Skip to content

Update all dependencies to latest#75

Merged
DoodlesEpic merged 7 commits intodevfrom
deps/update-to-latest
Feb 22, 2026
Merged

Update all dependencies to latest#75
DoodlesEpic merged 7 commits intodevfrom
deps/update-to-latest

Conversation

@DoodlesEpic
Copy link
Owner

This branch not only resets the Cargo lockfile and the Yarn lockfile, but it also updates the ranges in the package.json through yarn upgrade-interactive. Finally, I've updated from Rust 2021 to Rust 2024 and changed the MSRV accordingly.

@DoodlesEpic DoodlesEpic self-assigned this Feb 21, 2026
@DoodlesEpic DoodlesEpic added the dependencies Pull requests that update a dependency file label Feb 21, 2026
@DoodlesEpic
Copy link
Owner Author

This update fails because of low security scores in dependencies. This has been flagged by the dependency review Action.


  Warning: npm/@lezer/common has an OpenSSF Scorecard of 2.9, which is less than this repository's threshold of 3.
  Warning: npm/@lezer/highlight has an OpenSSF Scorecard of 2, which is less than this repository's threshold of 3.
  Warning: npm/crelt has an OpenSSF Scorecard of 2, which is less than this repository's threshold of 3.
  Warning: npm/debug has an OpenSSF Scorecard of 2.6, which is less than this repository's threshold of 3.
  Warning: npm/deepmerge has an OpenSSF Scorecard of 2.3, which is less than this repository's threshold of 3.
  Warning: npm/http-cache-semantics has an OpenSSF Scorecard of 2.1, which is less than this repository's threshold of 3.
  Warning: npm/ignore has an OpenSSF Scorecard of 2.7, which is less than this repository's threshold of 3.
  Warning: npm/ip-address has an OpenSSF Scorecard of 2.5, which is less than this repository's threshold of 3.
  Warning: npm/style-mod has an OpenSSF Scorecard of 2, which is less than this repository's threshold of 3.
  Warning: npm/totalist has an OpenSSF Scorecard of 2.8, which is less than this repository's threshold of 3.
  Warning: npm/w3c-keyname has an OpenSSF Scorecard of 2, which is less than this repository's threshold of 3.
  Warning: cargo/embed-resource has an OpenSSF Scorecard of 2.5, which is less than this repository's threshold of 3.
  Warning: cargo/fax has an OpenSSF Scorecard of 2.1, which is less than this repository's threshold of 3.
  Warning: cargo/fax_derive has an OpenSSF Scorecard of 2.1, which is less than this repository's threshold of 3.
  Warning: cargo/id-arena has an OpenSSF Scorecard of 2.9, which is less than this repository's threshold of 3.
  Warning: cargo/tree_magic_mini has an OpenSSF Scorecard of 2.1, which is less than this repository's threshold of 3.

@DoodlesEpic
Copy link
Owner Author

Dependency review is flagging:

  yarn.lock » svelte@3.59.2 – Svelte has a potential mXSS vulnerability due to improper HTML escaping (moderate severity)
    ↪ https://github.com/advisories/GHSA-8266-84wp-wv5c
  yarn.lock » svelte@3.59.2 – Svelte affected by cross-site scripting via spread attributes in Svelte SSR (moderate severity)
    ↪ https://github.com/advisories/GHSA-f7gr-6p89-r883
  yarn.lock » svelte@3.59.2 – Svelte SSR does not validate dynamic element tag names in `<svelte:element>` (moderate severity)
    ↪ https://github.com/advisories/GHSA-m56q-vw4c-c2cp
  yarn.lock » svelte@3.59.2 – Svelte SSR attribute spreading includes inherited properties from prototype chain (moderate severity)
    ↪ https://github.com/advisories/GHSA-crpf-4hrx-3jrp
  Error: Dependency review detected vulnerable packages.

This does not make sense, as this version of the software is already on Svelte 5. Further investigation is needed to fix this PR.

@DoodlesEpic
Copy link
Owner Author

Apparently, Svelte 3 is a transitive dependency of svelte-frappe-charts. Perhaps, this means it's time to migrate out of it and maybe even dygraphs and use something like d3.js for both basic and advanced modes. This would also be an advantage as it would probably help with improving UI performance.

This was referenced Feb 21, 2026
@DoodlesEpic
Copy link
Owner Author

While the new configuration is saner, the pull request will still fail because of the transitive dependency on Svelte 3, which features a few moderate severity vulnerabilities.

@DoodlesEpic
Copy link
Owner Author

The dependency on svelte-frappe-charts has been completely removed and now the project directly wraps frappe-charts into a Svelte component, similar to how it's done with dygraphs already.

@DoodlesEpic DoodlesEpic merged commit 9cab11b into dev Feb 22, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant