Closed Mrtenz closed 5 months ago
New dependencies detected. Learn more about Socket for GitHub ↗︎
Package | New capabilities | Transitives | Size | Publisher |
---|---|---|---|---|
npm/@yarnpkg/types@4.0.0 | None | +1 |
92.8 kB | yarnbot |
npm/tslib@2.6.2 | None | 0 |
84 kB | typescript-bot |
👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎
This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.
Using these constraints requires bumping Yarn to v4, and using a minimum Node.js version of 18.12.0. The Node.js version bump is a .nvmrc only bump, so this shouldn't be a breaking change.
Unfortunately this causes CI to fail, so it looks like we may want to drop support for Node.js 16 (EOL) anyway.
I've replaced the Prolog-based constraints (deprecated in Yarn v4) with JavaScript-based constraints. This has the benefit that the constraints file is much more readable, especially for those who are not well-versed in Prolog. As an added benefit, the error messages produced by Yarn are more readable too.
The new constraints file implements all the Prolog-based constraints, and some extras. For example, we can now verify that the
README.md
does not contain the template instructions (if the current repository is not the module template), and that the.nvmrc
version matches with the Node.js version mentioned in theREADME.md
. Since the new constraints file has access to all Node.js APIs (includingfs
), we have much more flexibility in the kinds of constraints.Using these constraints requires bumping Yarn to v4, and using a minimum Node.js version of 18.12.0. The Node.js version bump is a
.nvmrc
only bump, so this shouldn't be a breaking change.Blocked by
221