{"action":"created","issue":{"url":"https://api.github.com/repos/Polymer/tools/issues/533","repository_url":"https://api.github.com/repos/Polymer/tools","labels_url":"https://api.github.com/repos/Polymer/tools/issues/533/labels{/name}","comments_url":"https://api.github.com/repos/Polymer/tools/issues/533/comments","events_url":"https://api.github.com/repos/Polymer/tools/issues/533/events","html_url":"https://github.com/Polymer/tools/pull/533","id":334464835,"node_id":"MDExOlB1bGxSZXF1ZXN0MTk2NDMwNzk5","number":533,"title":"Fix audit warnings wct browser legacy","user":{"login":"TimvdLippe","id":5948271,"node_id":"MDQ6VXNlcjU5NDgyNzE=","avatar_url":"https://avatars3.githubusercontent.com/u/5948271?v=4","gravatar_id":"","url":"https://api.github.com/users/TimvdLippe","html_url":"https://github.com/TimvdLippe","followers_url":"https://api.github.com/users/TimvdLippe/followers","following_url":"https://api.github.com/users/TimvdLippe/following{/other_user}","gists_url":"https://api.github.com/users/TimvdLippe/gists{/gist_id}","starred_url":"https://api.github.com/users/TimvdLippe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TimvdLippe/subscriptions","organizations_url":"https://api.github.com/users/TimvdLippe/orgs","repos_url":"https://api.github.com/users/TimvdLippe/repos","events_url":"https://api.github.com/users/TimvdLippe/events{/privacy}","received_events_url":"https://api.github.com/users/TimvdLippe/received_events","type":"User","site_admin":false},"labels":[{"id":85405100,"node_id":"MDU6TGFiZWw4NTQwNTEwMA==","url":"https://api.github.com/repos/Polymer/tools/labels/cla:%20yes","name":"cla: yes","color":"009800","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-06-21T12:10:35Z","updated_at":"2018-06-21T14:42:31Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/Polymer/tools/pulls/533","html_url":"https://github.com/Polymer/tools/pull/533","diff_url":"https://github.com/Polymer/tools/pull/533.diff","patch_url":"https://github.com/Polymer/tools/pull/533.patch"},"body":"This upgrades several packages with (critical) vulnerabilities. There is one 1 low vulnerability left in `stacky > lodash`. We maintained stacky (https://github.com/googlearchive/stacky), but it has been unmaintained for 2 years. Moreover, `lodash` is actually never used in the code in `stacky`. Fixing this vulnerability therefore is easy: simply remove `lodash` from `stacky`, yet the package is no longer updated. Not sure what our options are in that regard.\r\n\r\nThe following list shows the breaking changes in this PR:\r\n\r\n## mocha\r\n\r\nMocha updated from 3.4.2 to 5.2.0.\r\nChangelists: https://github.com/mochajs/mocha/releases/tag/v4.0.0 and https://github.com/mochajs/mocha/releases/tag/v5.0.0\r\n\r\nThe breaking changes include removal of old Node versions.\r\nThis is not a problem as we support 8+ which still works.\r\nMoreover, IE8, 9 and 10 are no longer supporter.\r\nAgain, we do not support these browsers, so this should not be breaking changes for our users.\r\n\r\n**Expected breaking change impact:** None\r\n\r\n## Chai\r\n\r\nSeveral API updates were made.\r\nChangelist: https://github.com/chaijs/chai/releases/tag/4.0.0\r\n\r\nI ran these changes on the Polymer repository.\r\nOut of all tests, there was 1 usage of `sinon.reset()`.\r\nAll other tests were happily passing.\r\n\r\n**Expected breaking change impact:** Low :warning:\r\n\r\n## Sinon\r\n\r\nUpdated from 1.17.1 to 6.0.0.\r\nChangelists: http://sinonjs.org/guides/migrating-to-2.0 and http://sinonjs.org/guides/migrating-to-3.0 and http://sinonjs.org/guides/migrating-to-4.0 and http://sinonjs.org/guides/migrating-to-5.0 and http://sinonjs.org/guides/migrating-to-6.0\r\n\r\nThere are no user-facing breaking changes for the upgrade to version 6.\r\nThe other versions introduce several error-throwing methods and some method removal.\r\nNone of these changes were impactful for the Polymer repository.\r\n\r\n**Expected breaking change impact:** (Very) Low :warning:\r\n\r\n## Sinon-chai\r\n\r\nUpdated from 2.10.0 to 3.2.0.\r\nChangelist: https://github.com/domenic/sinon-chai/releases/tag/v3.0.0\r\n\r\nThe breaking changes include removal of old Node versions.\r\nThis is not a problem as we support 8+ which still works.\r\n\r\n**Expected breaking change impact:** None\r\n\r\n## Lodash\r\n\r\nUpdated from 3.10.1 to 4.17.10.\r\nChangelist: https://github.com/lodash/lodash/wiki/Changelog#compatibility-warnings\r\n\r\nThese changes include quite some updates to methods.\r\nHowever, Polymer core does not make use it and I was unable to find other usages of Lodash in our organisations: [Polymer](https://github.com/search?utf8=%E2%9C%93&q=org%3APolymer+lodash+extension%3Ajs+extension%3Ahtml&type=Code&ref=advsearch&l=&l=) and [PolymerElements](https://github.com/search?l=&p=2&q=org%3APolymerElements+lodash+extension%3Ajs+extension%3Ahtml&ref=advsearch&type=Code&utf8=%E2%9C%93).\r\n(There are usages, but they are in node_modules fixtures of modulizer or implementation of our Node tooling)\r\n\r\n**Expected breaking change impact:** (Very) Low :warning:\r\n\r\n## Async\r\n\r\nUpdated from 1.5.2 to 2.6.1.\r\nChangelist: https://github.com/caolan/async/releases/tag/v2.0.0\r\n\r\nI was unable to find any usage of this particular package in our test suites.\r\nThe Polymer core repository was doing fine without this.\r\nNot sure what the purpose of this package is and what the impact of the method updates is.\r\n\r\n**Expected breaking change impact:** (Very) Low :warning:\r\n\r\nFixes #418"},"comment":{"url":"https://api.github.com/repos/Polymer/tools/issues/comments/399128359","html_url":"https://github.com/Polymer/tools/pull/533#issuecomment-399128359","issue_url":"https://api.github.com/repos/Polymer/tools/issues/533","id":399128359,"node_id":"MDEyOklzc3VlQ29tbWVudDM5OTEyODM1OQ==","user":{"login":"TimvdLippe","id":5948271,"node_id":"MDQ6VXNlcjU5NDgyNzE=","avatar_url":"https://avatars3.githubusercontent.com/u/5948271?v=4","gravatar_id":"","url":"https://api.github.com/users/TimvdLippe","html_url":"https://github.com/TimvdLippe","followers_url":"https://api.github.com/users/TimvdLippe/followers","following_url":"https://api.github.com/users/TimvdLippe/following{/other_user}","gists_url":"https://api.github.com/users/TimvdLippe/gists{/gist_id}","starred_url":"https://api.github.com/users/TimvdLippe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TimvdLippe/subscriptions","organizations_url":"https://api.github.com/users/TimvdLippe/orgs","repos_url":"https://api.github.com/users/TimvdLippe/repos","events_url":"https://api.github.com/users/TimvdLippe/events{/privacy}","received_events_url":"https://api.github.com/users/TimvdLippe/received_events","type":"User","site_admin":false},"created_at":"2018-06-21T14:42:31Z","updated_at":"2018-06-21T14:42:31Z","author_association":"CONTRIBUTOR","body":"Integrations for WCT are failing, but I am unable to reproduce locally.\r\n\r\nSadly, to fix the issues with `wct-browser-legacy`, I had to update the `web-component-tester` config, as that appears to generate the `browser.js` that has to be updated. As such, I had to update the same bower and npm dependencies in web-component-tester to fix wct-browser-legacy.\r\n\r\nRight now, the integration test is locally passing, but on CI the `multiple-replace` test suite is failing. There is nothing particularly different in this integration test compared to the other tests. The failures happen on the assert that makes sure the test fixtures are correctly setup. While locally that works, on CI this throws.\r\n\r\nThe weird thing is that I have not updated the version of `test-fixture`, only the other packages. I therefore do not understand why this suddenly would fail. Any pointers would be greatly appreciated!"}}
{"actor":{"display_login":"TimvdLippe"}}