search

krakenjs / confit

Environment-aware configuration.
Other
61 stars 26 forks source link

remove load-jsonic-sync feature due to uglify security vuln #73

Closed grawk closed 6 years ago

grawk commented 6 years ago

backing out the load-jsonic changes, due to ometa-js bringing in a vulnerable version of uglifyjs. I've had an issue open on ometa (https://github.com/veged/ometa-js/issues/34) for a while. Seems that module is abandoned. I tried to resolve the issue myself but was not able to figure how to adapt the newer uglify API into ometa. In the meantime, we should revert this change so the latest confit doesn't throw security warnings.

linkRace commented 6 years ago

All looks good to me, seems like tests pass and we have a clean dependency tree

grawk commented 6 years ago

Thanks! I'm going to merge. I'll open a separate issue to track integrated testing of this change.