Uh oh!
There was an error while loading. Please reload this page.
update semver package and fix security issues in transitive deps - #151
update semver package and fix security issues in transitive deps#151mmcgahan wants to merge 1 commit into
semver package and fix security issues in transitive deps#151Conversation
eli-darkly
commented
Oct 18, 2019
Sorry we didn't get to this one earlier. There have been some other package changes since then, so I'll need to resolve conflicts and verify that everything works. |
eli-darkly
commented
Oct 23, 2019
About |
eli-darkly
commented
Oct 23, 2019
Actually, as far as we can tell, |
eli-darkly
commented
Oct 23, 2019
We made equivalent fixes in the 5.9.2 release, and improved our dependency checking process. |
I encountered a random
yarn checkerror in a project I'm working on, and drilled it down to thesemverdependency in this package that was locked to v5.5.0 (most other transitive semver dependencies were^5.5.1).This isn't really a problem with the package itself, but i figured I could help with dependency maintenance and upgrade it to the latest
semverv6.0.0, which is officially a breaking change, but only for an API that is not being used here (semver CHANGELOG), so all tests pass.npm auditalso found a few important security vulnerabilities in transitive dependencies, so I rannpm audit fixto updatepackage-lock.jsonwith those updates. Again, all tests pass and this is just a background maintenance update.