Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump react-redux@7.2.8 and run npm audit fix #4230

Merged
merged 4 commits into from
Apr 8, 2022

Conversation

compulim
Copy link
Contributor

@compulim compulim commented Apr 5, 2022

Changelog Entry

Changed

Description

Recently release of react@18 broke react-redux@7.2.6 due to the way NPM handle peer dependencies, documented at reduxjs/react-redux#1881. We need to bump to react-redux@>=7.2.7.

Also, we run npm audit fix manually for a couple of dependabot asks. This is because dependabot cannot handle lerna properly and dropped some of our local deps in the PR. This is for minimalist and node-forge.

Design

The new peer deps feature in npm is designed to only look at immediately peer deps.

Web Chat requires peer deps of react@>=16.8.6. When npm evaluates, it considers react@18 as the base version.

Then, npm tries to install react-redux@7.2.6. As react-redux requires react@16.8 || 17 and react@18 is not a peer deps, npm consider Web Chat failed the deps.

As npm only look at immediate package.json for peer deps and do not negotiate, it could not figure out other possible candidates, such as, react@16.8.6. Thus, react-redux needs to do an emergency patch @7.2.7 to mitigate the "side effect of release of react@18".

Specific Changes

  • Bump to react-redux@7.2.8
  • Run npm audit fix on all packages, including samples
  • I have added tests and executed them locally
  • I have updated CHANGELOG.md
  • I have updated documentation

Review Checklist

This section is for contributors to review your work.

  • Accessibility reviewed (tab order, content readability, alt text, color contrast)
  • Browser and platform compatibilities reviewed
  • CSS styles reviewed (minimal rules, no z-index)
  • Documents reviewed (docs, samples, live demo)
  • Internationalization reviewed (strings, unit formatting)
  • package.json and package-lock.json reviewed
  • Security reviewed (no data URIs, check for nonce leak)
  • Tests reviewed (coverage, legitimacy)

@compulim compulim marked this pull request as ready for review April 5, 2022 19:45
@compulim compulim added p0 Must Fix. Release-blocker p1 Painful if we don't fix, won't block releasing and removed p0 Must Fix. Release-blocker labels Apr 5, 2022
@compulim compulim merged commit 27c45b0 into microsoft:main Apr 8, 2022
@compulim compulim deleted the fix-minimist branch April 8, 2022 00:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
p1 Painful if we don't fix, won't block releasing
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants