digitalbazaar / http-client

An opinionated, isomorphic HTTP client.

BSD 3-Clause "New" or "Revised" License

2 stars 7 forks source link

Update dependencies. #32

Closed davidlehn closed 1 year ago

davidlehn commented 1 year ago

Addresses https://github.com/digitalbazaar/http-client/issues/31 to fix a security concern.
After updating dependencies, it wanted to use import assertion in the rollup config. If we're only building with Node.js 16+ then this could work. If not, that file needs to be refactored somehow. eslint does not yet support that syntax, so it will need to not check that file or use some other fix.
ky@0.32 (https://github.com/sindresorhus/ky/releases) changed behavior for an empty response body when using .json() to return an empty string instead of throwing. This is likely breaking behavior. If not, this could be a minor version bump instead.

codecov-commenter commented 1 year ago

Codecov Report

Merging #32 (fdf32f0) into main (1d86e50) will increase coverage by 1.99%. The diff coverage is 100.00%.

@@            Coverage Diff             @@
##             main      #32      +/-   ##
==========================================
+ Coverage   82.87%   84.86%   +1.99%     
==========================================
  Files           3        3              
  Lines         216      218       +2     
==========================================
+ Hits          179      185       +6     
+ Misses         37       33       -4

Impacted Files	Coverage Δ
lib/index.js	`100.00% <100.00%> (ø)`
lib/agentCompatibility.js	`56.60% <0.00%> (+7.54%)`	:arrow_up:

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

davidlehn commented 1 year ago

The tests were "fixed" by not linting the rollup config, using 18.x for install/build step to allow rollup to run, and then testing on 14-18. The CJS file is distributed so I think this is ok? Or maybe we should just avoid the import assertion, I'm not sure.
Please provide feedback on the major/minor issue. Testing in other projects that might trigger the empty body responses would be ideal.