search

get-alex / alex

Catch insensitive, inconsiderate writing
https://alexjs.com
MIT License
4.82k stars 207 forks source link

Update Ava to @next version #231

Closed MrBenJ closed 6 years ago

MrBenJ commented 6 years ago

I updated the npm dependency ava to the beta version of 1.0.0, per our discussion in #229

The tests all continue to pass without any additional changes. While I had to do some digging on the RegEx vulnerability, I found the root package causing it and submitted a PR to that package here: https://github.com/alessioalex/git-spawned-stream/pull/5

When that gets re-released, we can close this issue for good. I'll go ahead and update the Github issue and continue monitoring.

Thanks again for an awesome project to help contribute to :). I'm having quite a bit of fun and learning a lot from this project.

MrBenJ commented 6 years ago

Hey @wooorm

I was able to recreate the build error in travis by switching my node version to v6.14.4. It looks like the transforms in @babel require the ** operator, which isn't available until Node 7.

Your node/boron Image uses Node v6.14.1.

I already submitted a PR to get rid of the RegEx vulnerability issue in the package that's causing the issue, so if you'd like to continue supporting Node 6 LTS, we can close this PR and not worry about upgrading Ava to @next

If you need me to edit the configs to test on Node 8 and put in the proper documentations, please let me know and I'll add some commits to make sure this is solid.

Murderlon commented 6 years ago

@MrBenJ thanks for picking this up as well as investigating the origin of it! Since you already submitted a PR to the package containing the vulnerability I don't think it's necessary to drop support for node/boron just to temporarily fix it. Especially since @wooorm and you agreed it isn't that bad of an issue.

Let's keep the issue open till it's fixed and thanks again 👍