node-markdown-spellcheck
node-markdown-spellcheck copied to clipboard
lukeapage
Is this still being maintained?
@lukeapage - would you be able to provide a quick update? It's understandable if you don't have the bandwidth to maintain this project. Maybe others can help with the maintenance.
Hi, not really.. the problem is I don’t use it. @robatwilliams also has permission to merge as I believe they use it
It is in use by the company I work for, as part of our website's publishing toolchain. While that toolchain is in regular use, it's "done" and working - not undergoing development at the moment. If an issue arises in this project that affects that toolchain, it'd probably be seen to fairly quickly.
If there's anything in particular that needs fixing, I'd be happy to try and find if we have someone who's not busy and who would be able to merge any PRs and do a release.
@robatwilliams @lukeapage Hi there, there's something that needs fixing, yes, a moderate security flaw was discovered on marked, a dependency of this project. Please update it to v0.7.0.
~~Would it help if I made a PR?~~ Here's the PR that fixes it. Can one of you review/merge it?
Hi, thanks for bringing this up. I'm not the owner of the repo, so didn't receive a security notification from GitHub.
We specify ^0.3.5, anyone installing it will get 0.7.0 so I'm not sure this is much of a concern for this project. Correct me if I'm wrong. So I don't see reason to do a release right now. Thanks for the PR.
I see there have been many breaking changes to marked since the 0.3.5 version that was originally installed in this project. I'm not sure how significant they are, given that the project isn't using semantic versioning.
We specify ^0.3.5, anyone installing it will get 0.7.0 so I'm not sure this is much of a concern for this project. Correct me if I'm wrong. So I don't see reason to do a release right now. Thanks for the PR.
Not really, with ^0.3.5 you will get all patch updates -- in this specific case you will get up to 0.3.19. The security flaw was only patched at 0.6.3. In the meantime, we are at risk.
Let's continue this discussion on the PR, as it's not the subject of this issue.
hi, i did some work on updating all dependencies, and migrating some code, and overall cleanup
https://github.com/lukeapage/node-markdown-spellcheck/pull/135
some of tests on master do not work (due to weird usage of promises)
recently we started using it at typescript-eslint and i'd like to hear some feedback about my changes.
Just FYI, I found what appears to be a maintained library that matches the functionality of this one: https://www.npmjs.com/package/spellchecker-cli
