(#7) Upgrade choco-theme and scripts #8
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description Of Changes
All of the dependencies that are use by choco-theme have been upgraded
to the latest versions where possible. These mostly include development
build tools used by gulp and also yarn itself.
One big change was the switch from node-sass to dart-sass. This was
done because node-sass is now depreciated and was reporting security
vulnerabilities. With this change, slight modifications were needed in
some of the scss files in order to get the gulp builds working again.
This also requires each gulpfile.js to be updated in each repository to
use sass instead of node-sass.
With these updates, and the pinning of some packages in the resolutions
area in the package.json file, all security vulnerabilities are
resolved.
Motivation and Context
See chocolatey/choco-theme#214
Testing
There are currently many bugs with
yarn npm audit
and alsonpm audit
and both seem to be not reporting accurate information. An issue has been created to investigate this further chocolatey/choco-theme#218.At the time, the best way of knowing that this resolves errors is by going to any of the repos listed below in the related issues list, and if the associated PR is closed, check to see if there are any dependabot errors on that repo. If there are a big yellow box appears on the repo and it is quite obvious.
Other testing:
gulp
from the directory that contains the gulpfile.jsChange Types Made
Related Issue
Fixes #7
Change Checklist