Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(deps): update all dependencies #15

Merged
merged 1 commit into from
Dec 11, 2023

Conversation

MikeMcC399
Copy link
Contributor

@MikeMcC399 MikeMcC399 commented Oct 31, 2023

This PR updates all dependencies in each of the examples (Angular, React, Svelte & Vue), including updating Cypress to 13.4.0 13.6.1. The lockfileVersion contained in the respective package-lock.json files is migrated from 2 to 3.

It resolves vulnerabilities in the examples:

Framework Resolved Vulnerabilities
Angular 9 vulnerabilities (5 moderate, 2 high, 2 critical)
React 2 vulnerabilities (1 moderate, 1 critical)
Svelte 1 moderate severity vulnerability
Vue 1 moderate severity vulnerability

Edit: A follow-on PR is now necessary to update to Angular 17, since in the meantime this is now supported by Cypress.

@MikeMcC399 MikeMcC399 marked this pull request as ready for review October 31, 2023 11:05
@MikeMcC399
Copy link
Contributor Author

@jordanpowell88

Is there any interest in this PR? By now it is also slightly out-of-date, however I don't want to put effort into updating it unless somebody will pick it up, then review and merge it.

The major reason for the PR is to resolve security vulnerabilities in the examples.

@jordanpowell88
Copy link
Contributor

Hey @MikeMcC399 Sorry to keep you in flux on this. Yes I think we want to keep these up-to-date it just got lost in the shuffle. Can you go ahead and update to the most recent version (Angular 17, etc) and give me a ping?

@MikeMcC399
Copy link
Contributor Author

MikeMcC399 commented Dec 9, 2023

@jordanpowell88

I have updated this PR to latest versions according to the semver definitions in the respective package.json files.

  • Updating to vite@5 requires that Cypress support this version. See Support vite v5 for component testing cypress#28347. So therefore Vite is left using v4.
  • I have prepared a separate PR to update to Angular 17, which I will submit once this one is merged as base

@jordanpowell88
Copy link
Contributor

Thanks @MikeMcC399

@jordanpowell88 jordanpowell88 merged commit fccacbd into cypress-io:main Dec 11, 2023
4 checks passed
@MikeMcC399 MikeMcC399 deleted the updates-deps branch December 11, 2023 16:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants