Skip to content

BREAKING: Bump to webpack 5; use Node.js >= 18 - #264

Merged
legobeat merged 14 commits into
MetaMask:mainfrom
legobeat:dependencies-update-webpack-5
Nov 6, 2023
Merged

BREAKING: Bump to webpack 5; use Node.js >= 18#264
legobeat merged 14 commits into
MetaMask:mainfrom
legobeat:dependencies-update-webpack-5

Conversation

@legobeat

@legobeatlegobeat commented Oct 24, 2023•
edited by rekmarks
Loading

Copy link
Copy Markdown
Contributor
  • Based on Dependencies update #223 rebased on main
  • Update webpack from 4 to 5
  • Add support for Node.js 18,20
  • Remove support for Node.js 16, which is EOL

webpack start seems to run fine locally for me but reviewers are encouraged to test manually.

@legobeat
legobeat requested a review from seaonaOctober 24, 2023 01:23
@legobeat
legobeatforce-pushed the dependencies-update-webpack-5 branch 2 times, most recently from c316c6d to 2e774caCompareOctober 24, 2023 01:24
@legobeatlegobeat added the dependencies Pull requests that update a dependency file label Oct 24, 2023
@legobeat
legobeat marked this pull request as ready for review October 24, 2023 01:25
@socket-security

socket-securityBot commented Oct 24, 2023•
edited
Loading

Copy link
Copy Markdown

Updated and removed dependencies detected. Learn more about Socket for GitHub ↗︎

PackagesVersionNew capabilitiesTransitivesSizePublisher
webpack-cli3.3.12...5.1.4None+39/-2686.26 MBevilebottnawi
clean-webpack-plugin3.0.0...4.0.0None+16/-2385.33 MBjohnagan
webpack-dev-server3.11.2...4.15.1network+73/-3119.55 MBevilebottnawi
copy-webpack-plugin6.0.2...11.0.0None+27/-2565.97 MBevilebottnawi

🚮 Removed packages:@lavamoat/allow-scripts@1.0.6, webpack@4.43.0

@socket-security

socket-securityBot commented Oct 24, 2023•
edited
Loading

Copy link
Copy Markdown

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring: launch-editor@2.6.1, hasown@2.0.0, nopt@6.0.0, @lavamoat/aa@3.1.5, memfs@3.6.0, update-browserslist-db@1.0.13, webpack-dev-server@4.15.1, bonjour-service@1.1.1

Next steps

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all

    @legobeatlegobeat mentioned this pull request Oct 24, 2023
    Open
    @legobeat
    legobeat requested a review from a teamOctober 24, 2023 09:26
    @legobeat
    legobeatforce-pushed the dependencies-update-webpack-5 branch from 06bb22a to d72f0a6CompareOctober 24, 2023 09:45
    @legobeat

    This comment was marked as resolved.

    Sign in to view
    @legobeat

    This comment was marked as resolved.

    Sign in to view
    @legobeat

    This comment was marked as resolved.

    Sign in to view
    @legobeat

    This comment was marked as resolved.

    Sign in to view
    @legobeat

    This comment was marked as resolved.

    Sign in to view
    @legobeat
    legobeatforce-pushed the dependencies-update-webpack-5 branch from d72f0a6 to a0abf65CompareNovember 1, 2023 04:00
    @rekmarksrekmarks mentioned this pull request Nov 3, 2023
    Closed
    rekmarks
    rekmarks approved these changes Nov 3, 2023
    View reviewed changes

    @rekmarksrekmarks left a comment

    Copy link
    Copy Markdown
    Member

    Choose a reason for hiding this comment

    The reason will be displayed to describe this comment to others. Learn more.

    LGTM!

    @legobeatlegobeat changed the title Bump to webpack 5; support Node.js >= 18BREAKING: Bump to webpack 5; support Node.js >= 18Nov 6, 2023
    @legobeat
    legobeat merged commit d600404 into MetaMask:mainNov 6, 2023
    @rekmarksrekmarks changed the title BREAKING: Bump to webpack 5; support Node.js >= 18BREAKING: Bump to webpack 5; use Node.js >= 18Nov 14, 2023
    Gudahtt added a commit that referenced this pull request Nov 21, 2023
    @Gudahtt
    Fix signing
    c2b7f3d
    The signing examples were broken as of the update to Webpack v5 (#264).
The "verification" button for the signatures relies upon the Node.js
`assert` and `stream` APIs. Polyfills have been added for both of
these.
Additionally, the `assert` polyfill itself relies upon the Node.js
`process` API, and expects `process` to be a global. A polyfill has
been added for `process`, and it has been set as a global.
    @GudahttGudahtt mentioned this pull request Nov 21, 2023
    Merged
    Gudahtt added a commit that referenced this pull request Nov 21, 2023
    @Gudahtt
    Fix signing (#276)
    d618601
    The signing examples were broken as of the update to Webpack v5 (#264).
The "verification" button for the signatures relies upon the Node.js
`assert` and `stream` APIs. Polyfills have been added for both of
these.
Additionally, the `assert` polyfill itself relies upon the Node.js
`process` API, and expects `process` to be a global. A polyfill has
been added for `process`, and it has been set as a global.
    @legobeatlegobeat mentioned this pull request Nov 22, 2023
    Merged
    Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

    Reviewers

    @rekmarksrekmarksrekmarks approved these changes
    @seaonaseaonaAwaiting requested review from seaona
    @ritaveritaveAwaiting requested review from ritave
    @GudahttGudahttAwaiting requested review from Gudahtt
    @tmashuangtmashuangAwaiting requested review from tmashuang
    @darkwingdarkwingAwaiting requested review from darkwing
    @jiexijiexiAwaiting requested review from jiexi

    Assignees

    No one assigned

    Labels

    dependenciesPull requests that update a dependency file

    Projects

    None yet

    Milestone

    No milestone

    Development

    Successfully merging this pull request may close these issues.

    3 participants

    @legobeat@rekmarks@seaona