App
App copied to clipboard
Expensify
[$250] Update @svgr/webpack to version 6.0.0
If you haven’t already, check out our contributing guidelines for onboarding and email [email protected] to request to join our Slack channel!
Problem
The package [email protected] has a security vulnerability introduced through @svgr/[email protected], fixed in [email protected]
$ npm list nth-check [12:38:18]
[email protected] /Users/flo/Expensidev/App
├─┬ @storybook/[email protected]
│ └─┬ @storybook/[email protected]
│ └─┬ @storybook/[email protected]
│ ├─┬ @storybook/[email protected]
│ │ └─┬ [email protected]
│ │ └─┬ [email protected]
│ │ └─┬ [email protected]
│ │ └─┬ [email protected]
│ │ └── [email protected] deduped
│ └─┬ @storybook/[email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └── [email protected] deduped
├─┬ @svgr/[email protected]
│ └─┬ @svgr/[email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └── [email protected]
├─┬ [email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └── [email protected] deduped
└─┬ [email protected]
└─┬ [email protected]
└── [email protected]
Solution
Upgrade to @svgr/[email protected]
Expensify/Expensify Issue URL: https://github.com/Expensify/Expensify/issues/218325 Upwork URL: https://www.upwork.com/jobs/~01615065cda2c02b5a
Triggered auto assignment to @flaviadefaria (External), see https://stackoverflow.com/c/expensify/questions/8582 for more details.
![melvin-bot[bot] avatar](https://avatars.githubusercontent.com/in/179547?v=4 "Published by a pub.dev verified publisher"){kind=small}
Triggered auto assignment to Contributor-plus team member for initial proposal review - @Santhosh-Sellavel (External)
Triggered auto assignment to @Gonals (External), see https://stackoverflow.com/c/expensify/questions/7972 for more details.
Proposal
Solution:
Upgrade version at package.json.
- "@svgr/webpack": "^5.5.0",
+ "@svgr/webpack" "^6.0.0",
Proposal
update from "@svgr/webpack": "^5.5.0" to "@svgr/webpack": "^6.0.0" in package.json
https://github.com/Expensify/App/blob/8aec877a678d09600e110e0fc7bc597e342ef342/package.json#L138
- Config format of SVGO changes & SVGR does not merge SVGO config
- Template has a new format
- core: @svgr/core now exposes { transform } instead of default export
- using --icon as latest arg now requires "--"
When I raised the Same issue long back , it was not considered I even shared the issue in slack, I included other package also ( react-native-svg-transformer) it also uses svgo which is dependent on older version of nth check
Heading is different , but its same When I posted about @svgr/webpack issue I was said that's not useful p/s Check comments here https://expensify.slack.com/archives/C01GTK53T8Q/p1660141537100609?thread_ts=1660141537.100609&cid=C01GTK53T8Q
As far as I can tell, that problem statement and the one proposed here are not the same. Am I wrong?
@trjExpensify, @Gonals, @Santhosh-Sellavel Uh oh! This issue is overdue by 2 days. Don't forget to update your issues!
@saivineeth100 according to package-lock.json and npm list nth-check`, this is not accurate:
$ npm list nth-check
[email protected] /Users/flo/Expensidev/App
├─┬ @storybook/[email protected]
│ └─┬ @storybook/[email protected]
│ └─┬ @storybook/[email protected]
│ ├─┬ @storybook/[email protected]
│ │ └─┬ [email protected]
│ │ └─┬ [email protected]
│ │ └─┬ [email protected]
│ │ └─┬ [email protected]
│ │ └── [email protected] deduped
│ └─┬ @storybook/[email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └── [email protected] deduped
├─┬ @svgr/[email protected]
│ └─┬ @svgr/[email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └── [email protected]
├─┬ [email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └── [email protected] deduped
└─┬ [email protected]
└─┬ [email protected]
└── [email protected]
I would appreciate it if we could please keep this issue's scope to the problem/solution description in the issue.
@Santhosh-Sellavel can you please review the proposals from @hungvu193 and @gadhiyamanan
@hungvu193 @gadhiyamanan
Do we have any other migration changes expected as there are some breaking changes?
Can you elaborate, on changes, if there are some migration changes, and how it does handle?
if no changes are required, how/why the breaking changes don't affect our app?
Thanks!
@Santhosh-Sellavel Since we are using @svgr/webpack as a loader for web and all these breaking changes for the command line tool, template, @svgr/core which we didn't use in our application, we only need to update the version in package.json.
@flodnv @Gonals
@hungvu193 proposal looks good to me.
C+ Reviewed. 👀 🎀 👀
Seems we need to update another library also, react-native-svg-transformer library's dependency libraries css select uses [email protected]
[email protected] /Users/santhoshkumar/Documents/App
├─┬ @storybook/[email protected]
│ └─┬ @storybook/[email protected]
│ └─┬ @storybook/[email protected]
│ ├─┬ @storybook/[email protected]
│ │ └─┬ [email protected]
│ │ └─┬ [email protected]
│ │ └─┬ [email protected]
│ │ └─┬ [email protected]
│ │ └── [email protected] deduped
│ └─┬ @storybook/[email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └── [email protected] deduped
├─┬ @svgr/[email protected]
│ └─┬ @svgr/[email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └── [email protected] deduped
├─┬ [email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └── [email protected] deduped
├─┬ [email protected]
│ └─┬ @svgr/[email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └── [email protected]
└─┬ [email protected]
└─┬ [email protected]
└── [email protected]
@trjExpensify, @Gonals, @Santhosh-Sellavel Uh oh! This issue is overdue by 2 days. Don't forget to update your issues!
@trjExpensify, @Gonals, @Santhosh-Sellavel Whoops! This issue is 2 days overdue. Let's get this updated quick!
@Gonals What should we do about another library?
Seems we need to update another library also,
react-native-svg-transformerlibrary's dependency librariescss selectuses[email protected][email protected] /Users/santhoshkumar/Documents/App ├─┬ @storybook/[email protected] │ └─┬ @storybook/[email protected] │ └─┬ @storybook/[email protected] │ ├─┬ @storybook/[email protected] │ │ └─┬ [email protected] │ │ └─┬ [email protected] │ │ └─┬ [email protected] │ │ └─┬ [email protected] │ │ └── [email protected] deduped │ └─┬ @storybook/[email protected] │ └─┬ [email protected] │ └─┬ [email protected] │ └─┬ [email protected] │ └─┬ [email protected] │ └── [email protected] deduped ├─┬ @svgr/[email protected] │ └─┬ @svgr/[email protected] │ └─┬ [email protected] │ └─┬ [email protected] │ └── [email protected] deduped ├─┬ [email protected] │ └─┬ [email protected] │ └─┬ [email protected] │ └─┬ [email protected] │ └── [email protected] deduped ├─┬ [email protected] │ └─┬ @svgr/[email protected] │ └─┬ [email protected] │ └─┬ [email protected] │ └── [email protected] └─┬ [email protected] └─┬ [email protected] └── [email protected]
@Gonals What should we do about another library?
Seems we need to update another library also,
react-native-svg-transformerlibrary's dependency librariescss selectuses[email protected][email protected] /Users/santhoshkumar/Documents/App ├─┬ @storybook/[email protected] │ └─┬ @storybook/[email protected] │ └─┬ @storybook/[email protected] │ ├─┬ @storybook/[email protected] │ │ └─┬ [email protected] │ │ └─┬ [email protected] │ │ └─┬ [email protected] │ │ └─┬ [email protected] │ │ └── [email protected] deduped │ └─┬ @storybook/[email protected] │ └─┬ [email protected] │ └─┬ [email protected] │ └─┬ [email protected] │ └─┬ [email protected] │ └── [email protected] deduped ├─┬ @svgr/[email protected] │ └─┬ @svgr/[email protected] │ └─┬ [email protected] │ └─┬ [email protected] │ └── [email protected] deduped ├─┬ [email protected] │ └─┬ [email protected] │ └─┬ [email protected] │ └─┬ [email protected] │ └── [email protected] deduped ├─┬ [email protected] │ └─┬ @svgr/[email protected] │ └─┬ [email protected] │ └─┬ [email protected] │ └── [email protected] └─┬ [email protected] └─┬ [email protected] └── [email protected]
I think we can update it as part of this. What do you think?
@Santhosh-Sellavel - are we good with that? ^^
Cool, should I apply to upwork?
@hungvu193 - yes please. Looks like you haven't applied yet here.
@trjExpensify I have applied (https://www.upwork.com/ab/proposals/1587067667179589633)