lock
lock copied to clipboard
chore: Upgrade fsevents to latest
Summary
Upgrade fsevents from the deprecated 1.2.13 to ^2.3.3 in order to eliminate the deprecation and install‐scripts risks flagged by Socket.dev in our dependency tree.
Changes
-
package.json
- Bumped
optionalDependencies.fseventsto^2.3.3
- Bumped
-
package-lock.json
- Regenerated lockfile so that all references to
[email protected]are removed and[email protected]is frozen
- Regenerated lockfile so that all references to
- Ran a clean install (
rm -rf node_modules package-lock.json && npm install) to verify no v1 artifacts remain
References
- SEC ticket: SEC-2161 (Jira link)
- Socket.dev alerts:
-
PSIRT process (Known Malware):
https://oktawiki.atlassian.net/wiki/spaces/REX/pages/3093897297/3rd-Party+Libraries+-+Risk+Reporting+Remediation+Standard#3.1-Known-Malware
Testing
-
Fresh install & audit
rm -rf node_modules package-lock.json npm install npm audit