Dependency vulnerabilites / Lerna / cssnano

coopdigital / coop-frontend

Co-op CSS Foundations and design system mono-repo

MIT License

0 stars 0 forks source link

Dependency vulnerabilites / Lerna / cssnano #503

Open omidantilong opened 2 years ago

omidantilong commented 2 years ago

There are currently two unfixable vulnerabilities that Dependabot has reported:

Regular expression denial of service in glob-parent

This comes from Lerna. Lerna is unmaintained. It is not clear when or if it will be picked up again. See this thread for details: https://github.com/lerna/lerna/issues/2703

Inefficient Regular Expression Complexity in nth-check

I think this is coming from a combination of outdated cssnano version 4.x which pins itself to postcss 7.x We should try and upgrade to cssnano 5 in the first instance.

omidantilong commented 2 years ago

I have updated cssnano in the root to 5.x and had no issues with the build, however there are some things to validate:

Looks like cssnano now orders properties. This shouldn't cause any issues, unless there are some selectors with duplicate properties. That check could probably be automated.
It also orders selectors by specificity. This has more potential for disruption and will probably need some manual checks.

omidantilong commented 2 years ago

There is now Lerna-lite. Something to chew on https://github.com/ghiscoding/lerna-lite

philwolstenholme commented 2 years ago

@omidantilong this isn't an area I know much about but I've also heard people mention Rush (https://rushjs.io/pages/intro/welcome/) as a monorepos tool, it's backed by Microsoft.

There's also NX and Turborepo but I think they're more just for managing dependencies and concurrent builds/watches, and they don't have the publishing aspect that Lerna had/has.

omidantilong commented 2 years ago

Interesting! Will take a look at rush. Seems like there's a few options in this space now since people have cottoned onto Lerna being unmaintained. Thanks for the tip :)

I will find some time this week to test the cssnano changes properly.

omidantilong commented 1 year ago

You were correct Phil, we had a proper look at Nx and its more to do with managing workflows/pipelines inside monorepos, compared to Lerna which handles versioning and publishing :)

But! Things have progressed a fair bit in the last few months -- Nx have taken stewardship of Lerna, which is great to see. Based on this and the various patterns we've seen in IBM's Carbon repo, we think the most sensible option is going to be to stick with Lerna for the foreseeable future. Better the devil you know and all that.

There is a separate conversation to be had about the structure of the repo as a whole. I'll start a new thread for that.