claimed-framework / claimed-framework/mlx_deprecated
Keep npm dependencies up to date
- Dominant language
- Python
- Stars
- 220
- Forks
- 54
- PR merge metrics
- No merged PRs in 30d
Description
Many of our `npm` dependencies get pinned to a certain version (see `package-lock.json`) which become outdated quickly. Those outdated version often have [security vulnerabilities](https://github.com/machine-learning-exchange/mlx/security/dependabot) that get fixed in more recent versions. However the MLX UI keeps using the pinned outdated versions.
We should try using tools like `npm-upgrade` and build that into a `Makefile` target and integrate a check for outdated (minor) versions in our CI/CD checks.
This is the first blog post I hit after googling this topic, but there are plenty more:
https://hudochenkov.com/posts/up-to-date-dependencies/
@drewbutlerbb4 -- could you take this on?
Contributor guide
Assessment
This issue has not been assessed yet.