claimed-framework / claimed-framework/mlx_deprecated

Keep npm dependencies up to date

Open
#93 1 comment 1 reaction 1 assignee Claimed by @BluThaitanium View on GitHub
dependencies RCOS size/S UI
Dominant language
Python
Stars
220
Forks
54
PR merge metrics
No merged PRs in 30d

Description

Many of our `npm` dependencies get pinned to a certain version (see `package-lock.json`) which become outdated quickly. Those outdated version often have [security vulnerabilities](https://github.com/machine-learning-exchange/mlx/security/dependabot) that get fixed in more recent versions. However the MLX UI keeps using the pinned outdated versions.

We should try using tools like `npm-upgrade` and build that into a `Makefile` target and integrate a check for outdated (minor) versions in our CI/CD checks.

This is the first blog post I hit after googling this topic, but there are plenty more:
https://hudochenkov.com/posts/up-to-date-dependencies/

@drewbutlerbb4 -- could you take this on?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.