41 security alerts by dependabot

[chgiesse]

Hi there!

I've forked Dash and turned on dependabot security alerts, which triggered 41 alerts. Is this due to the dev branch?

Thanks in advance and kind regards,
Christian

[T4rk1n]

Is this due to the dev branch?

No, we have multiple packages and the js ecosystem for them has ton of dev dependencies that get hit with alerts. Most of them are not exploitable since they are only for bundling, I usually update the importants one before releasing new version, but some of them we can't easily do (eg: Markdown in dcc need a overhaul of the markdown component).

Then there are all those in the @plotly packages, they are not part of the framework but only used for testing purpose and we don't update them as often.