Refresh js/package-lock.json with compatible bumps#398
Merged
Conversation
Regenerate the lockfile inside a node:20 container so that every
transitive dep moves to the latest version that satisfies the existing
^x.y.z ranges in js/package.json. No top-level dep is bumped to a new
major.
Top-level package versions before / after:
- firebase 7.19.0 -> 7.24.0
- axios 1.4.0 -> 1.16.1
- @mui/material 5.13.1 -> 5.18.0
- @mui/icons-material 5.11.16 -> 5.18.0
- @mui/styles 5.13.1 -> 5.18.0
- @mui/lab 5.0.0-alpha.130 -> 5.0.0-alpha.177
- @emotion/react 11.11.0 -> 11.14.0
- @emotion/styled 11.11.0 -> 11.14.1
- react / react-dom / react-scripts / android-emulator-webrtc
unchanged
The 1400+ transitive bumps cover the security patches that were
proposed individually as google#297, google#304, google#307, google#310, google#315, google#321, google#324,
google#326, google#340, google#380, google#381, and the more recent rollups google#394, google#395 (minus
their firebase 7 -> 12 jump, which would require a Firebase v9+
modular-API migration).
CI=true npm run build inside the same container produces a clean
production bundle (237.96 kB main.js gzipped).
This was referenced May 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refreshes
js/package-lock.jsonso every transitive dep moves to the latest version compatible with the existing^x.y.zranges injs/package.json. No top-level dep crosses a major-version boundary.Top-level package versions before / after
The 1400+ transitive bumps cover the same security patches that were proposed individually as #297, #304, #307, #310, #315, #321, #324, #326, #340, #380, #381, and the more recent rollups #394, #395.
Notably not in this PR: the firebase 7 → 12 jump that #394 / #395 propose. Firebase v9 ships a redesigned modular SDK; the current
js/src/code uses the v7 namespaced API (and the deprecated@react-firebase/authpackage targets the same), so a major-version bump would force a follow-up migration that's worth its own focused PR.Test plan
npm installinsidenode:20-bookworm-slimresolves cleanly (1426 packages).CI=true npm run buildproduces a clean production bundle:237.96 kB main.js,557 B main.css. (Source-map warnings from the Firebase auth polyfill are cosmetic and unchanged from the prior lockfile.)js/package.jsonis untouched; no top-level dep crosses a major.Follow-ups (not in this PR)
@react-firebase/auth).