Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

build(deps): Fix GitHub warning by updating request from 2.83.0 to 2.87.0 #131

Merged
merged 1 commit into from
Oct 23, 2018

Conversation

TimothyJones
Copy link
Contributor

The problem

Currently a repository including pact-node gets the following warnings in the GitHub gui:

screen shot 2018-10-23 at 12 27 12 pm

screen shot 2018-10-23 at 12 26 50 pm

For request@2.83.0, the problem library cryptiles was brought in by hawk:

$ npm ls cryptiles
@pact-foundation/pact-node@6.19.11 /Users/work/office/pact/pact-node
└─┬ request@2.83.0
  └─┬ hawk@6.0.2
    └── cryptiles@3.1.2

The solution

This PR upgrades request. Since later versions of request no longer depend on hawk or cryptiles, this will remove the warning in future releases.

$ npm ls cryptiles
@pact-foundation/pact-node@6.19.11 /Users/work/office/pact/pact-node
└── (empty)

Aside: The latest version of request is actually 2.88.0 (as suggested by this dependabot PR). However, the travis build for 2.88.0 fails with lots of test errors, so I don't think we should use it. This is also further evidence that dependabot isn't very useful for us (at least in this configuration).

@TimothyJones
Copy link
Contributor Author

Closing this, as:

  1. the travis build for request@2.88.0 is broken with many test failures
  2. Request is upgraded to a stable version in build(deps): Fix GitHub warning by updating request from 2.83.0 to 2.87.0 #131

@TimothyJones
Copy link
Contributor Author

Oops, closed the wrong one. This is the good one! Sorry for the spam.

@mboudreau
Copy link
Contributor

Looks good :)

Do you know how to do a release?

@mboudreau mboudreau merged commit f3ff306 into master Oct 23, 2018
@mboudreau mboudreau deleted the upgrade-request branch October 23, 2018 03:09
@TimothyJones
Copy link
Contributor Author

I don't! But happy to do it if you want to point me to the right place.

@mboudreau
Copy link
Contributor

Actually, I need to update the core library as well, so I'll do it in a sec :)

@mboudreau
Copy link
Contributor

Version 6.19.12 is going out now with the security fix, then release 6.20.0 as well with the binary update :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants