Remove unused gulp-css-url-adjuster dependency #1691
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary | Résumé
This PR is part 2 of 2 (part 1) to resolve a critical security vulnerability with versions of
lodash
that are < 4.5.0.Why?
The dependency tree:
gulp-css-url-adjuster
is dependent ongulp-util
which has been deprecated. The authors recommend moving away from using it. Additionally the authors ask that if your project has a dependency which usesgulp-util
to create an issue in the dep's repo recommending it's removal and offering replacements for certain API calls.Initially this was my plan, however, there has not been a commit in the repo for over 8 years and there are issues that have been open for 6+ years. I expect that if we opened an issue it would receive the same treatment as maintenance of the dep seems to have halted.
Lastly, while we require the dependency in our
gulp.js
we do not appear to call or utilize it, and removing it has had no apparent affect on the building of our dev containers or within the running application.An aside
It may be beneficial for relations to open a PR in GDS' Admin repo, or otherwise share this with them as they appear to be in the same boat.
Testing