feat: bump npm dependency ranges #8860
Conversation
|
Thanks for the PR, @bradzacher! typescript-eslint is a 100% community driven project, and we are incredibly grateful that you are contributing to that community. The core maintainers work on this in their personal time, so please understand that it may not be possible for them to review your work immediately. Thanks again! 🙏 Please, if you or your company is finding typescript-eslint valuable, help us sustain the project by sponsoring it transparently on https://opencollective.com/typescript-eslint. |
✅ Deploy Preview for typescript-eslint ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
bradzacher
changed the title
| "semver": "^7.5.4", | ||
| "ts-api-utils": "^1.0.1" | ||
| "semver": "^7.6.0", | ||
| "ts-api-utils": "^1.3.0" |
There was a problem hiding this comment.
There's something weird about 1.3.0 of ts-api-utils. Source code of this version does not exist on GitHub.
Also npm flags it when executing npm audit (see JoshuaKGoldberg/ts-api-utils#403).
Given the recent events with the XZ Utils backdoor, I would advise to pin this dependency to the last known version (1.2.1) to avoid any risks.
There was a problem hiding this comment.
@JoshuaKGoldberg is a maintainer of this project so can respond
There was a problem hiding this comment.
Though looking at it - there is provenance data for v1.3.0
https://www.npmjs.com/package/ts-api-utils/v/1.3.0#provenance
So it's verified as being published by the github action.
There was a problem hiding this comment.
@bradzacher And this is the linked GitHub Actions run: https://github.com/JoshuaKGoldberg/ts-api-utils/actions/runs/8214871649/job/22467737771.
This again looks a bit suspicious...
WARNING Unable to verify if user joshuakgoldberg is a collaborator for ts-api-utils.
Unsure about the rollback of pushing the tag below. But looks a bit a bit weird at least as well.
There was a problem hiding this comment.
I'm under the impression it was a transient npm issue, as mentioned in the ts-api-utils issue. I manually verified the code published matched what we expected from source. I'd encourage you to do the same if you're nervous about the release.
There was a problem hiding this comment.
Oh, and this isn't the only package that had the same odd issue: nodemailer/nodemailer#1634
PR Checklist
Overview