Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: drop update notifier #706

Merged
merged 2 commits into from
Jul 4, 2022
Merged

fix: drop update notifier #706

merged 2 commits into from
Jul 4, 2022

Conversation

JustinBeckwith
Copy link
Collaborator

@JustinBeckwith JustinBeckwith commented Jul 1, 2022

Fixes #704 by just removing the update-notifier dependency all together. This was largely used to give users a message using gts from the CLI that they need to upgrade. Realistically, we expect most users to be using npx, or to have gts installed in the package.json and to use it from npm run scripts.

This is a no-win situation because:

  • update-notifier has a security vuln in the previous major version
  • The new version is ESM only
  • ESLint plugins don't work with ESM

I don't think this dependency was worth it.

@JustinBeckwith JustinBeckwith requested a review from bcoe July 1, 2022 20:02
@bcoe bcoe merged commit cab7704 into main Jul 4, 2022
@bcoe bcoe deleted the noupdatenot branch July 4, 2022 17:17
alexander-fenster pushed a commit that referenced this pull request Sep 6, 2022
Co-authored-by: Benjamin E. Coe <bencoe@google.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Upgrade update-notifier version for fixing CVE-2022-33987
2 participants