[DEV-18965] handle streambot dependabot alerts #76
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
firebase-tools
from npm dependencies, because it is already installed via asdf. It is used in the Makefile to runfirebase deploy
. I don't see a reason why this should not work without the npm package installed. However we have to test this! Unfortunately we do not have any testing possibility without actually running the deploy. 🤷♀️ Note: The reason for removing it is that this package caused a lot of high-severity security alerts. We could also have upgraded it to at least v9, but if it is really not necessary, I would rather remove it altogether.workbox-webpack-plugin@6.6.1
when trying to upgrade, even though there seems to be no version 6.6.1, so I kept it at version 6.5.4, which is fine according toreact-scripts
dependencies (it requiresworkbox-webpack-plugin "^6.4.1"
).@svgr/webpack
was updated to fix the dependabot alert for nth-check. It is a dependency ofreact-scripts
, which is already on the latest version (5.0.1). See this issue: Question About 6 high severity vulnerabilities facebook/create-react-app#13227