Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade acorn to v7.1.1 #338

Closed

Conversation

mulholo
Copy link

@mulholo mulholo commented Mar 9, 2020

Upgrades acorn and acorn-walk to 7.1.1 in order to avoid the NPM audit warning here: https://www.npmjs.com/advisories/1488.


Tests all pass fine but I am getting these warnings from npm if I update acorn and acorn-walk only.

npm WARN acorn-dynamic-import@4.0.0 requires a peer of acorn@^6.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN acorn-jsx@5.0.1 requires a peer of acorn@^6.0.0 but none is installed. You must install peer dependencies yourself.

acorn-jsx is relied upon by eslint. acorn-dynamic-import is relied upon by webpack.

For acorn-jsx, I wanted to upgrade eslint but all this does is remove the one npm WARN above and replace it with three others, including one from eslint-config-th0r and one from eslint-config-th0r-react which haven't been updated in a year and rely upon eslint v5.x.x. It seems out of scope to change these packages upstream.

I have not yet attempted to update webpack but that also feels excessive here.

What is webpack-bundle-analyzer's policy on having npm WARNs? Are they fine to have here? If not, do the maintainers have suggestions on how to work around the above warnings?

@jsf-clabot
Copy link

jsf-clabot commented Mar 9, 2020

CLA assistant check
All committers have signed the CLA.

@th0r
Copy link
Collaborator

th0r commented Mar 10, 2020

@mulholio those warnings are not good - packages expect another versions of acorn so we can't just ignore it.

@mulholo
Copy link
Author

mulholo commented Mar 10, 2020

@mulholio those warnings are not good - packages expect another versions of acorn so we can't just ignore it.

Would you be able to help in upgrading the lint rules package so that it expects a newer version of eslint?

@th0r
Copy link
Collaborator

th0r commented Mar 10, 2020

Actually, I don't see these unmet peer dependency warnings. Was able to update a few packages in #339 and get rid of vulnerability warnings completely. Thanks for the PR!

@th0r th0r closed this Mar 10, 2020
@mulholo mulholo deleted the mulholio-upgrade-acorn-7.1.1 branch March 10, 2020 12:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants