Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Remove child-process-promise from dependencies #1559

Merged
merged 4 commits into from
Dec 9, 2024
Merged

Remove child-process-promise from dependencies #1559

merged 4 commits into from
Dec 9, 2024

Conversation

MarcAstr0
Copy link
Collaborator

@MarcAstr0 MarcAstr0 commented Dec 5, 2024 •
edited
Loading

Description

There's a vulnerability with high severity found in the cross-spawn package. This package comes as a child dependency of child-process-promise, a project that hasn't been updated in years and that is not likely to change. This PR replaces child-process-promise with other, more up-to-date alternatives.

Changes

  • Removes child-process-promise from the cli, framework-common-helpers, and framework-integration-tests packages.
  • Refactor code that used child-process-promise to use execa instead.

Checks

  • Project Builds
  • Project passes tests and checks
  • Updated documentation accordingly

@MarcAstr0
Copy link
Collaborator Author

/integration sha=93465150425a3b168a3f250289b52e9f10b97a79

@what-the-diff What The Diff
Copy link

what-the-diff bot commented Dec 5, 2024

PR Summary

  • Substituting child-process-promise with execa
    The code has been revised and updated to swap the 'child-process-promise' package with the 'execa' package in the '@boostercloud/framework-core' package. This involves changes made to core operational files and adjustment of certain methods and functions to suit the new package. This update will enhance the efficiency of executing subprocesses.

  • Removal of 'child-process-promise'
    The 'child-process-promise' dependency has been fully removed from the 'cli' package. It means that the 'cli' package no longer draws functionality from this particular package.

  • Changes in testing mocks
    The test file 'live.test.ts' has been adapted to mock 'execa.command' instead of 'child-process-promise.exec'. This reduces errors during testing due to the removal of 'child-process-promise' from the dependencies.

  • Updates to test files
    The appearance of 'exec' from 'child-process-promise' has been rooted out from other test files and 'command' from 'execa' is now used. This will ensure all tests are run with the new functionality brought by 'execa' and keeps the usage consistent across all test files.

  • execa added as a dependency
    The framework-common-helpers/package.json file now includes execa as a dependency, showing that the common helpers will now use execa for their functionality.

  • Fixing of imports
    To ensure consistency with the new execa dependency, various imports across multiple test and service files have been corrected and fixed.

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Dec 5, 2024

⌛ Integration tests are running...

Check their status here 👈

@MarcAstr0
Copy link
Collaborator Author

/integration sha=123e787ab3890d6d8f3908c1f5806892ead2a15b

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Dec 5, 2024

⌛ Integration tests are running...

Check their status here 👈

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Dec 5, 2024

❌ Oh no! Integration tests have failed

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Dec 5, 2024

❌ Oh no! Integration tests have failed

@MarcAstr0
Copy link
Collaborator Author

/integration sha=a9509fa68f0f73ca7c27a37a48e7487aecfa4440

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Dec 5, 2024

⌛ Integration tests are running...

Check their status here 👈

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Dec 5, 2024

❌ Oh no! Integration tests have failed

@MarcAstr0
Copy link
Collaborator Author

/integration sha=66dee1888cdb55f7967331c504e5f1901446be63

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Dec 5, 2024

⌛ Integration tests are running...

Check their status here 👈

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Dec 5, 2024

❌ Oh no! Integration tests have failed

@MarcAstr0
Copy link
Collaborator Author

/integration sha=0fdc542738b0afff3c9a6f1b20e0f39dcda5f404

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Dec 5, 2024

⌛ Integration tests are running...

Check their status here 👈

@MarcAstr0
Copy link
Collaborator Author

/integration sha=70f284c8a81e071dfe07eccc7be001cc255251e2

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Dec 5, 2024

⌛ Integration tests are running...

Check their status here 👈

@MarcAstr0
Copy link
Collaborator Author

/integration sha=c9cb82e0e2a6e9027950113efd17e8b96bb2b203

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Dec 5, 2024

⌛ Integration tests are running...

Check their status here 👈

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Dec 5, 2024

❌ Oh no! Integration tests have failed

@MarcAstr0
Copy link
Collaborator Author

/integration sha=d3c7e6ef9b070569ba5942185649cbc6a4828284

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Dec 5, 2024

⌛ Integration tests are running...

Check their status here 👈

@MarcAstr0
Copy link
Collaborator Author

/integration sha=a54668262b46f92995a9e840d0f8dc13c813dc76

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Dec 5, 2024

⌛ Integration tests are running...

Check their status here 👈

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Dec 5, 2024

❌ Oh no! Integration tests have failed

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Dec 5, 2024

❌ Oh no! Integration tests have failed

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Dec 5, 2024

❌ Oh no! Integration tests have failed

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Dec 5, 2024

❌ Oh no! Integration tests have failed

@MarcAstr0 MarcAstr0 force-pushed the remove_child_process_promise branch from a546682 to 123e787 Compare December 5, 2024 19:54
@MarcAstr0
Copy link
Collaborator Author

/integration sha=8a3f7bd0f6df736e3e423176d510a725642601c4

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Dec 6, 2024

⌛ Integration tests are running...

Check their status here 👈

@MarcAstr0 MarcAstr0 force-pushed the remove_child_process_promise branch from 8a3f7bd to 71fa4ed Compare December 6, 2024 19:00
@MarcAstr0
Copy link
Collaborator Author

/integration sha=71fa4eddf21ea96bf2bc04962626c09363962c98

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Dec 6, 2024

⌛ Integration tests are running...

Check their status here 👈

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Dec 6, 2024

❌ Oh no! Integration tests have failed

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Dec 6, 2024

❌ Oh no! Integration tests have failed

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Dec 6, 2024

⌛ Integration tests are running...

Check their status here 👈

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Dec 6, 2024

✅ Integration tests have finished successfully!

@MarcAstr0 MarcAstr0 changed the title Remove child-process-promise Remove child-process-promise from dependencies Dec 6, 2024
@MarcAstr0 MarcAstr0 requested a review from davidverdu December 6, 2024 21:14
@MarcAstr0 MarcAstr0 added dependencies Pull requests that update a dependency file security Issues about improving the overall framework security. labels Dec 6, 2024
@MarcAstr0 MarcAstr0 marked this pull request as ready for review December 6, 2024 21:15
davidverdu
davidverdu approved these changes Dec 9, 2024
View reviewed changes
Copy link
Collaborator

@davidverdu davidverdu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@MarcAstr0 MarcAstr0 merged commit ab31b49 into boostercloud:main Dec 9, 2024
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@davidverdu davidverdu davidverdu approved these changes

Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file security Issues about improving the overall framework security.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@MarcAstr0 @davidverdu