[#39433] - [4.2] Update 3rd party dependencies
- Fixed in Code Base
- 21 Dec 2022
- Medium
- Build: 4.2-dev
- # 39433
- Diff
- SniperSister:4x-sec-composer-dependency-updates
User tests: Successful: Unsuccessful:
Summary of Changes
Updating various 3rd party dependencies in composer and npm to make dependabot happy.
Testing Instructions
- Check out the 4.2-dev branch
- Run npm ci
- Run composer install
- Try to install and use Jooma
joomla-cms-bot
- | Category | ⇒ | External Library Composer Change NPM Change |
| Status | New | ⇒ | Pending |
This pr is not complete. You need to run the build scripts locally and you will see that they generate additional changed files that you need to add to this PR as well.
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/39433.
In addition I can see at least one major library (codemirror) that has not been updated and is now at least 5 versions out of date despite our package.json allowing for it to be updated.
| Category | External Library Composer Change NPM Change | ⇒ | External Library Composer Change NPM Change Front End Plugins Templates (site) |
| Labels |
Added:
Composer Dependency Changed
NPM Resource Changed
?
|
||
This pr is not complete. You need to run the build scripts locally and you will see that they generate additional changed files that you need to add to this PR as well.
Good catch, fixed!
In addition I can see at least one major library (codemirror) that has not been updated and is now at least 5 versions out of date despite our package.json allowing for it to be updated.
The PR is not a generic "update all the things" PR, but specifically limited to dependencies that have received upstream security changes.
The PR is not a generic "update all the things" PR, but specifically limited to dependencies that have received upstream security changes.
You are assuming that they all publish if an update is security related
In maintainers we discussed this topic and came to the conclusion that general updates of dependencies should only be made in minor versions to ensure stability for the current release stream. Except when there are security issues, then this needs to be made in patch releases. This is not something Mr Jardin does now for fun, he follows the process.
It is still makling an assumption that is risky - but clearly I am in a minority. Would be good to see this policy documented as there is none for patch releases
Agree that this needs to be better documented. For now this is mentioned in the meeting report here https://volunteers.joomla.org/teams/cms-maintenance-team/reports/1744-meeting-notes-june-08-2022.
I have tested this item
does what it says
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/39433.
I have tested this item
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/39433.
| Status | Pending | ⇒ | Ready to Commit |
RTC
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/39433.
wilsonge
- | Status | Ready to Commit | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2022-12-21 22:29:48 |
| Closed_By | ⇒ | wilsonge | |
| Labels |
Added:
?
|
||
I have tested this item? unsuccessfully on 56f6754
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/39433.