Logan/eng 469 fix tinacms dependency vulnerabilities by logan-anderson · Pull Request #3088 · tinacms/tinacms

logan-anderson · 2022-08-10T15:03:32Z

Updates deps to remove vulnerabilities.

One known issue.

When updating next I get this warning

warn  - ../../node_modules/.pnpm/node-fetch@2.6.7/node_modules/node-fetch/lib/index.js
Module not found: Can't resolve 'encoding' in '/Users/logananderson-forestry-mac/dev/tinacms/tinacms/node_modules/.pnpm/node-fetch@2.6.7/node_modules/node-fetch/lib'

It does not seem to effect anything.

linear · 2022-08-10T15:03:38Z

ENG-469 Fix tinacms dependency vulnerabilities

A user in Discord pointed out we have some dependency vulnerabilities:
https://discord.com/channels/835168149439643678/1006697414213767288/1006701434793885826

https://github.com/tinacms/tinacms/security/dependabot?page=1&q=is%3Aopen
This shows up on a banner on the repo as well.

Screen Shot 2022-08-10 at 8.40.51 AM.png

changeset-bot · 2022-08-10T15:03:38Z

🦋 Changeset detected

Latest commit: a14bdc4

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 13 packages

Name	Type
@tinacms/auth	Patch
@tinacms/graphql	Patch
@tinacms/toolkit	Patch
create-tina-app	Patch
next-tinacms-cloudinary	Patch
tinacms	Patch
@tinacms/starter	Patch
@tinacms/cli	Patch
@tinacms/app	Patch
starter-basic	Patch
starter-empty	Patch
kitchen-sink-starter	Patch
kitchen-sink	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

github-actions · 2022-08-10T15:07:11Z

	Warnings
⚠️	`packages/tinacms` was modified but its README.md was not updated. Please check if any changes should be reflected in the documentation.
⚠️	`packages/next-tinacms-cloudinary` was modified but its README.md was not updated. Please check if any changes should be reflected in the documentation.
⚠️	`packages/create-tina-app` was modified but its README.md was not updated. Please check if any changes should be reflected in the documentation.
⚠️	`packages/@tinacms/graphql` was modified but its README.md was not updated. Please check if any changes should be reflected in the documentation.
⚠️	`packages/@tinacms/cli` was modified but its README.md was not updated. Please check if any changes should be reflected in the documentation.
⚠️	`packages/@tinacms/auth` was modified but its README.md was not updated. Please check if any changes should be reflected in the documentation.

Modified Packages

The following packages were modified by this pull request:

@tinacms/auth
@tinacms/cli
@tinacms/graphql
create-tina-app
next-tinacms-cloudinary
tinacms

Generated by 🚫 dangerJS against a14bdc4

jeffsee55 · 2022-08-10T16:02:33Z

When updating next I get this warning

We should probably make sure we understand why that's happening. Might be related node-fetch/node-fetch#675.

logan-anderson · 2022-08-11T13:57:48Z

When updating next I get this warning

We should probably make sure we understand why that's happening. Might be related node-fetch/node-fetch#675.

@jeffsee55 I think that is the issue

…bilities

logan-anderson · 2022-08-15T19:21:50Z

Some key things to review for the PR

Local image uploads
cloudinary image uploads
General next.js stuff (does the site load, does getStaticProps work, any more warning messages or errors, etc)
Editing a file, click save and see if the changed file is updated in the file system.
Make sure svg's still load in tina-cloud-starter

kldavis4 · 2022-08-16T14:12:47Z

@logan-anderson there are some conflicts with main - you want to resolve before we validate this?

…bilities

logan-anderson · 2022-08-16T17:25:04Z

@logan-anderson there are some conflicts with main - you want to resolve before we validate this?

@kldavis4 I have update it. Good catch

kldavis4 · 2022-08-16T18:40:52Z

@logan-anderson

when I run yarn build in tina-cloud-starter in the monorepo I get:

../../node_modules/.pnpm/cloudinary@1.30.0/node_modules/cloudinary/lib-es5/utils/index.js
Critical dependency: the request of a dependency is an expression

Import trace for requested module:
../../node_modules/.pnpm/cloudinary@1.30.0/node_modules/cloudinary/lib-es5/cloudinary.js
../../node_modules/.pnpm/cloudinary@1.30.0/node_modules/cloudinary/cloudinary.js
../../packages/next-tinacms-cloudinary/dist/handlers.js
./pages/api/cloudinary/[...media].tsx

../../node_modules/.pnpm/cloudinary@1.30.0/node_modules/cloudinary/lib/utils/index.js
Critical dependency: the request of a dependency is an expression

Import trace for requested module:
../../node_modules/.pnpm/cloudinary@1.30.0/node_modules/cloudinary/lib/cloudinary.js
../../node_modules/.pnpm/cloudinary@1.30.0/node_modules/cloudinary/cloudinary.js
../../packages/next-tinacms-cloudinary/dist/handlers.js
./pages/api/cloudinary/[...media].tsx

It looks like the build succeeds, so not sure if this is an issue. In the main branch, it fails completely

kldavis4 · 2022-08-16T18:49:36Z

@logan-anderson

local image uploads seem to be working normally in the tina-cloud-starter
cloudinary image uploads don't seem to be currently testable due to: https://linear.app/tina/issue/ENG-485/cloudinary-not-working-in-tina-cloud-starter-in-monorepo
nextjs stuff seems to be working normally
editing a file works. Creating a new file wasn't testable due to: https://linear.app/tina/issue/ENG-484/create-document-in-tina-cloud-starter-monorepo-fails
svgs seem to load as normal in the tina-cloud-starter

…bilities the commit.

Co-authored-by: Jeff See <jeffsee.55@gmail.com>

…bilities

kldavis4

Everything in the validation list is now working for me.

@jamespohalloran do we need to make corresponding changes in the standalone tina-cloud-starter repo?

jamespohalloran · 2022-08-23T19:47:39Z

Everything in the validation list is now working for me.

@jamespohalloran do we need to make corresponding changes in the standalone tina-cloud-starter repo?

Yep I think all our starters will have to upgrade next, and tinacms once this is out

logan-anderson added 2 commits August 10, 2022 11:00

update deps

09e50a1

added changeset

b369d72

update deps

c7435a8

logan-anderson marked this pull request as ready for review August 10, 2022 15:44

logan-anderson requested a review from a team as a code owner August 10, 2022 15:44

added override

ea9ca6c

logan-anderson mentioned this pull request Aug 11, 2022

Using --snapshot breaks with "@changesets/assemble-release-plan": "5.2.0" changesets/changesets#910

Closed

logan-anderson commented Aug 11, 2022

View reviewed changes

Comment thread package.json Outdated

logan-anderson added 2 commits August 11, 2022 09:58

Merge branch 'main' into logan/eng-469-fix-tinacms-dependency-vulnera…

d1e50c5

…bilities

update @changesets/cli

0597308

logan-anderson added 2 commits August 16, 2022 14:23

Merge branch 'main' into logan/eng-469-fix-tinacms-dependency-vulnera…

d6fbe02

…bilities

fix merge conflicts

19419c4

logan-anderson and others added 8 commits August 17, 2022 11:10

Merge branch 'main' into logan/eng-469-fix-tinacms-dependency-vulnera…

26b2891

…bilities the commit.

Version Packages

3212b53

Fix issue building node packages to non-index.js files

ae2d677

Version Packages

bea8883

Fix regression in handling images in rich-text

85f6e39

Version Packages

8c655cc

complete listMedia function

57a12d8

complete upload feature

4728179

Phoenix-Alpha and others added 10 commits August 22, 2022 12:51

complete delete feature

e6df8cf

update pnpm-lock.yaml

cf90312

add README.md to next-tinacms-dos

53bd882

add changeset

dc8b8d6

Update packages/next-tinacms-dos/README.md

8028b8b

Co-authored-by: Jeff See <jeffsee.55@gmail.com>

Update packages/next-tinacms-dos/README.md

481b01c

Co-authored-by: Jeff See <jeffsee.55@gmail.com>

Update packages/next-tinacms-dos/README.md

636cdc6

Co-authored-by: Jeff See <jeffsee.55@gmail.com>

Update packages/next-tinacms-dos/README.md

dce52f0

Co-authored-by: Jeff See <jeffsee.55@gmail.com>

Merge branch 'main' into logan/eng-469-fix-tinacms-dependency-vulnera…

a718e1e

…bilities

Merge branch 'main' into logan/eng-469-fix-tinacms-dependency-vulnera…

a14bdc4

…bilities

kldavis4 approved these changes Aug 22, 2022

View reviewed changes

jeffsee55 merged commit b9afec9 into main Aug 24, 2022

jeffsee55 deleted the logan/eng-469-fix-tinacms-dependency-vulnerabilities branch August 24, 2022 18:15

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Logan/eng 469 fix tinacms dependency vulnerabilities#3088

Logan/eng 469 fix tinacms dependency vulnerabilities#3088
jeffsee55 merged 26 commits intomainfrom
logan/eng-469-fix-tinacms-dependency-vulnerabilities

logan-anderson commented Aug 10, 2022 •

edited

Loading

Uh oh!

linear Bot commented Aug 10, 2022

Uh oh!

changeset-bot Bot commented Aug 10, 2022 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 10, 2022 •

edited

Loading

Uh oh!

jeffsee55 commented Aug 10, 2022

Uh oh!

Uh oh!

logan-anderson commented Aug 11, 2022

Uh oh!

logan-anderson commented Aug 15, 2022 •

edited

Loading

Uh oh!

kldavis4 commented Aug 16, 2022

Uh oh!

logan-anderson commented Aug 16, 2022

Uh oh!

kldavis4 commented Aug 16, 2022

Uh oh!

kldavis4 commented Aug 16, 2022

Uh oh!

kldavis4 left a comment

Uh oh!

jamespohalloran commented Aug 23, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

logan-anderson commented Aug 10, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

One known issue.

Uh oh!

linear Bot commented Aug 10, 2022

Uh oh!

changeset-bot Bot commented Aug 10, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

github-actions Bot commented Aug 10, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Modified Packages

Uh oh!

jeffsee55 commented Aug 10, 2022

Uh oh!

Uh oh!

logan-anderson commented Aug 11, 2022

Uh oh!

logan-anderson commented Aug 15, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kldavis4 commented Aug 16, 2022

Uh oh!

logan-anderson commented Aug 16, 2022

Uh oh!

kldavis4 commented Aug 16, 2022

Uh oh!

kldavis4 commented Aug 16, 2022

Uh oh!

kldavis4 left a comment

Choose a reason for hiding this comment

Uh oh!

jamespohalloran commented Aug 23, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

logan-anderson commented Aug 10, 2022 •

edited

Loading

changeset-bot Bot commented Aug 10, 2022 •

edited

Loading

github-actions Bot commented Aug 10, 2022 •

edited

Loading

logan-anderson commented Aug 15, 2022 •

edited

Loading