stencila / encoda

↔️ A format converter for Stencila documents
https://stencila.github.io/encoda/
Apache License 2.0
35 stars 9 forks source link

package.json, bumps remark-parse to 9.0+ to fix CVE-2020-7753 #1063

Closed lsh-0 closed 1 year ago

lsh-0 commented 1 year ago

package.json, bumps remark-parse to 9.0+ to fix CVE-2020-7753 in trim transitive dependency.

lsh-0 commented 1 year ago

Dead with:

$ npm install

> @stencila/encoda@1.0.1 install
> node install.js

node:internal/errors:857
  const err = new Error(message);
              ^

Error: Command failed: npx tsc -p tsconfig.prod.json

    at ChildProcess.exithandler (node:child_process:402:12)
    at ChildProcess.emit (node:events:513:28)
    at maybeClose (node:internal/child_process:1100:16)
    at Process.ChildProcess._handle.onexit (node:internal/child_process:304:5) {
  code: 2,
  killed: false,
  signal: null,
  cmd: 'npx tsc -p tsconfig.prod.json',
  stdout: "src/codecs/md/index.ts(250,20): error TS2345: Argument of type '{ commonmark: boolean; }' is not assignable to parameter of type 'Options'.\n" +
    "  Object literal may only specify known properties, and 'commonmark' does not exist in type 'Options'.\n" +
    `src/codecs/md/plugins/cite.ts(6,10): error TS2305: Module '"remark-parse"' has no exported member 'Eat'.\n` +
    `src/codecs/md/plugins/cite.ts(6,15): error TS2724: '"remark-parse"' has no exported member named 'Parser'. Did you mean 'Parse'?\n` +
    `src/codecs/md/plugins/cite.ts(6,23): error TS2305: Module '"remark-parse"' has no exported member 'Tokenizer'.\n` +
    "src/codecs/md/plugins/cite.ts(39,5): error TS2578: Unused '@ts-expect-error' directive.\n" +
    "src/codecs/md/plugins/cite.ts(120,30): error TS7006: Parameter 'value' implicitly has an 'any' type.\n" +
    "src/codecs/md/plugins/cite.ts(120,37): error TS7006: Parameter 'fromIndex' implicitly has an 'any' type.\n",
  stderr: ''
}
npm ERR! code 1
npm ERR! path /home/elife/encoda
npm ERR! command failed
npm ERR! command sh -c -- node install.js

npm ERR! A complete log of this run can be found in:
npm ERR!     /home/elife/.npm/_logs/2023-08-04T01_57_02_858Z-debug-0.log

Looks like remark-parse at 9.0.0 is too large of a change for encoda without significant work: