Multiple Gatsby dependencies flagged by Veracode scan — any chance to update?

[robert-j-peterson]

Hello! I recently built an app using Gatsby, but when I tried to run it through Veracode's approval filters, the following Gatsby dependencies were flagged as out of date (see below).

Would it be possible for these dependencies to be updated to the most current versions, or would it be possible to get some kind of temp or beta version of Gatsby that includes updated dependencies?

Thank you! I love Gatsby!!!

react-dev-utils | 4.2.3 | MIT | 1 | 1
lodash | 4.17.15 | MIT | 11 | 1
bl | 1.2.2 | MIT | 1 | 1
inquirer | 3.3.0 | MIT | 1 | 1
websocket-driver | 0.6.5 | MIT | 1 | 1
bl | 4.0.2 | MIT | 1 | 1
ajv | 6.12.0 | MIT | 1 | 1
request | 2.88.2 | Apache-2.0 | 2 | 1
jpeg-js | 0.3.7 | BSD-3-Clause | 1 | 1
trim | 0.0.1

[LekoArts]

Hi, thanks for the issue!

As we have to keep some backward compatibility we can't (most of the times) just update to latest versions. We're monitoring it via #16840 and update everything that is possible.

Important security fixes are added quickly and at the moment there are none (to our knowledge).

[robert-j-peterson]

HI, Leko! Thanks for the message, and duly noted!

[Purii]

Hi @LekoArts! Would be really awesome if you upgrade react-dev-utils to a more recent version, since there's a licensing issue with one of the peer dependencies in this old version:

gatsby
|-react-dev-utils
   |-shell-quote
      |-jsonify

• jsonify is published under no valid license: https://github.com/substack/jsonify/pull/7
• shell-quote got rid of the dependency completely as part of a patch bump to v1.6.2 a year ago: https://github.com/substack/node-shell-quote/pull/21
• react-dev-utils: Updated to new version of shell-quote also a year ago. Guess > 9.0.4 should be fine: Bump dependencies facebook/create-react-app#7681