Move CLI to its own package

[sosoba]

Json5 module has a hard dependecy on minimist package which is necessary only when you run a CLI for converting JSON5 to JSON and for validating the syntax of JSON5 documents.
I sugest to change it to "optionalDependencies".

[jordanbtucker]

Good point. But that means that users would need to globally install minimist to use the JSON5 CLI. I think a better option is to decouple the library from the CLI.

[cyrilletuzi]

Hi @jordanbtucker, thanks for this lib!

Is there any news about this issue? json5 is widely used now, many tools must parse json5 config files, and this issue can be blocking in many situations. As it is a production dependency for projects, it should be autonomous.

[jordanbtucker]

@cyrilletuzi Thanks for your interest. This is a breaking change, and I haven't had time to finalize a v3 for JSON5. Can you explain why the dependence on minimist is blocking?

[cyrilletuzi]

@jordanbtucker Thanks for your answer. If json5 was used as a devDependencies it would be OK, but as it is used as a production dependencies, there is 2 reasons why having subdependencies is an issue:

• performance: in a classic JavaScript project, dependencies used by multiple other dependencies can be mutualized by npm; but some tools, like VS Code extensions, need to bundle their whole code, including dependencies (and their own subdependencies): so including a new dependency means it will be included in the build.
• security: given what does minimist, it is a library highly subject to security issues, and one happened recently. VS Code extensions have a wide access to the system (files, etc.) so security issues are taken seriously, and it happens that VS Code blocks all extensions using a dependency if a security issue is discovered. And given that the extension is critical for me (I use it in courses I teach), I cannot take the risk that it could be suspended at any moment.

[jordanbtucker]

@cyrilletuzi Thanks for bringing these valid concerns to my attention. I'll see if I can devote some time to a v3 release soon.

[Jason3S]

It doesn't need to be a breaking change.

By creating a new package: json5-lib that is used by json5, it is possible.

Everyone who wants to use the json5 as a library can move to json5-lib. json5 can continue to export all the json5-lib functionality so as to not break anyone that is currently using it as a library.

[Successahead]

Okay