Skip to content

Remove the concurrently as a dependency and update other outdated dependencies#7659

Open
janechu wants to merge 5 commits into
mainfrom
users/janechu/remove-concurrently-update-deps
Open

Remove the concurrently as a dependency and update other outdated dependencies#7659
janechu wants to merge 5 commits into
mainfrom
users/janechu/remove-concurrently-update-deps

Conversation

@janechu

@janechu janechu commented Jul 23, 2026

Copy link
Copy Markdown
Collaborator

Pull Request

📖 Description

This fixes the current npm vulnerabilities.

✅ Checklist

General

  • I have included a change request file using $ npm run change
  • I have added tests for my changes.
  • I have tested my changes.
  • I have updated the project documentation to reflect my changes.
  • I have read the CONTRIBUTING documentation and followed the standards for this project.

Agents

  • I have linked to an existing issue in this project that this change addresses
  • I have read the skills
  • I have read the DESIGN.md file(s) in packages relevent to my changes
  • I have updated the DESIGN.md file(s) in packages relevent to my changes

@janechu
janechu requested a review from Copilot July 24, 2026 18:41
@janechu janechu changed the title Remove the vulnerable concurrently dependency and dependencies Remove the vulnerable concurrently dependency and update dependencies Jul 24, 2026
@janechu janechu changed the title Remove the vulnerable concurrently dependency and update dependencies Remove the concurrently as a dependency and update other outdated dependencies Jul 24, 2026

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR removes the vulnerable concurrently dev dependency from the monorepo and replaces its limited usage in @microsoft/fast-element with a small in-repo Node script for running multiple npm scripts in parallel, while also updating the lockfile to pick up transitive dependency security fixes.

Changes:

  • Added a run-npm-scripts.js helper to run multiple npm run <script> tasks concurrently and terminate the remaining tasks when one finishes or on shutdown signals.
  • Updated @microsoft/fast-element npm scripts (dev:declarative, test:ui:declarative) to use the new helper instead of concurrently.
  • Removed concurrently from root devDependencies and updated package-lock.json to reflect removals and transitive dependency updates.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated no comments.

Show a summary per file
File Description
packages/fast-element/scripts/run-npm-scripts.js New internal parallel runner to replace concurrently for selected dev workflows.
packages/fast-element/package.json Swaps concurrently usage for the new script; adds a dedicated Playwright UI runner script target.
package.json Removes concurrently from root dev dependencies.
package-lock.json Lockfile refresh removing concurrently and updating related transitive dependencies.
change/@microsoft-fast-element-3909d052-d93c-4481-9ca6-4e8b0d0173b6.json Change file documenting the dependency/security maintenance update.

janechu and others added 4 commits July 24, 2026 12:59
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: e5a2ed54-0427-4c16-9bbf-2895f0747dda
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: e5a2ed54-0427-4c16-9bbf-2895f0747dda
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: e5a2ed54-0427-4c16-9bbf-2895f0747dda
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: e5a2ed54-0427-4c16-9bbf-2895f0747dda
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants