Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Renamed private packages to avoid ambiguity with existing official packages. This should mitigate false positives during image scans. #424

Conversation

Fallibilist
Copy link
Contributor

This PR addresses the issue raised here: #423

This change was pretty minor but I did have a couple of questions:

  • Would you prefer if I changed the path for these dependencies as well? I decided against it because it might be a breaking change but I can update the PR with that if you'd like.
  • I get a warning about the new package names due to the double forward slashes (/) failing the regex. It doesn't have an impact since these are private packages but I wasn't sure if you would rather I use a different naming convention. Something like "@hookform/resolvers.ajv" perhaps.
    image

…ckages. This should mitigate false positives during image scans.
@jorisre
Copy link
Member

jorisre commented Jul 1, 2022

I can't test right now but I'm not sure deep import like @hookform/resolvers/zod still work if we rename the package name

@bluebill1049
Copy link
Member

bluebill1049 commented Jul 6, 2022

I can't test right now but I'm not sure deep import like @hookform/resolvers/zod still work if we rename the package name

I see, that's a valid concern. @Fallibilist any chance you can validate this above?

@Fallibilist
Copy link
Contributor Author

Fallibilist commented Jul 8, 2022

I ran a few tests and this seems to be fine. It looks like the path in exports is all that matters (in this case ./zod).

Here is how I tested.
I created a simple testing project which imported @hookform/resolvers from a local directory. It imported zod and ran a simple schema validation.
image
image
image

This is successful.
image

Now if I rename the export "./zod" to "./zodbroken" it breaks
image
image

If I set the import to this value then it works again.
image

This was all conducted with the zod resolver's package name as "@hookform/resolvers/zod"

Here are those two files if you want to test yourself:

{
  "name": "export-test",
  "version": "1.0.0",
  "description": "",
  "main": "testExports.js",
  "type": "module",
  "scripts": {
    "start": "node testExports.js",
    "zod": "^3.11.6"
  },
  "dependencies": {
    "@hookform/resolvers": "./resolvers"
  }
}
import { zodResolver } from '@hookform/resolvers/zod';
import * as z from 'zod';

const schema = z.object({
  name: z.string().min(1, { message: 'Required' }),
  age: z.number().min(10),
});

console.log(await zodResolver(schema)({name: 'Name', age: 5}, {}, {}));

These docs seem to support my findings: https://webpack.js.org/guides/package-exports/

@jorisre
Copy link
Member

jorisre commented Jul 8, 2022

Thanks a ton for your contribution ! Looks good to me :)

@jorisre jorisre merged commit 18ae921 into react-hook-form:master Jul 8, 2022
@github-actions
Copy link
Contributor

github-actions bot commented Jul 8, 2022

🎉 This PR is included in version 2.9.5 🎉

The release is available on:

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants