Resolve at least critical dependecies about conference-buddy

[coderbyheart]

Could you elaborate what you would like to achieve?
If you see a dependabot warning, you can create a PR from that, which will pin a (sub-)dependency.

[programmiri]

Hi! Dependabot solves the critical dependencies with downgrading gatsby-plugin-image (to 0.7.2. instead of 2.0.0) which breaks stuff. Same as npm audit fix --force. Had a simliar problem with immer at my company and I solved it with forcing yarn to use a specific version of immer everywhere, which yarn does with resolves. Didn't find something similar for npm when I looked (shortly).

[coderbyheart]

Since gatsby-plugin-image is a build time dependency which does not get shipped with the published site I think it's safe to ignore this downgrade.

[coderbyheart]

I realize this is not the answer to the initial question, with NPM you would manually patch the package-lock.json.

[programmiri]

Thanks @coderbyheart! Will look into that ❤️

[programmiri]

even if it's not really unsafe, it feels BAD to see it listed as critical 😬 It's like a todo item you can't check 😱