search

wooorm / refractor

Lightweight, robust, elegant virtual syntax highlighting using Prism
MIT License
722 stars 33 forks source link

Change prismjs to carat range? #33

Closed karlhorky closed 4 years ago

karlhorky commented 4 years ago

Hi @wooorm !

Maybe going forward, you would consider changing to a carat version range for prismjs?

It would help a lot for projects stuck with older dependencies which have refractor as a transitive dep (especially when things like security vulnerabilities with prismjs happen).

Anyway, thanks for the consideration!

wooorm commented 4 years ago

Hi Karl! 👋

We have Prism as a dep for its core. Basically hidden internals. Loosening the range will cause stuff to break. I find preventing everything from exploding more important than older dependencies. Refractor also has a track record of updating fast after Prism updates, and if you use refractor itself with a loose range, you’ll also get Prism updates.

The security vulnerability did not affect anyone using refractor, as we don’t support plugins. If there is an issue, it’s with Dependabot falsely claiming there was one 🤷‍♂️

karlhorky commented 4 years ago

Ok, understandable. Thanks for the answer :)

wooorm commented 4 years ago

No problem, thanks for understanding!