Skip to content

chore(commonjs)!: bump glob's version#1695

Merged
shellscape merged 2 commits intorollup:masterfrom
younggglcy:fix/1691
Jun 5, 2024
Merged

chore(commonjs)!: bump glob's version#1695
shellscape merged 2 commits intorollup:masterfrom
younggglcy:fix/1691

Conversation

@younggglcy
Copy link
Copy Markdown
Contributor

@younggglcy younggglcy commented Mar 17, 2024 •
edited
Loading

Rollup Plugin Name: @rollup/plugin-commonjs

This PR contains:

  • bugfix
  • feature
  • refactor
  • documentation
  • other

Are tests included?

  • yes (bugfixes and features will not be merged without tests)
  • no

Breaking Changes?

  • yes (breaking changes will not be merged unless absolutely necessary)
  • no

If yes, then include "BREAKING CHANGES:" in the first commit message body, followed by a description of what is breaking.

List any relevant issue numbers: resolves #1691

Description

BREAKING CHANGES: Requires Node.js version >=16.0.0 or >= 14.17, this is the same as glob's need.

both glob and shx have inflight in their deps, so this PR bumps glob to the latest and removes shx, since it's not been used.

@younggglcy younggglcy requested a review from shellscape as a code owner March 17, 2024 12:08
@akashennn
Copy link
Copy Markdown

akashennn commented Apr 5, 2024

Hi any update on this? There is a vulnerability introduced thought this

lukastaegert
lukastaegert requested changes Apr 5, 2024
View reviewed changes
Copy link
Copy Markdown
Member

@lukastaegert lukastaegert left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It seems this update is breaking tests that rely on glob, so we need to figure out what the breaking changes were.

@mehdibo
Copy link
Copy Markdown

mehdibo commented May 27, 2024

Hello, any updates on this? or is there a workaround
Facing this issue:

warning nuxt > nitropack > @rollup/plugin-commonjs > glob > inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.91

@younggglcy
Copy link
Copy Markdown
Contributor Author

younggglcy commented May 27, 2024

CI tests failed due to wrong order returned by glob.sync() here.
That's because, since glob v9, results will not be sorted.
FYI: isaacs/node-glob#576

@younggglcy younggglcy requested a review from lukastaegert May 27, 2024 13:38
@shellscape
Copy link
Copy Markdown
Collaborator

shellscape commented Jun 5, 2024

@younggglcy I think this is good to merge, but please rebase/merge from master again. CI isn't happy.

younggglcy added 2 commits June 5, 2024 12:40
@younggglcy
chore: bump glob's version
42971b2 
BREAKING CHANGES: Requires Node.js version >=16.0.0 or >= 14.17
@younggglcy
fix: let glob match alphabetical order
77ec8ee
@younggglcy
Copy link
Copy Markdown
Contributor Author

younggglcy commented Jun 5, 2024

@younggglcy I think this is good to merge, but please rebase/merge from master again. CI isn't happy.

fixed.

@shellscape shellscape changed the title chore(commonjs): bump glob's version chore(commonjs)!: bump glob's version Jun 5, 2024
@shellscape shellscape merged commit 2447548 into rollup:master Jun 5, 2024
@shellscape shellscape mentioned this pull request Jun 5, 2024
Closed
younggglcy added a commit to younggglcy/plugins that referenced this pull request Jun 6, 2024
@younggglcy
chore(commonjs)!: bump glob's version (rollup#1695)
766cf2c 
* chore: bump glob's version

BREAKING CHANGES: Requires Node.js version >=16.0.0 or >= 14.17

* fix: let glob match alphabetical order
@tbouffard tbouffard mentioned this pull request Jun 10, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@shellscape shellscape Awaiting requested review from shellscape shellscape is a code owner

@lukastaegert lukastaegert Awaiting requested review from lukastaegert

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[@rollup/plugin-commonjs]: vulnerability in inflight

5 participants

@younggglcy @akashennn @mehdibo @shellscape @lukastaegert