fix(esbuild): update peerDep range#30402
Merged
FrozenPandaz merged 2 commits intonrwl:masterfrom May 14, 2025
hendrickson-tyler:master
Merged
fix(esbuild): update peerDep range#30402FrozenPandaz merged 2 commits intonrwl:masterfrom hendrickson-tyler:master
FrozenPandaz merged 2 commits intonrwl:masterfrom
hendrickson-tyler:master
Conversation
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
|
Hi @FrozenPandaz, can we get a review on this please? Thanks! |
|
A review would be much appreciated - the security advisory has been out for over 3 months now. |
FrozenPandaz
approved these changes
May 14, 2025
Contributor
|
Thank you for your contribution! LGTM 🎉 |
Contributor
|
View your CI Pipeline Execution ↗ for commit 2048198.
☁️ Nx Cloud last updated this comment at |
FrozenPandaz
pushed a commit
that referenced
this pull request
May 16, 2025
## Current Behavior `esbuild` has a [security advisory](GHSA-67mh-4wv8-2f99) for versions older than 0.25.0. `@nx/esbuild` does not allow versions greater than 0.19.2 due to the range specified in peer dependencies. A fix for this was attempted in #30167, but it still does not allow any versions greater than 0.19.x due to the way [0.x.x releases are handled](https://github.com/npm/node-semver#caret-ranges-123-025-004). ## Expected Behavior `@nx/esbuild` allows any version from the current 0.19.2 onwards, not including a future 1.x.x version. This will allow non-vulnerable versions of `esbuild` to be used. ## Related Issue(s) Fixes #30009 Fixes #30370 (cherry picked from commit 21bdb35)
FrozenPandaz
pushed a commit
that referenced
this pull request
May 16, 2025
## Current Behavior `esbuild` has a [security advisory](GHSA-67mh-4wv8-2f99) for versions older than 0.25.0. `@nx/esbuild` does not allow versions greater than 0.19.2 due to the range specified in peer dependencies. A fix for this was attempted in #30167, but it still does not allow any versions greater than 0.19.x due to the way [0.x.x releases are handled](https://github.com/npm/node-semver#caret-ranges-123-025-004). ## Expected Behavior `@nx/esbuild` allows any version from the current 0.19.2 onwards, not including a future 1.x.x version. This will allow non-vulnerable versions of `esbuild` to be used. ## Related Issue(s) Fixes #30009 Fixes #30370 (cherry picked from commit 21bdb35)
Contributor
|
This pull request has already been merged/closed. If you experience issues related to these changes, please open a new issue referencing this pull request. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Current Behavior
esbuildhas a security advisory for versions older than 0.25.0.@nx/esbuilddoes not allow versions greater than 0.19.2 due to the range specified in peer dependencies.A fix for this was attempted in #30167, but it still does not allow any versions greater than 0.19.x due to the way 0.x.x releases are handled.
Expected Behavior
@nx/esbuildallows any version from the current 0.19.2 onwards, not including a future 1.x.x version. This will allow non-vulnerable versions ofesbuildto be used.Related Issue(s)
Fixes #30009
Fixes #30370