Upgrade kolibri-design-system to a release that pins lodash 4.18.1

Abierto
  • ¿Algo no está bien?
#6,381 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
25/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
javascript
Área
frontend, security

Línea de trabajo

Start by checking Studio's package manifest and pnpm-lock.yaml, then identify the first kolibri-design-system release whose package.json pins lodash 4.18.1. Review the KDS release notes and Studio components for API changes, then run pnpm build, pnpm test, and pnpm audit --prod. Done means the lockfile has no lodash 4.17.23 entry and all three commands pass.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

dependencies javascript

❌ This issue is not open for contribution. Visit Contributing guidelines to learn about the contributing process and how to find suitable issues.

Overview

Studio's frontend bundle still ships lodash 4.17.23, the version patched by GHSA-f23m-r3pf-42rh and CVE-2026-4800, because kolibri-design-system 5.10.0 pins it exactly. Studio should move to a KDS release that pins lodash 4.18.1, so a single lodash copy resolves.

Complexity: Low
Target branch: unstable

Context
  • Dependabot PR #6380 targeted lodash 4.17.23 → 4.18.1; unstable already has that bump (c4a855604). The PR was closed unmerged.
  • pnpm-lock.yaml on unstable still resolves lodash: 4.17.23 under [email protected].
  • KDS develop pins "lodash": "4.18.1" since learningequality/kolibri-design-system#1232; the v5.10.0 tag, the latest release, does not include it.
  • KDS 5.10.0 imports only debounce, throttle, merge, cloneDeep, get, has and similar; none of template, unset, omit.
  • Lockstep: KDS pins lodash to an exact version, so kolibri-design-system and Studio's own lodash must match to share one copy. Each later lodash bump in Studio needs a matching KDS release.
The Change
  • Bump kolibri-design-system to the first release whose package.json pins lodash 4.18.1.
  • Handle any KDS API changes between 5.10.0 and that release in Studio's components.
Acceptance Criteria
  • pnpm-lock.yaml contains no [email protected] entry.
  • pnpm build and pnpm test pass.
  • pnpm audit --prod reports no lodash advisories.

AI usage

rtibblesbot (Claude Code) reviewed #6380, traced the leftover lodash 4.17.23 to KDS through the lockfile, the KDS 5.10.0 npm tarball and the KDS repo, and drafted this issue.

Filed from #6380's review.

Lenguaje dominante
Python
Estrellas
211
Forks
317
Merge medio
4 d 2 h
PR fusionados (30 d)
23

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de learningequality/studio

Todos los issues de learningequality/studio

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.