Conversation
|
This update fails because of low security scores in dependencies. This has been flagged by the dependency review Action. |
|
Dependency review is flagging: This does not make sense, as this version of the software is already on Svelte 5. Further investigation is needed to fix this PR. |
|
Apparently, Svelte 3 is a transitive dependency of svelte-frappe-charts. Perhaps, this means it's time to migrate out of it and maybe even dygraphs and use something like d3.js for both basic and advanced modes. This would also be an advantage as it would probably help with improving UI performance. |
|
While the new configuration is saner, the pull request will still fail because of the transitive dependency on Svelte 3, which features a few moderate severity vulnerabilities. |
|
The dependency on svelte-frappe-charts has been completely removed and now the project directly wraps frappe-charts into a Svelte component, similar to how it's done with dygraphs already. |
This branch not only resets the Cargo lockfile and the Yarn lockfile, but it also updates the ranges in the package.json through yarn upgrade-interactive. Finally, I've updated from Rust 2021 to Rust 2024 and changed the MSRV accordingly.