Repository navigation
Conversation
npm warns that glob 11 is unsupported and carries publicized vulnerabilities. glob 13 keeps the promise API the CLI and benchmark use. The engines field now matches what the dependency supports (18, 20 or 22+); glob 11 already required Node 20, so no supported version is lost.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
npm install qualitymax-grader@0.2.0prints a deprecation warning: glob 11 is unsupported upstream and the maintainer points at publicized vulnerabilities fixed in current versions. This bumpsglobto^13.0.6, which keeps the promiseglob(pattern, { nodir: true })API used by the CLI and the benchmark script.The
enginesfield now states what the dependency supports: Node 18, 20 or 22 and newer. glob 11 already required Node 20, so the old>=16was never accurate and no supported version is lost.Version 0.2.1. Publishing to npm is a separate step after merge.
Validation
npm ls --omit=dev --all) is glob 13 with minimatch, minipass and path-scurry only; no deprecated package. The deprecation notices still printed bynpm ci(inflight, glob 7 and 10) come from Jest's dev-only tree and do not reach consumers of the published package.npm test: 89 passed, 6 suites.node bin/qualitymax-grader.js 'examples/**/*.js' --format jsongrades the example specs as before.