You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
As mentioned here, the meow dependency has a transitive dependency vulnerability. It's also gone through a number of breaking changes -- most notably it is now incompatible with CommonJS. It also now requires NodeJS 12+.
We could choose to rewrite the CLI using ESM instead of CommonJS, but the NodeJS system requirement would still be a breaking change (and a largely unnecessary one at that). We could alternatively choose to replace meow with another CLI helper library.
The text was updated successfully, but these errors were encountered:
What actually is the currently targetted minimum NodeJS version? The project manifest doesn't specify anything. 🤔
My vote would go towards upgrading the codebase to use ES Modules and providing backwards compatibility to the API for older node version by including a transpiled CommonJS version of the package, creating in a prepublish step. I'm not sure how we could go about providing both an ESM and CJS "binary", but I'd say that with v12 being the oldest LTS NodeJS, we can generally expect developers to be using at least v12 on the CLI.
I'm in favor of upgrading as:
it future proofs the code (in particular with respect to dependencies switching to ESM),
@ericcornelissen Sorry about the slow response. I have been without a computer for a bit.
That plan sounds good to me. I would generally prefer not dropping support for a previously supported Node version (with "supported" meaning "works", since it's all been a bit non explicit), but if we're going to explicitly state a minimum supported version (which I agree we should) then we might as well use the opportunity to align it with e.g. the LTS schedule. I'm fine with bumping to v12. Converting to ES modules would definitely also be an upgrade.
As mentioned here, the
meow
dependency has a transitive dependency vulnerability. It's also gone through a number of breaking changes -- most notably it is now incompatible with CommonJS. It also now requires NodeJS 12+.We could choose to rewrite the CLI using ESM instead of CommonJS, but the NodeJS system requirement would still be a breaking change (and a largely unnecessary one at that). We could alternatively choose to replace
meow
with another CLI helper library.The text was updated successfully, but these errors were encountered: