Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Consider replacing meow dependency #34

Closed
birjj opened this issue Jun 12, 2021 · 2 comments
Closed

Consider replacing meow dependency #34

birjj opened this issue Jun 12, 2021 · 2 comments
Assignees
Labels
dependencies Pull requests that update a dependency file

Comments

@birjj
Copy link
Contributor

birjj commented Jun 12, 2021

As mentioned here, the meow dependency has a transitive dependency vulnerability. It's also gone through a number of breaking changes -- most notably it is now incompatible with CommonJS. It also now requires NodeJS 12+.

We could choose to rewrite the CLI using ESM instead of CommonJS, but the NodeJS system requirement would still be a breaking change (and a largely unnecessary one at that). We could alternatively choose to replace meow with another CLI helper library.

@ericcornelissen
Copy link
Contributor

What actually is the currently targetted minimum NodeJS version? The project manifest doesn't specify anything. 🤔

My vote would go towards upgrading the codebase to use ES Modules and providing backwards compatibility to the API for older node version by including a transpiled CommonJS version of the package, creating in a prepublish step. I'm not sure how we could go about providing both an ESM and CJS "binary", but I'd say that with v12 being the oldest LTS NodeJS, we can generally expect developers to be using at least v12 on the CLI.

I'm in favor of upgrading as:

  • it future proofs the code (in particular with respect to dependencies switching to ESM),
  • it simplifies resolving this issue (as well as Support ES Module configuration files #36 and possibly others in the future), and
  • backwards compatibility can be provided by transpiling the source code.

That being said, changing the CLI helper library shouldn't be too hard either. @birjolaxew, do you feel strongly that we should stick with CommonJS?

@birjj
Copy link
Contributor Author

birjj commented Jul 28, 2021

@ericcornelissen Sorry about the slow response. I have been without a computer for a bit.

That plan sounds good to me. I would generally prefer not dropping support for a previously supported Node version (with "supported" meaning "works", since it's all been a bit non explicit), but if we're going to explicitly state a minimum supported version (which I agree we should) then we might as well use the opportunity to align it with e.g. the LTS schedule. I'm fine with bumping to v12. Converting to ES modules would definitely also be an upgrade.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Development

No branches or pull requests

2 participants