drizzle-team
[FEATURE]: Dependency to deprecated package `@esbuild-kit/esm-loader`
Describe what you want
@esbuild-kit/esm-loader was recently marked as deprecated. It might be a good time to update the dependencies to this library.
Apologies for the multiple commit messages in the log! I was refining the commit message to make it clearer...
Created a pull request #3498 , which simply moves @esbuild-kit/esm-loader from dependencies to devDependencies, because this package doesn't appear to be used in end-user environments.
[email protected] depends on @esbuild-kit/core-utils and core-utils is deprecated too and add some critical vulnerability to dockerfile. It is reported by docker scout.
Should you change it to tsx?
npm warn deprecated @esbuild-kit/[email protected]: Merged into tsx: https://tsx.is
npm warn deprecated @esbuild-kit/[email protected]: Merged into tsx: https://tsx.is
npm audit is now showing vulnerabilities related to drizzle-kit: "depends on vulnerable versions of @esbuild-kit/esm-loader". Would it be possible to prioritize merging PR #3498 so I can resolve the build pipeline blocker? Thank you!
Hi! We are also using drizzle-kit in our project and would love to have this fixed!
Here's the related npm audit output:
esbuild <=0.24.2
Severity: moderate
esbuild enables any website to send any requests to the development server and read the response - https://github.com/advisories/GHSA-67mh-4wv8-2f99
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/@esbuild-kit/core-utils/node_modules/esbuild
node_modules/drizzle-kit/node_modules/esbuild
@esbuild-kit/core-utils *
Depends on vulnerable versions of esbuild
node_modules/@esbuild-kit/core-utils
@esbuild-kit/esm-loader *
Depends on vulnerable versions of @esbuild-kit/core-utils
node_modules/@esbuild-kit/esm-loader
drizzle-kit 0.9.1 - 0.9.54 || >=0.12.9
Depends on vulnerable versions of @esbuild-kit/esm-loader
Depends on vulnerable versions of esbuild
node_modules/drizzle-kit
I would prefer not downgrading drizzle-kit to v.0.19.1, as npm audit suggests :)
Hi! We are also using drizzle-kit in our project and would love to have this fixed!
Here's the related npm audit output:
esbuild <=0.24.2 Severity: moderate ... node_modules/drizzle-kitI would prefer not downgrading drizzle-kit to v.0.19.1, as npm audit suggests :)
Hi @AnMW I solved that by adding in package.json the overrides section with esbuild set to the newest version in drizzle-kit and also in its sub-dependencies (esm-loader and core-utils):
"overrides": {
"@esbuild-kit/core-utils": {
"esbuild": "0.25.0"
},
"@esbuild-kit/esm-loader": {
"esbuild": "0.25.0"
},
"drizzle-kit": {
"esbuild": "0.25.0"
}
}
And running npm i + npm update after that.
¡Hola! También usamos drizzle-kit en nuestro proyecto y nos encantarÃa solucionarlo.
Aquà está la salida de auditorÃa de npm relacionada:
esbuild <=0.24.2 Severity: moderate esbuild enables any website to send any requests to the development server and read the response - https://github.com/advisories/GHSA-67mh-4wv8-2f99 fix available via `npm audit fix --force` Will install [email protected], which is a breaking change node_modules/@esbuild-kit/core-utils/node_modules/esbuild node_modules/drizzle-kit/node_modules/esbuild @esbuild-kit/core-utils * Depends on vulnerable versions of esbuild node_modules/@esbuild-kit/core-utils @esbuild-kit/esm-loader * Depends on vulnerable versions of @esbuild-kit/core-utils node_modules/@esbuild-kit/esm-loader drizzle-kit 0.9.1 - 0.9.54 || >=0.12.9 Depends on vulnerable versions of @esbuild-kit/esm-loader Depends on vulnerable versions of esbuild node_modules/drizzle-kitPreferirÃa no degradar drizzle-kit a v.0.19.1, como sugiere la auditorÃa de npm :)
fix problem warn moderate
package.json
"overrides": { "esbuild": "0.25.1", },
ready!!
A simple way is to remove the @esbuild-kit/esm-loader dependency and use the already dependent tsx instead
https://github.com/drizzle-team/drizzle-orm/blob/9e81def6dbe33e54ef96f5960cf87ec829b7414f/drizzle-kit/build.dev.ts#L27
js: `#!/usr/bin/env -S node --loader tsx --no-warnings`,
See https://tsx.is/dev-api/node-cli#node-js-cli .
fix problem warn moderate
package.json
"overrides": { "esbuild": "0.25.1", },
Adding to @artiefy 's fix above, if you're using pnpm you can add this to your package.json file:
"pnpm": {
"overrides": {
"esbuild": "^0.25.0"
}
},
fix problem warn moderate package.json "overrides": { "esbuild": "0.25.1", },
Adding to @artiefy 's fix above, if you're using pnpm you can add this to your
package.jsonfile:"pnpm": { "overrides": { "esbuild": "^0.25.0" } },
Did not work for me. Possibly because I'm in a monorepo.
"pnpm": { "overrides": { "esbuild": "^0.25.0" } },Did not work for me. Possibly because I'm in a monorepo.
@npearson72 it looks like that can only be used at the root of a project.
Note that the overrides field can only be set at the root of the project.
Source: https://pnpm.io/9.x/package_json#pnpmoverrides
At this point it is no longer a deprecation warning but a moderate vulnerability warning. The esbuild version override throws an error with npm..
