Rollup warnings "Use of eval is strongly discouraged"

[andrewmclagan]

Describe the bug

Rollup emits multiple warnings from this library, most importantly:

(!) Use of eval is strongly discouraged
https://rollupjs.org/guide/en#avoiding-eval
node_modules/js-base64/base64.js
31:     if ('object' !== 'undefined' && module.exports) {
32:         try {
33:             buffer = eval("require('buffer').Buffer");
                         ^
34:         } catch (err) {
35:             buffer = undefined;

To Reproduce

Include tus-js-client or @uppy/tus in a package built with rollup

Expected behavior

No warnings emitted

[Acconut]

Thank you for reporting this, we weren't aware that eval is used inside tus-js-client. However, this is not caused by tus-js-client directly but instead by js-base64, one of our dependencies. There is already a discussion at dankogai/js-base64#85 about whether that can be fixed. Maybe we can join in and help them.

Is this a blocking issue for you or is the warning not preventing Rollup from producing your build?

[andrewmclagan]

Thanks for your response! Yes, I also noticed it was on the dependency. It’s not a blocking issue for us at all, just a Rollup warning. There are alternatives to js-base64 that don’t use evil... I mean eval ;)

On Tue, 2 Apr 2019 at 6:58 am, Marius ***@***.***> wrote: Thank you for reporting this, we weren't aware that eval is used inside tus-js-client. However, this is not caused by tus-js-client directly but instead by js-base64, one of our dependencies. There is already a discussion at dankogai/js-base64#85 <dankogai/js-base64#85> about whether that can be fixed. Maybe we can join in and help them. Is this a blocking issue for you or is the warning not preventing Rollup from producing your build? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#147 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABBgawEDNcp-rJDHvXk61xTQsyLaDkCYks5vcmTcgaJpZM4cUn3C> .

-- Regards, *Andrew McLagan* *Contract Web Developer* Please consider the environment before printing.

[Acconut]

Great, let's see if js-base64 fixes this problem in the near future. Switching to another module is also an option but I am not sure if the engineering costs are worth the effort :)

[Acconut]

js-base64 released a version without the use of eval, so I just updated tus-js-client to use the new release: dankogai/js-base64#85 (comment)