Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade dependent packages to latest version #101

Merged
merged 2 commits into from
Nov 29, 2018
Merged

Conversation

yhatt
Copy link
Member

@yhatt yhatt commented Nov 29, 2018

This PR will upgrade dependent packages to latest version by using yarn upgrade(-interactive) --latest.

About security

Have you heard about a recent malicious dependency? The update of nodemon in this PR is beating a deep dependency completely.

npm has published a post about detail of the event-stream incident. Marpit and our packages managed by marp-team have already handled the incident in early (#96: last Sunday).

Next action

To manage packages securely, we're going to run yarn audit when running CI or publishing to npm.

@yhatt
Copy link
Member Author

yhatt commented Nov 29, 2018

CI build was failed by updating deep dep by yarn upgrade --latest.

$ stylelint "./**/*.{css,scss}"
internal/modules/cjs/loader.js:582
    throw err;
    ^

Error: Cannot find module 'ajv/lib/compile/equal'
    at Function.Module._resolveFilename (internal/modules/cjs/loader.js:580:15)
    at Function.Module._load (internal/modules/cjs/loader.js:506:25)
    at Module.require (internal/modules/cjs/loader.js:636:17)
    at require (internal/modules/cjs/helpers.js:20:18)
    at Object.<anonymous> (/home/circleci/marp-core/node_modules/table/dist/validateConfig.js:2:13)
    at Module._compile (internal/modules/cjs/loader.js:688:30)
    at Object.Module._extensions..js (internal/modules/cjs/loader.js:699:10)
    at Module.load (internal/modules/cjs/loader.js:598:32)
    at tryModuleLoad (internal/modules/cjs/loader.js:537:12)
    at Function.Module._load (internal/modules/cjs/loader.js:529:3)
error Command failed with exit code 1.
info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.
Exited with code 1

I guess that is caused by minor update of ajv v6.6.0. Similar issues have reported in the other OSS. (e.g. next.js)

@@ -97,5 +97,8 @@
},
"publishConfig": {
"access": "public"
},
"resolutions": {
"ajv": "~6.5"
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's a workaround for stylelint and ESLint to prevent error caused by the refactor in ajv.

@marp-team/[email protected]
├─┬ [email protected]
│ ├── [email protected]
│ └─┬ [email protected]
│   └── [email protected]  deduped
└─┬ [email protected]
  └── [email protected]  deduped

@yhatt yhatt merged commit 01171e4 into master Nov 29, 2018
@yhatt yhatt deleted the update-dependencies branch November 29, 2018 08:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant