fix(core): use zkochan/js-yaml directly to avoid false audit errors #25999
Conversation
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
☁️ Nx Cloud ReportCI is running/has finished running commands for commit 7e0cb93. As they complete they will appear below. Click to see the status, the terminal output, and the build insights. 📂 See all runs for this CI Pipeline Execution ✅ Successfully ran 6 targets
Sent with 💌 from NxCloud. |
| @@ -31,7 +31,7 @@ | |||
| "generators": "./generators.json", | |||
| "executors": "./executors.json", | |||
| "peerDependencies": { | |||
| "js-yaml": "npm:@zkochan/js-yaml@0.0.7" | |||
| "@zkochan/js-yaml": "0.0.7" | |||
There was a problem hiding this comment.
@meeroslav Is the peerDependency needed? The nx package also depends on @zkochan/js-yaml so we can move it to the dependencies
There was a problem hiding this comment.
True, but it doesn't change the requirement need for this one. The eslint package only needs js-yaml if user needs to migrate yaml-based config to flat config.
There was a problem hiding this comment.
But it would eliminate the user confusion why the @zochkan/js-yaml package has to be installed instead of js-yaml. And it would allow existing usage to function without changes...
There was a problem hiding this comment.
The only things we could do is make eslint depend on js-yaml since it has no need for Zoltan's overrides as it uses plain load and dump. But the entire usage might be completely removed once code mods from eslint's team land.
On top of that we generally don't have support for yaml configs, so the chance of someone using converter to convert yaml rc to flat config are almost zero.
If there is an issue created later on we can address it.
…25999) Some of the audit tools have been falsely flagging the alias to `@zkochan/js-yaml` as `[email protected]` (which has security holes) so we decided to use the package explicitly. <!-- This is the behavior we have today --> <!-- This is the behavior we should expect with the changes in this PR --> <!-- Please link the issue being fixed so it gets closed when this is merged. --> Fixes # (cherry picked from commit 61e4ab2)
|
This pull request has already been merged/closed. If you experience issues related to these changes, please open a new issue referencing this pull request. |
Some of the audit tools have been falsely flagging the alias to
@zkochan/js-yamlas[email protected](which has security holes) so we decided to use the package explicitly.Current Behavior
Expected Behavior
Related Issue(s)
Fixes #