Eugleo / magic-racket

The best coding experience for Racket in VS Code
https://marketplace.visualstudio.com/items?itemName=evzen-wybitul.magic-racket
GNU General Public License v3.0
202 stars 28 forks source link

vulnerability warnings and build version wrong #52

Closed dalev closed 3 years ago

dalev commented 3 years ago

I was going to poke at the stack trace I reported in #18, so I tried setting up a build according to the instructions in CONTRIBUTING.md. Using nodejs-lts 14.7.6, I obtain some concering output from npm install (see below). Aside from the vulnerability warnings (!), it shows magic-racket at version 0.5.5, whereas what's available in the marketplace is labeled 0.5.7. And this repo has no tags / branches to corresponding to releases.

Does the 0.5.7 released extension actually correspond to the code in the repo? Do you have local commits that were never pushed?

Further, npm warns about an incompatibility with the version of package-lock.json. Do you build/release this package with nodejs-lts or using a bleeding edge version? (The lts version seems more appropriate since that's what's running inside VSCode itself (see the Help->About dialog in vscode).)

npm WARN read-shrinkwrap This version of npm is compatible with lockfileVersion@1, but package-lock.json was generated for lockfileVersion@2. I'll try to do my best with it!
npm WARN magic-racket@0.5.5 No license field.
npm WARN optional SKIPPING OPTIONAL DEPENDENCY: fsevents@2.1.3 (node_modules\fsevents):
npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for fsevents@2.1.3: wanted {"os":"darwin","arch":"any"} (current: {"os":"win32","arch":"x64"})

added 297 packages from 201 contributors and audited 300 packages in 10.058s

33 packages are looking for funding
  run `npm fund` for details

found 15 vulnerabilities (6 moderate, 9 high)
  run `npm audit fix` to fix them, or `npm audit` for details
Eugleo commented 3 years ago

Hey, good points, will look into this later today. There shouldn't be any local nonpushed changes, but I did some manual version changing throughout the development, and maybe caused some problems along the way.

dalev commented 3 years ago

Thanks for the quick turnaround! Fwiw, I have not been able to reproduce issue #18 since updating to 0.5.8.