Upgrade instructions and considerations for Configured Commerce SDK 5.1

Follow the steps below to upgrade Optimizely Configured Commerce SDK:

* check for customizations you may have made that are lost

There are three possible approaches: 

OR

OR

There are two possible approaches:

OR

All features introduced between 4.6 and 5.1 are incorporated into the 5.1 SDK release. This document highlights specific areas to consider when upgrading from a 4.6 version of Configured Commerce.

Key Features

The major features introduced in this SDK are listed in the 5.1 SDK Release Announcement5.1 SDK Release Announcement. 

Upgrade Process

Note: The Configured Commerce private Nuget feed moved from MyGet to the Optimizely public server. You will need to point your Nuget host to this location.

Breaking Changes

Optimizely attempts to minimize breaking changes, but sometimes they are inevitable. The specific changes are detailed in the cumulative spreadsheet attached to each set of release notes, but it may be easier to look for compilation problems and remediate them individually. (Note the two tabs at the bottom of the spreadsheet: one for cumulative breaking changes, one for Spire breaking changes.)

Potential Warnings

When running npm audit on the 5.1 SDK code, you may run into the following vulnerabilities:

Immer

This only applies to the applyPatches and enablePatches functions, which are not used in Optimizely Configured Commerce, making this low risk for the application.

ANSI-HTML

This affects all versions of package ansi-html. If an attacker provides a malicious string, it will get stuck processing the input for an extremely long time. This is a limited risk for Optimizely Configured Commerce, because this is a peer dependency of our development environments.

Glob-parent

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator. Because glob-parent is a dependency of webpack and babel, which are developmental dependencies, this is a limited risk for Optimizely Configured Commerce.

Vulnerable Versions

SSRI

npm `ssri` 5.2.2-6.0.1 and 7.0.0-8.0.0, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option. SSRI is a dependency of webpack and therefore this risk is limited for Optimizely Configured Commerce

Handlebars

The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source. This is a limited risk for Optimizely Configured Commerce, because we do not use Handlebars directly; it is peer dependency of a development dependency.

 Ini

The `ini` npm package before version 1.3.6 has a Prototype Pollution vulnerability. Ini is a development dependency for Optimizely Configured Commerce, and is therefore low risk.

 Trim-newlines

The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method. This dependency is a dependency of template-file, which is used on specific files for generating templates on the backend, making it low risk for Optimizely Configured Commerce.

Node-fetch

Node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. This is a dependency of isomorphic-fetch, which performs data calls for serverside rendering. Therefore it is low risk for Optimizely Configured Commerce.