Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

build(deps): align cliui version to the version yargs uses internally #350

Merged
merged 4 commits into from
Dec 20, 2023

Conversation

csantos1113
Copy link
Contributor

@csantos1113 csantos1113 commented Dec 19, 2023

  • this package already uses yargs@16.2.0,
  • yargs@16.2.0 uses cliui@7.0.2
  • so we should align the cliui versions so only one gets installed as transient dependency
image

so there should be no impact to consumers

Copy link
Collaborator

@ljharb ljharb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

package.json Outdated Show resolved Hide resolved
@csantos1113 csantos1113 changed the title breaking: drop Node 10 to release CVE-2021-3807 patch build(deps): align cliui version to the version yargs uses internally Dec 20, 2023
@csantos1113 csantos1113 requested a review from ljharb December 20, 2023 00:49
@csantos1113
Copy link
Contributor Author

csantos1113 commented Dec 20, 2023

after reading CVE-2021-3807 more carefully I see the current cliui uses a safe version of strip-ansi

image

so this PR isn't reaaally needed for my original intention.

BUT, I think this PR is still valid, so its dependencies are aligned, otherwise users of this package are installing two versions of cliui:

  • cliui@3.2.0 directly
  • and cliui@7.2.0 indirectly (via transient dependencies from yargs)

@ljharb
Copy link
Collaborator

ljharb commented Dec 20, 2023

Sounds good - I’ll merge this tonight, thanks.

ljharb and others added 3 commits December 19, 2023 21:10
Copy link
Collaborator

@ljharb ljharb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

bundled in a few other commits i had sitting unmerged also

@codecov-commenter
Copy link

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (4fc0815) 100.00% compared to head (096427b) 100.00%.

❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files
@@            Coverage Diff            @@
##            master      #350   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            9         9           
  Lines          185       185           
=========================================
  Hits           185       185           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@ljharb ljharb merged commit 096427b into sarbbottam:master Dec 20, 2023
28 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants