Remove the concurrently as a dependency and update other outdated dependencies#7659
Open
janechu wants to merge 5 commits into
Open
Remove the concurrently as a dependency and update other outdated dependencies#7659janechu wants to merge 5 commits into
janechu wants to merge 5 commits into
Conversation
…ooling dependencies with security fixes
There was a problem hiding this comment.
Pull request overview
This PR removes the vulnerable concurrently dev dependency from the monorepo and replaces its limited usage in @microsoft/fast-element with a small in-repo Node script for running multiple npm scripts in parallel, while also updating the lockfile to pick up transitive dependency security fixes.
Changes:
- Added a
run-npm-scripts.jshelper to run multiplenpm run <script>tasks concurrently and terminate the remaining tasks when one finishes or on shutdown signals. - Updated
@microsoft/fast-elementnpm scripts (dev:declarative,test:ui:declarative) to use the new helper instead ofconcurrently. - Removed
concurrentlyfrom rootdevDependenciesand updatedpackage-lock.jsonto reflect removals and transitive dependency updates.
Reviewed changes
Copilot reviewed 4 out of 5 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| packages/fast-element/scripts/run-npm-scripts.js | New internal parallel runner to replace concurrently for selected dev workflows. |
| packages/fast-element/package.json | Swaps concurrently usage for the new script; adds a dedicated Playwright UI runner script target. |
| package.json | Removes concurrently from root dev dependencies. |
| package-lock.json | Lockfile refresh removing concurrently and updating related transitive dependencies. |
| change/@microsoft-fast-element-3909d052-d93c-4481-9ca6-4e8b0d0173b6.json | Change file documenting the dependency/security maintenance update. |
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: e5a2ed54-0427-4c16-9bbf-2895f0747dda
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: e5a2ed54-0427-4c16-9bbf-2895f0747dda
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: e5a2ed54-0427-4c16-9bbf-2895f0747dda
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: e5a2ed54-0427-4c16-9bbf-2895f0747dda
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull Request
📖 Description
This fixes the current npm vulnerabilities.
✅ Checklist
General
$ npm run changeAgents