Skip to content
Snippets Groups Projects
  1. Aug 25, 2022
    • Benjamin Franzke's avatar
      [TASK] Update vulnerable build dependencies · 0787c222
      Benjamin Franzke authored
      Update (most) vulnerable dependencies/packages found by
      `npm audit fix --force --dry-run`.
      
      Notes redarding package changes:
      
       * The outdated grunt-postcss plugin is replaced by a (maintained)
         fork for compatibility with newer grunt versions.
      
       * karma is updated to v6 and pulls in @types/node which conflicts with
         TypeScript type definitions by @types/requirejs. Therefore 3rd party
         type declarations from packages (@types/*) are now explicitly
         enabled in tsconfig.json – note that there is no other way to exclude
         from typeRoots:
         https://github.com/microsoft/TypeScript/issues/18588
      
       * grunt-lintspaces and grunt-contrib-imagemin are replaced
         as these packages have been not been updated to not depend
         on vulnerabe dependencies, while grunt-lintspaces and
         grunt-contrib-imagemin would cause downgrades to older
         version when running `npm audit fix --force` (because only
         the older versions do not depend on vulnerable software).
      
       * (grunt-contrib-)imagemin is replaced by squoosh (by google) as
         a) imagemin dependencies ("bin-build" > "download") rely on vulnerable
            versions of "got".
            Neither of these packages is currently updated,see
            https://github.com/kevva/download/issues/224
         b) imagemin is unmaintained:
            https://github.com/imagemin/imagemin/issues/385
            and suggests squoosh as replacement
      
       * stylefmt is replaced by a maintained fork.
      
      There is one remaining packages that pulls in a vulnerability alerts:
      
        * jquery-ui is marked as vulnerable (severity: high), but worked on
          in a separate patch #96497.
          (We don't actually use the vulnerable library parts though).
      
      Vulnerability report before this patch:
      
          74 vulnerabilities (1 low, 30 moderate, 38 high, 5 critical)
      
      Vulnerability report after this patch:
      
          1 high severity vulnerability
          (this is jquery-ui)
      
      Commands executed:
      
        # Supposed to be non breaking, but broke grunt-css
        npm audit fix
        npm remove grunt-postcss
        npm install @lodder/grunt-postcss
      
        # Preparation for `npm audit fix --force` (breaking changes)
        npm install grunt@^1.5
        npm install grunt-lintspaces@^0.10.0
        npm remove grunt-lintspaces
        npm install --save-dev lintspaces-cli
        npm remove grunt-contrib-imagemin
        npm install --save-dev
        npm remove stylefmt
        npm install --save-dev @ronilaukkarinen/stylefmt
        npm audit fix --force
      
      Releases: main
      Resolves: #98198
      Change-Id: I09df87fe131a499790e6c5f95f1c51e9216b71c2
      Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75539
      
      
      Tested-by: default avatarcore-ci <typo3@b13.com>
      Tested-by: default avatarGeorg Ringer <georg.ringer@gmail.com>
      Tested-by: default avatarStefan Bürk <stefan@buerk.tech>
      Tested-by: default avatarBenjamin Franzke <bfr@qbus.de>
      Reviewed-by: default avatarGeorg Ringer <georg.ringer@gmail.com>
      Reviewed-by: default avatarStefan Bürk <stefan@buerk.tech>
      Reviewed-by: default avatarBenjamin Franzke <bfr@qbus.de>
      0787c222
  2. Aug 24, 2022
  3. Aug 23, 2022
    • Benjamin Franzke's avatar
      [TASK] Migrate from yarn to npm · 6575656a
      Benjamin Franzke authored
      Yarn has been added to TYPO3 back in 2017 because
      npm shrinkwrap files were not stable and package-lock.json
      and `npm ci` not yet established.
      
      By now the yarn version in TYPO3 (v1) got outdated
      and an update to yarn v3 would be required sooner
      or later. The update to yarn v3 brings quite some
      problems for the TYPO3 codebase:
      
       - Yarn v3 is executed/proxied through yarn v1
         (installed on the developer machine) – therefore the
         yarn v3 executable needs to be tracked within git.
         See https://yarnpkg.com/cli/set/version#details
      
       - Yarn v3 pulls in @types/node (through the "got" package) for
         unknown reasons, causing clashes with TypeScript declarations
         for requirejs (window.require vs node's require())
      
      As package-lock.json is solid thesedays, there is no real
      need to depend on yarn anymore. We basically switch
      to npm because that switch is way more straightforward than
      migrating to yarn v3 and it removes one dependency.
      
      Note that `npm install` properly honors `...
      6575656a
  4. Aug 22, 2022
  5. Aug 21, 2022
  6. Aug 19, 2022
  7. Aug 17, 2022
  8. Aug 16, 2022
  9. Aug 15, 2022
  10. Aug 13, 2022
  11. Aug 12, 2022