upgrade dependencies

[paul-marechal]

Description

yarn audit finally works on the main repository, and here's the output:

16468 vulnerabilities found - Packages audited: 6505915
Severity: 13677 Low | 13 Moderate | 2775 High | 3 Critical

To be fair, this is not a huge issue in itself, for two reasons:

1. It is due to having a lock file, despite our version ranges targeting newer versions, the lock file prevent us from pulling updated packages.
2. Clients will most likely pull up-to-date packages.

Although this becomes an issue when despite using all the most up-to-date packages, vulnerabilities are still present. That's when we are supposed to fix things. Right now given the result of yarn audit, we have no way to know if the Theia framework suffers from such vulnerabilities through its dependencies.

Hence why we should try and make a best effort keeping our dependencies up-to-date.

Reproduction Steps

git clone [email protected]:theia-ide/theia.git
cd theia
yarn
yarn audit

OS and Theia version: Ubuntu 16.04, Theia@9105c43, [email protected]

[vince-fugnitto]

How many of the issues are from production and not devDependencies?

[paul-marechal]

No idea, too many. But that's the issue.

Scrolling through the report I could see some, but cannot know for sure for the rest.

[lmcbout]

@marechal-p What about the 3 critical, did you have a look at those ?

[paul-marechal]

Those were dev dependency related, still trying to bring the counters as close to 0.

[vince-fugnitto]

Is it closeable by #6255 ?