Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove unnecessary dependencies #190

Merged
merged 1 commit into from
Oct 27, 2024

Conversation

timmorey
Copy link
Contributor

@timmorey timmorey commented Sep 19, 2023

We've been getting misleading security reports about vulnerabilities in our dependency chain under this package, but it doesn't look like those things actually need to be dependencies. In particular, the npm dependency pulls in a version of semver vulnerable to https://nvd.nist.gov/vuln/detail/CVE-2022-25883.

While I don't believe this package really exposes our users to that vulnerability, I'd rather clean up the package than argue with our security team. This should also marginally improve install speed and reduce bloat where this package is used.

These dependencies were added with #169, and @ungap/structured-clone is a legitimate dependency. The @types package just needs to be listed as a dev dependency to get its goodness. I wasn't actually able to find any indication that the i package is in use, but would be happy to add it back in if there is need.

Comment on lines -76 to -77
"i": "^0.3.7",
"npm": "^8.7.0"
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have a hypothesis about how the npm and i deps may have been introduced:

  1. Developer has intent to install new packages @ungap/structured-clone and @types/ungap__structured-clone
  2. Developer starts typing into the terminal npm i to follow through on their intent
  3. Developer gets interrupted or distracted
  4. Developer later picks up where they left off and enters npm i @ungap/structured-clone @types/ungap__structured-clone --save into the terminal and hits Enter, forgetting that npm i was already entered. The full command npm i npm i @ungap/structured-clone @types/ungap__structured-clone --save gets executed.

@timmorey
Copy link
Contributor Author

timmorey commented Sep 21, 2023

@snewcomer any chance this could get a review and release? Preferably with a patch version bump only (1.3.5), so this can slide into our transitive dependencies without having to update references in consuming packages.

@SergeAstapov SergeAstapov added the bug Something isn't working label Oct 27, 2024
@SergeAstapov SergeAstapov self-requested a review October 27, 2024 02:19
@SergeAstapov SergeAstapov merged commit 0739872 into adopted-ember-addons:main Oct 27, 2024
@github-actions github-actions bot mentioned this pull request Oct 31, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants