[cli] upgrade update-notifier to fix vulnerability
#8038
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
alex-grover
requested review from
TooTallNate,
EndangeredMassa and
styfle
as code owners
styfle
reviewed
Jun 29, 2022
There was a problem hiding this comment.
This version switched to ESM so we'll need to update TS as well so we can use await import() from CJS
I'm starting to wonder if it makes more sense to drop update-notifier since its quite large from something that should be a single fetch.
|
@styfle got it, thanks for the pointers! happy to take a stab at upgrading TS, let me know how you'd like to proceed. |
|
closing in favor of #8090 |
cb1kenobi
added a commit
that referenced
this pull request
Dec 1, 2022
This PR replaces the `update-notifier` dependency with a custom implementation. There are a few reasons: the dependency is quite large, it requires ESM in order to update, and can sometimes suggest an update to an older version. For example:  - Related to #8038 Co-authored-by: Chris Barber <chris.barber@vercel.com> Co-authored-by: Chris Barber <chris@cb1inc.com> Co-authored-by: Sean Massa <EndangeredMassa@gmail.com> Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Upgrade
update-notifierfor security vulnerability fixed in yeoman/update-notifier#222. An older version is included viaavabut I didn't touch it since that's a dev dep.The unit tests pass but seem to modify the fixture file so I included that as well.
Tests
yarn test-unitCode Review