Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update dependencies to not use deprecated packages #76

Open
hendrix04 opened this issue Jul 12, 2024 · 4 comments
Open

Update dependencies to not use deprecated packages #76

hendrix04 opened this issue Jul 12, 2024 · 4 comments

Comments

@hendrix04
Copy link

I just did an npm install on this and there are a lot of high vulnerabilities and deprecated packages that this relies on...

npm WARN deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm WARN deprecated rimraf@2.7.1: Rimraf versions prior to v4 are no longer supported
npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported
npm WARN deprecated fs-write-stream-atomic@1.0.10: This package is no longer supported.
npm WARN deprecated copy-concurrently@1.0.5: This package is no longer supported.
npm WARN deprecated move-concurrently@1.0.1: This package is no longer supported.
npm WARN deprecated figgy-pudding@3.5.2: This module is no longer supported.
npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated
npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated
npm WARN deprecated source-map-url@0.4.1: See https://github.com/lydell/source-map-url#deprecated
npm WARN deprecated source-map-resolve@0.5.3: See https://github.com/lydell/source-map-resolve#deprecated
npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
npm WARN deprecated fsevents@1.2.13: The v1 package contains DANGEROUS / INSECURE binaries. Upgrade to safe fsevents v2
npm WARN deprecated chokidar@2.1.8: Chokidar 2 does not receive security updates since 2019. Upgrade to chokidar 3 with 15x fewer dependencies

@Worie
Copy link
Owner

Worie commented Jul 12, 2024

Yes, this package could overall be split into smaller chunks and made dependency free, especially that we now built in support for fetch in node. PRs are welcome but I think with recent BTT releases the need for this package has decreased significally.

@hendrix04
Copy link
Author

I am not sure that I understand what all this package does to try and go about refactoring it. That said, I just spent (probably way too long) going through the package-lock.json and it looks like a lot of these outdated dependencies are due to Vue and webpack so at least the core package isn't the one with all of the bad dependencies ;)

I never realized that an "npm install" would also install dev dependencies. That seems like a waste of space and data transfer.

@Worie
Copy link
Owner

Worie commented Jul 12, 2024

If you're looking to install non-dev dependencies, npm ci is probably the one you're looking for. For installing a package from npm repository, dev dependencies shouldn't be pulled in, unless you actually npm install within a directory with a package json

@hendrix04
Copy link
Author

@Worie, I am seeing what you mean by updates to BTT making a lot of the functionality in this package obsolete...

I would argue though that it only really makes the frontend portion of this obsolete as no real backend SDK has been published.

How would you feel about removing the front end portion of the codebase?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants