | ||
| scripts | ||
| src | ||
| .eslintignore | ||
| .eslintrc | ||
| .gitignore | ||
| Dockerfile | ||
| gen_app_docker.sh | ||
| package.json | ||
| tsconfig.json | ||
| yarn.lock | ||