Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade @jimp/* to v0.22.12 #148

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

colingm
Copy link

@colingm colingm commented May 7, 2024

This change is in order to address security vulnerabilities in phin < v3.7.1 which is used by @jimp/* in v0.16.

GHSA-x565-32qp-m3vf

There were a few changes marked as Breaking inside of @jimp between v0.16 and v0.22.12 but all but 1 were marked that way as they were changing the build tool used by jimp. The one that wasn't is listed below:

They decided to use a polyfill for fetch to support better browser compatibility and I couldn't see any issues this would cause for node-vibrant but am happy to have anyone see if that is an issue.

Addresses: #146

This change is in order to address security vulnerabilities in
phin < v3.7.1 which is used by @jimp/* in v0.16.

GHSA-x565-32qp-m3vf
@colingm
Copy link
Author

colingm commented May 7, 2024

I'm actually having trouble even getting node-vibrant to build though. Is there a specific node version that needs to be used or something? I can't get this to build from node 18 or node 10 with some typescript errors related to what seems to be missing lodash types or something from ts-node.

(I also can't get master to build so clearly I am doing something wrong)

@crutchcorn
Copy link
Member

Unfortunately, you're not doing anything wrong @colingm :( node-vibrant was left in a bit of a haste (long story) and not in a healthy state. I couldn't get master building either some time ago. I need to come back to it, altho FWIW I'll review PRs as quickly as I can if anyone else wants to jump in

@colingm
Copy link
Author

colingm commented May 8, 2024

@crutchcorn okay yeah that is what I later realized after a bit of sleuthing. So right now I am taking some time to try to upgrade a few things in the library (mainly in upgrading to webpack 5) and just working through the issues that come with inline workers in webpack 5 (mostly figuring out what is the right way to do it 😅 )

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants