Redocly
Deprecated `glob` version used
Overview
I use @redocly/cli as a linting step against the OpenAPI spec in my project.
pnpm warns me of deprecated subdependencies in my project:
$ pnpm i
WARN 2 deprecated subdependencies found: [email protected], [email protected]
Using pnpm why, the glob one seems to come from @redocly/cli:
$ pnpm why [email protected]
...
devDependencies:
@redocly/cli 1.25.11
└── glob 7.2.3
And notably, the other deprecated subdependency ([email protected]) itself comes through the deprecated glob version (which is potentially why the glob version was deprecated)
$ pnpm why [email protected]
...
devDependencies:
@redocly/cli 1.25.11
└─┬ glob 7.2.3
└── inflight 1.0.6
Desired Fix
Bump the used version of glob to a non-deprecated version.
Versions
@redocly/[email protected], latest at time of issue submission- M2 Mac, likely irrelevant
Hey!
I'm interesting about an update, I'm using @redocly/[email protected]
└─┬ @redocly/[email protected] └─┬ [email protected] └── [email protected]
I would like to adress this warning about inflight
npm warn deprecated [email protected]: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
Thanks!
Hey @matthieuLepetit, it is on our to-do list. We just don't have enough bandwidth to work on it yet.
Hi @tatomyr thank you for your quick update !
I just made a PR https://github.com/Redocly/redocly-cli/pull/1843
I hope I followed correctly your conventions.
If you have some bandwith for some review do not hesitate.
Have a great day !
Thanks, @matthieuLepetit! The main thing here is to test if it doesn’t break anything for us. I'll be able to do that a bit later this week (I hope).
Hi we also ran into this issue while trying to use redocly. I don't think it's a blocker for us but it would be nice to have this resolved.
Is there an ETA on that? Looking to get this vulnerability resolved. https://cwe.mitre.org/data/definitions/772.html
@garrett-whitehorn-cengage this has been fixed in v2. You may start using the pre-release next version before we go launch the stable version. I'm currently preparing the migration guide, but in general you should be able to use it with minimal changes (except for resolving deprecations, see the changelog).