Conversation
Mainly, this Marak/colors.js#285 Latest version has been compromised. A former maintainer, @DABH, has released this alternative 1.4.0 version
|
We should pin it. See also Marak/colors.js#285 (comment) for some easy workarounds in your projects. |
Both are valid, according to [this comment]8Marak/colors.js#285 (comment)) by @DABH. However, in that same comment they're committing to keep upgrading so it might be a better option. Anyway, your call, and all my support for anything you decide. |
But this will not fix the current releases of cli-table3. If you can provide a PR to pin the version, we can merge this and make a new release. But previous releases will still be affected. That's why we will have to document And we should wait until next week / Monday to see which route to go with the package in general. Best would be an org, which takes over the maintenance of |
That's generally a better option to pin it to |
Please bear in mind that, since this points to the old repo that's still compromised, it's not impossible to re-tag a new commit. So I think it's a good compromise solution, but probably not the best going forward. But then, that's the bread and butter of development, isn't it?
|
@Turbo87 hi, can you merge and prepare / push a new release, when you find some time? That would be great. |
|
@DanielRuf currently a bit busy here. I've invited you to the org and added you on npm. feel free to merge and release :) |
Thanks, I have accepted the invitation.
Hm, seems I need a few more rights. |
|
As I still need write access to the repo I did this:
You can see the changes also at https://diff.intrinsic.com/cli-table3/0.6.0/0.6.1 Pushing the changes to the fork in a few minutes. |
|
@JJ did you check / enable the checkbox in you PR to allow changes by us? Because I get this on "git push":
|
Do you still need this? I might have not. Anyway, I guess you'll make any changes afterwards. Thanks! |
Thanks, it is not needed anymore. Thanks for your contribution and help with this. |
…onal) colors.js cli-table3 pins its (optional) dependency on colors.js to 1.4.0; While Serenity/JS doesn't use colors.js, older versions of NPM will install this optional dependency by default. This change to Serenity/JS dependencies ensures that even if the optional dependency of cli-table3 gets installed, the user gets a safe version. For details see: cli-table/cli-table3#251 Marak/colors.js#285 Marak/colors.js#285 (comment)
3 participants
Mainly, this Marak/colors.js#285 Latest version has been compromised. A former maintainer, @DABH, has released this alternative 1.4.0 version.
Alternatively, it could simply be eliminated, since it's optional.