mirror of
https://github.com/expo/eas-cli.git
synced 2026-11-15 03:38:08 -10:00
Stanisław Chmiela
ac761edb5c
# Why Supersedes #3968. Dependabot alert 354 requires `lodash` and `lodash-es` 4.18.1. The original PR upgraded the worker's direct dependency and enforced the patched transitive version with a root resolution. That resolution is no longer needed: this PR upgrades the EAS-owned declarations and the GraphQL Code Generator packages that brought in the remaining restrictive `lodash ~4.17.0` dependency. # How - Upgrade direct Lodash declarations in build-tools, local-build-plugin, template-file, and worker to 4.18.1. - Upgrade the scripts project's `lodash-es` declaration and its independent lockfile to 4.18.1. - Upgrade the complete GraphQL Code Generator family used by EAS CLI: - `@graphql-codegen/cli` 5.0.0 → 6.3.1 - `@graphql-codegen/introspection` 4.0.0 → 5.0.2 - `@graphql-codegen/typescript` 4.0.1 → 5.0.10 - `@graphql-codegen/typescript-operations` 4.0.1 → 5.1.0 - Regenerate the checked-in GraphQL TypeScript output. - Keep the root free of `resolutions` and regenerate both affected lockfiles. These are the newest aligned Codegen releases before `typescript-operations` v6. That v6 upgrade changes generated operation type semantics (including nullable response-field presence) and causes broad fixture/type failures across EAS CLI, so it should be handled as a separate GraphQL contract migration rather than bundled into this security dependency update. The selected packages use `@graphql-codegen/plugin-helpers` 6.3.x, which no longer depends on Lodash. The root dependency graph now reports only `[email protected].1`, selected through ordinary declared dependency ranges. The separate scripts project reports only `[email protected].1`. There is no resolution or override. # Test Plan - `yarn install` - `yarn why lodash` — only `[email protected].1`; no Codegen consumer - `cd scripts && yarn install && yarn why lodash-es` — only `[email protected].1` - `yarn build` — all 13 projects passed - `yarn workspace eas-cli verify-graphql-code` — generated output compiles against the current live schema - `cd scripts && yarn typecheck` - `yarn lint-changelog` - template-file tests — 7 passed - worker tests — 51 passed - `yarn fmt`
39 lines
1.2 KiB
JSON
39 lines
1.2 KiB
JSON
{
|
|
"name": "scripts",
|
|
"version": "0.31.0",
|
|
"private": true,
|
|
"license": "MIT",
|
|
"author": "Expo <[email protected]>",
|
|
"type": "module",
|
|
"scripts": {
|
|
"changelog-entry": "node --no-warnings=ExperimentalWarning --loader ts-node/esm src/changelogEntry.ts",
|
|
"next-version": "node --no-warnings=ExperimentalWarning --loader ts-node/esm src/nextVersion.ts",
|
|
"lint-changelog": "node --no-warnings=ExperimentalWarning --loader ts-node/esm src/lintChangelog.ts",
|
|
"release": "./src/release.sh",
|
|
"release-changelog": "node --no-warnings=ExperimentalWarning --loader ts-node/esm src/releaseChangelog.ts",
|
|
"update-local-plugin": "./src/updateLocalPlugin.sh",
|
|
"typecheck": "tsc"
|
|
},
|
|
"dependencies": {
|
|
"chalk": "5.2.0",
|
|
"dateformat": "4.5.1",
|
|
"fs-extra": "11.2.0",
|
|
"lodash-es": "4.18.1",
|
|
"marked": "3.0.4",
|
|
"semver": "7.5.4",
|
|
"tslib": "2.6.2"
|
|
},
|
|
"devDependencies": {
|
|
"@types/dateformat": "3.0.1",
|
|
"@types/fs-extra": "11.0.4",
|
|
"@types/lodash-es": "4.17.12",
|
|
"@types/node": "20.11.0",
|
|
"@types/semver": "7.5.6",
|
|
"ts-node": "10.9.2",
|
|
"typescript": "5.3.3"
|
|
},
|
|
"engines": {
|
|
"node": ">=20.0.0"
|
|
}
|
|
}
|