Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update draft-js peer dependency to the latest version #454

Open
chrimesdev opened this issue Aug 22, 2022 · 2 comments
Open

Update draft-js peer dependency to the latest version #454

chrimesdev opened this issue Aug 22, 2022 · 2 comments

Comments

@chrimesdev
Copy link

chrimesdev commented Aug 22, 2022

draftail has a peer dependency on draft-js version 0.10.5, the latest version of draft-js is at 0.11.7.

draft-js 0.10.5 has some requirements on an earlier version of node-fetch which currently has a high security vulnerability (GHSA-r683-j2x4-v87g) and also size which currently has a low security vulnerability (GHSA-w7rc-rwvf-8q5r)

We've overridden the peer dependencies for draftail to the latest version of draft-js and -everything still seems to be functioning as normal- see comment

It looks like a pull request was started for 0.11.0 when it was in BETA but not completed #186

@zerolab also left a comment here: #186 (comment)

@chrimesdev
Copy link
Author

chrimesdev commented Sep 1, 2022

Looks like you get this issue #260 if you use anything higher than 0.10.5

Specifically i, j, k in our case

@thibaudcolas
Copy link
Collaborator

Hey @chrimesdev 👋 I believe this is a dupe of #213. I’ll document how to use overrides to get rid of those warnings, and then close this in favour of #213.

I’ve researched those two warnings before, as I recall they are transitive dependencies from fbjs, a large polyfill and utility library, and don’t end up being used in Draft.js / Draftail.


The main problem with #186 for context is copy-paste support – Draft.js v0.11 has very different copy-paste processing, and I’d need to make sure the implementation is as solid as in v0.10 before merging this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants