fix(ui): Safari crashed after upgrading react-diff-viewer

[rbreeze]

Fixes #6701

Signed-off-by: Remington Breeze remington@breeze.software

Note on DCO:

If the DCO action in the integration test fails, one or more of your commits are not signed off. Please click on the Details link next to the DCO action for instructions on how to resolve this.

Checklist:

• Either (a) I've created an enhancement proposal and discussed it with the community, (b) this is a bug fix, or (c) this does not need to be in the release notes.
• The title of the PR states what changed and the related issues number (used for the release note).
• I've included "Closes [ISSUE #]" or "Fixes [ISSUE #]" in the description to automatically close the associated issue.
• I've updated both the CLI and UI to expose my feature, or I plan to submit a second PR with them.
• Does this PR require documentation updates?
• I've updated documentation as required by this PR.
• Optional. My organization is added to USERS.md.
• I have signed off all my commits as required by DCO
• I have written unit and/or e2e tests for my change. PRs without these are unlikely to be merged.
• My build is green (troubleshooting builds).

[jannfis]

This will revert many of the updated dependency, according to changes on yarn.lock, and I fear ultimately re-introduce many (if not all) of the fixed critical and high severity vulnerabilities.

Don't we want to go for the root cause of this?

[codecov]

Codecov Report

Merging #6702 (6c7b33d) into master (d6dd6af) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master    #6702   +/-   ##
=======================================
  Coverage   41.30%   41.30%           
=======================================
  Files         156      156           
  Lines       20702    20702           
=======================================
  Hits         8550     8550           
  Misses      10944    10944           
  Partials     1208     1208           

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update d6dd6af...6c7b33d. Read the comment docs.

[alexmt]

Agree with @jannfis . It would be good to try to avoid rollback. Googled this: https://stackoverflow.com/questions/51568821/works-in-chrome-but-breaks-in-safari-invalid-regular-expression-invalid-group

Looks like something uses lookbehind that is not supported by Safari yet. Trying to find if there is polyfill or similar workaround.

[alexmt]

It is sindresorhus/normalize-url#105

[alexmt]

Another option to fix the crash and avoid reintroducing vulnerability:

#6703

@rbreeze , @jannfis WDYT?

[rbreeze]

@alexmt I think that's perfect. I do think it might be a good idea to eventually replace the react-diff-view component, either with an alternative npm package, or our own.

Also, I've opened an issue in the react-diff-view repo: otakustay/react-diff-view#129