Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Backport: Upgrade EasyMDE 2.16.1 (package-lock.json) #18301

Merged
merged 3 commits into from
Jan 17, 2022

Conversation

wxiaoguang
Copy link
Contributor

@wxiaoguang wxiaoguang commented Jan 17, 2022

This PR follows #18279 to add forgotten package-lock.json

npm suggests:

Browserslist: caniuse-lite is outdated. Please run:
npx browserslist@latest --update-db

So the caniuse-lite is also updated.

@wxiaoguang
Copy link
Contributor Author

wxiaoguang commented Jan 17, 2022

Hmm ... why a new codemirror comes.

    "node_modules/easymde/node_modules/codemirror": {
      "version": "5.65.0",
      "resolved": "https://registry.npmjs.org/codemirror/-/codemirror-5.65.0.tgz",
      "integrity": "sha512-gWEnHKEcz1Hyz7fsQWpK7P0sPI2/kSkRX2tc7DFA6TmZuDN75x/1ejnH/Pn8adYKrLEA1V2ww6L00GudHZbSKw=="
    },

Let me see ....

Gitea 1.15 uses "codemirror": "5.61.0", while EasyMDE 2.16.1 depends on "codemirror": "^5.63.1"

Do maintainers have suggestions about how to deal with such dependency?

  • Should we upgrade CodeMirror for Gitea 1.15 to apply EasyMDE 2.16.1?
  • Or should we revert to use old EasyMDE 2.15 (there is a browser-side DoS problem in EasyMDE 2.15, maybe not too serious)?

@GiteaBot GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Jan 17, 2022
@wxiaoguang wxiaoguang added this to the 1.15.11 milestone Jan 17, 2022
@GiteaBot GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels Jan 17, 2022
@zeripath
Copy link
Contributor

  • Should we upgrade CodeMirror for Gitea 1.15 to apply EasyMDE 2.16.1?

Yes do this after checking that the editor still works.

AFAIU we're not really tightly depending on Codemirror - we're only using it as part of EasyMDE (and I think the githooks editor.) Even though we may import it directly it's only to ensure that we load syntax highlighting. I think therefore its version should be more tightly bound to EasyMDE than to any of our code.

@wxiaoguang
Copy link
Contributor Author

wxiaoguang commented Jan 17, 2022

Yep, CodeMirror is only used by EasyMDE. I tested locally and EasyMDE works.

PR is updated.

@silverwind
Copy link
Member

Update CM as well. There is still a static version of CM in public whis is used for the modeload feature and those plugins are loaded as outdated versions, but that's another issue to be solved.

@GiteaBot GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels Jan 17, 2022
@wxiaoguang wxiaoguang merged commit 95f3945 into go-gitea:release/v1.15 Jan 17, 2022
@wxiaoguang wxiaoguang deleted the backport-update-easymde branch January 17, 2022 10:32
@zeripath zeripath added the skip-changelog This PR is irrelevant for the (next) changelog, for example bug fixes for unreleased features. label Jan 29, 2022
@go-gitea go-gitea locked and limited conversation to collaborators Apr 28, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. skip-changelog This PR is irrelevant for the (next) changelog, for example bug fixes for unreleased features.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants