elm / compiler

Compiler for Elm, a functional language for reliable webapps.
https://elm-lang.org/
BSD 3-Clause "New" or "Revised" License
7.48k stars 658 forks source link

npm installer: Download elm package without deprecated libraries. #2307

Closed mather closed 10 months ago

mather commented 10 months ago

Quick Summary: request is deprecated, and vulnerabilities have been reported in its dependency libraries. I replaced download feature using following libraries:

Ref: https://github.com/elm/compiler/commit/41ec49ed921a2409afda483eb9e29197e262fe27

Thought: axios also depends on the same libraries (follow-redirects, proxy-from-env), but there is no need to use Promise-based features. To improve maintainability, I believe that we should adopt libraries with simple enough functions to meet our needs,rather than relying on a library with many additional functions.

github-actions[bot] commented 10 months ago

Thanks for suggesting these code changes. To set expectations:

Finally, please be patient with the core team. They are trying their best with limited resources.

mather commented 10 months ago

I want to review the behavior of proxy and organize the commits, so I close PR.