Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Stop requiring eslint as a production dependency #15

Merged
merged 1 commit into from Jun 25, 2020
Merged

Stop requiring eslint as a production dependency #15

merged 1 commit into from Jun 25, 2020

Conversation

s100
Copy link
Contributor

@s100 s100 commented Jun 25, 2020

It appears that logdna-bunyan does not use eslint at run time, only for linting at development time, so this PR removes that dependency.

This PR is motivated by a prototype pollution vulnerability in lodash, which eslint has a dependency on, and which lodash's maintainers seem not to be acting on. By eliminating eslint as a production dependency, we eliminate the transitive dependency on lodash.

@smusali smusali self-requested a review June 25, 2020 17:07
@smusali smusali self-assigned this Jun 25, 2020
@smusali smusali added bug Something isn't working enhancement New feature or request labels Jun 25, 2020
smusali
smusali approved these changes Jun 25, 2020
View reviewed changes
Copy link
Contributor

@smusali smusali left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for reporting this, @s100! I will update the package and let you know!

@smusali smusali merged commit 6854142 into logdna:master Jun 25, 2020
@smusali smusali mentioned this pull request Jun 25, 2020
Merged
@smusali
Copy link
Contributor

smusali commented Jun 25, 2020

@s100, we have just released the newest patch version including this change. Thanks again for reporting and fixing this!

@s100 s100 deleted the patch-1 branch June 26, 2020 08:31
@s100
Copy link
Contributor Author

s100 commented Jun 26, 2020

Thank you for acting promptly!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@smusali smusali smusali approved these changes

Assignees

@smusali smusali

Labels
bug Something isn't working enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@s100 @smusali