Skip to content

LG-3756: Bump Node devDependencies to latest#4521

Merged
aduth merged 1 commit intomasterfrom
aduth-node-dependencies
Dec 21, 2020
Merged

LG-3756: Bump Node devDependencies to latest#4521
aduth merged 1 commit intomasterfrom
aduth-node-dependencies

Conversation

@aduth
Copy link
Contributor

@aduth aduth commented Dec 21, 2020

Why: As a user, I want login.gov to not have unused or out of date apps, so that I can use the fastest and most secure app possible.

This only updates devDependencies, under the assumption that they are generally less risky. They are not immune to risk, given that some devDependencies are responsible for generating runtime code (e.g. Babel, Webpack, etc).

Using ncu:

$ ncu --dep dev   
Checking /Users/andrewmduthie/Documents/Code/identity-idp/package.json
[====================] 32/32 100%

All dependencies match the latest package versions :)

Notable major version bumps:

 @types/react                  ^16.9.56  →   ^17.0.0   
 chai                            ^3.5.0  →    ^4.2.0   
 dirty-chai                      ^1.2.2  →    ^2.0.1 

**Why:** As a user, I want login.gov to not have unused or out of date apps, so that I can use the fastest and most secure app possible.
Copy link
Contributor

@mitchellhenke mitchellhenke left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍🏼

excludeCredentials: [
{
// encodes to 'credential123'
id: Buffer.from([114, 183, 157, 122, 123, 98, 106, 93, 118]).buffer,
Copy link
Contributor Author

@aduth aduth Dec 21, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pretty sure this was always broken, since the buffer here is not actually "credential123", it's "credential12":

window.btoa(String.fromCharCode(...new Uint8Array([114, 183, 157, 122, 123, 98, 106, 93, 118])))
// "credential12"

This is clearer anyways.

This became a failure in upgrading chai, likely related to release notes concerning deep equality revisions.

Copy link
Contributor

@zachmargolis zachmargolis left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@aduth aduth merged commit ffc77ff into master Dec 21, 2020
@aduth aduth deleted the aduth-node-dependencies branch December 21, 2020 19:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants