search

Worie / btt

Low level MacOS management in JavaScript via BetterTouchTool
MIT License
115 stars 7 forks source link

Update dependencies to not use deprecated packages #76

Open hendrix04 opened 1 month ago

hendrix04 commented 1 month ago

I just did an npm install on this and there are a lot of high vulnerabilities and deprecated packages that this relies on...

npm WARN deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful. npm WARN deprecated rimraf@2.7.1: Rimraf versions prior to v4 are no longer supported npm WARN deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported npm WARN deprecated fs-write-stream-atomic@1.0.10: This package is no longer supported. npm WARN deprecated copy-concurrently@1.0.5: This package is no longer supported. npm WARN deprecated move-concurrently@1.0.1: This package is no longer supported. npm WARN deprecated figgy-pudding@3.5.2: This module is no longer supported. npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated npm WARN deprecated source-map-url@0.4.1: See https://github.com/lydell/source-map-url#deprecated npm WARN deprecated source-map-resolve@0.5.3: See https://github.com/lydell/source-map-resolve#deprecated npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details. npm WARN deprecated fsevents@1.2.13: The v1 package contains DANGEROUS / INSECURE binaries. Upgrade to safe fsevents v2 npm WARN deprecated chokidar@2.1.8: Chokidar 2 does not receive security updates since 2019. Upgrade to chokidar 3 with 15x fewer dependencies

Worie commented 1 month ago

Yes, this package could overall be split into smaller chunks and made dependency free, especially that we now built in support for fetch in node. PRs are welcome but I think with recent BTT releases the need for this package has decreased significally.

hendrix04 commented 1 month ago

I am not sure that I understand what all this package does to try and go about refactoring it. That said, I just spent (probably way too long) going through the package-lock.json and it looks like a lot of these outdated dependencies are due to Vue and webpack so at least the core package isn't the one with all of the bad dependencies ;)

I never realized that an "npm install" would also install dev dependencies. That seems like a waste of space and data transfer.

Worie commented 1 month ago

If you're looking to install non-dev dependencies, npm ci is probably the one you're looking for. For installing a package from npm repository, dev dependencies shouldn't be pulled in, unless you actually npm install within a directory with a package json

hendrix04 commented 1 month ago

@Worie, I am seeing what you mean by updates to BTT making a lot of the functionality in this package obsolete...

I would argue though that it only really makes the frontend portion of this obsolete as no real backend SDK has been published.

How would you feel about removing the front end portion of the codebase?