Skip to content

[Snyk] Fix for 32 vulnerabilities #29

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hashim21223445 merged 1 commit into from
Apr 5, 2026
Merged

[Snyk] Fix for 32 vulnerabilities #29

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 8 additions & 8 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@
"css-loader": "7.1.1",
"got": "12.4.1",
"json-loader": "0.5.7",
"lodash": "4.17.21",
"lodash": "4.18.1",
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot Apr 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

There is a version mismatch for lodash between the root package.json (4.18.1) and app/package.json (4.17.23). Since webpack.config.ts (line 106) treats lodash as an external dependency, this inconsistency can lead to unpredictable behavior or bundling errors. It is recommended to synchronize these versions across both files.

"mousetrap": "chabou/mousetrap#useCapture",
"ms": "2.1.3",
"open": "8.4.2",
Expand Down Expand Up @@ -98,20 +98,20 @@
"@types/seamless-immutable": "7.1.19",
"@types/styled-jsx": "2.2.9",
"@types/uuid": "9.0.8",
"@typescript-eslint/eslint-plugin": "7.0.0",
"@typescript-eslint/parser": "6.21.0",
"@typescript-eslint/eslint-plugin": "7.6.0",
"@typescript-eslint/parser": "7.6.0",
"ava": "6.3.0",
"babel-loader": "9.1.3",
"concurrently": "8.2.2",
"copy-webpack-plugin": "12.0.2",
"copy-webpack-plugin": "14.0.0",
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot Apr 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

copy-webpack-plugin version 14.0.0 does not appear to exist in the public npm registry. Furthermore, version 13 and above are ESM-only, which would break this CommonJS-based build setup (no "type": "module" in package.json). This update will likely cause the build to fail with an ERR_REQUIRE_ESM error.

"cpy-cli": "^5.0.0",
"cross-env": "7.0.3",
"electron": "37.3.1",
"electron-builder": "^24.13.3",
"electron": "39.8.5",
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot Apr 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The electron version is being updated to 39.8.5, but electron-mksnapshot (line 112) remains at 29.3.0. The mk-snapshot script (line 21) relies on these being compatible. Major version mismatches or invalid versions typically result in build failures or invalid V8 snapshots. Additionally, the jump to electron-builder 26.6.0 (line 110) should be verified for breaking changes.

"electron-builder": "^26.6.0",
"electron-link": "^0.6.0",
"electron-mksnapshot": "29.3.0",
"electronmon": "^2.0.2",
"eslint": "9.0.0",
"eslint": "9.26.0",
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot Apr 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

Upgrading to ESLint 9.26.0 introduces the Flat Config system. The lint script on line 10 uses the --ext flag, which was removed in ESLint 9. This will cause the yarn run lint command to fail. You will need to update the script to remove --ext and ensure your configuration is migrated to eslint.config.js.

"eslint-config-prettier": "9.1.0",
"eslint-import-resolver-typescript": "^3.6.1",
"eslint-plugin-eslint-comments": "^3.2.0",
Expand All @@ -126,7 +126,7 @@
"node-addon-api": "8.0.0",
"null-loader": "4.0.1",
"parse-url": "8.1.0",
"playwright": "1.55.1",
"playwright": "1.56.0",
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot Apr 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

The version 1.56.0 for playwright does not appear to exist in the public npm registry. This, coupled with the yarn.lock update failure mentioned in the PR description, indicates that the dependency resolution is broken. Merging this PR will result in a broken build as the package manager will be unable to fetch these versions.

"plist": "3.1.0",
"prettier": "3.2.5",
"proxyquire": "2.1.3",
Expand Down
Loading