@_linked/cli 1.21.1 → 1.21.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +53 -0
- package/package.json +1 -6
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,58 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 1.21.3
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- [#116](https://github.com/linked-fw/cli/pull/116) [`0377581`](https://github.com/linked-fw/cli/commit/0377581afa4e97070a70f7cc263f2baf6d5e4a9d) Thanks [@flyon](https://github.com/flyon)! - Drop `optimize-css-assets-webpack-plugin`, so `npm install` and `npm ci` work without `--legacy-peer-deps`.
|
|
8
|
+
|
|
9
|
+
The package declares `webpack ^5`, but this plugin's last release peers on
|
|
10
|
+
`webpack ^4`. npm cannot satisfy both, so a plain install failed outright:
|
|
11
|
+
|
|
12
|
+
```
|
|
13
|
+
npm error ERESOLVE could not resolve
|
|
14
|
+
npm error While resolving: optimize-css-assets-webpack-plugin@6.0.1
|
|
15
|
+
npm error Found: webpack@5.108.4
|
|
16
|
+
npm error Could not resolve dependency: peer webpack@"^4.0.0"
|
|
17
|
+
```
|
|
18
|
+
|
|
19
|
+
The workaround was `--legacy-peer-deps`, which silences every peer check in the
|
|
20
|
+
tree, not just this one — and it left `npm ci` broken, so a clean
|
|
21
|
+
lockfile-driven install never worked at all.
|
|
22
|
+
|
|
23
|
+
Nothing imports the plugin: it appears only in `devDependencies`, with no
|
|
24
|
+
reference anywhere in `src/`. It is also deprecated upstream in favour of
|
|
25
|
+
`css-minimizer-webpack-plugin`, which is not needed here either, since the
|
|
26
|
+
webpack config does not minify CSS through it.
|
|
27
|
+
|
|
28
|
+
Removing it is the whole fix. `npm install` and `npm ci` both succeed with no
|
|
29
|
+
flags, 28 fewer packages are installed, and the audit total drops from 20 to 19.
|
|
30
|
+
|
|
31
|
+
## 1.21.2
|
|
32
|
+
|
|
33
|
+
### Patch Changes
|
|
34
|
+
|
|
35
|
+
- [#113](https://github.com/linked-fw/cli/pull/113) [`476689a`](https://github.com/linked-fw/cli/commit/476689a2cce89639389b19daea2a240d929eacfd) Thanks [@flyon](https://github.com/flyon)! - Drop four declared-but-unused dependencies: `child-process-promise`, `css-parse`, `postcss-comment` and `postcss-strip-inline-comments`.
|
|
36
|
+
|
|
37
|
+
None of them is referenced anywhere outside `package.json`. The only trace of
|
|
38
|
+
any is a commented-out `// import parseCSS from 'css-parse';` at the top of
|
|
39
|
+
`src/loaders/css-loader.mts`.
|
|
40
|
+
|
|
41
|
+
They are worth removing rather than leaving because this package is a runtime
|
|
42
|
+
dependency of `@_linked/server`, not just a build tool: `lib/esm/cli.js`
|
|
43
|
+
statically imports `cli-methods.js`, so the whole dependency graph is loaded in
|
|
44
|
+
the serving process. Carrying advisories for code nothing calls is pure cost to
|
|
45
|
+
every consumer.
|
|
46
|
+
|
|
47
|
+
Together they account for 7 advisories — `cross-spawn` (ReDoS) via
|
|
48
|
+
`child-process-promise`, six `postcss` 5/6 advisories via the two postcss
|
|
49
|
+
wrappers, and `decode-uri-component` via `css-parse` → `css` →
|
|
50
|
+
`source-map-resolve`. None of the removed packages is the _current_ postcss:
|
|
51
|
+
the real one is 8.5.28 and is unaffected.
|
|
52
|
+
|
|
53
|
+
Typecheck clean, `test:unit` 303/303, build clean, and the audit total drops
|
|
54
|
+
from 27 to 20 in this repo.
|
|
55
|
+
|
|
3
56
|
## 1.21.1
|
|
4
57
|
|
|
5
58
|
### Patch Changes
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@_linked/cli",
|
|
3
|
-
"version": "1.21.
|
|
3
|
+
"version": "1.21.3",
|
|
4
4
|
"packageManager": "npm@11.19.1",
|
|
5
5
|
"description": "Command line tools for the @_linked/* packages and apps",
|
|
6
6
|
"main": "lib/esm/index.js",
|
|
@@ -96,7 +96,6 @@
|
|
|
96
96
|
"@vitejs/plugin-react": "^4.3.0",
|
|
97
97
|
"babel-loader": "^9.1.3",
|
|
98
98
|
"chalk": "^4.1.2",
|
|
99
|
-
"child-process-promise": "^2.2.1",
|
|
100
99
|
"chokidar": "^4.0.0",
|
|
101
100
|
"colors": "^1.4.0",
|
|
102
101
|
"commander": "^11.0.0",
|
|
@@ -104,7 +103,6 @@
|
|
|
104
103
|
"copyfiles": "^2.4.1",
|
|
105
104
|
"create-esm-loader": "^0.2.5",
|
|
106
105
|
"css-loader": "^6.10.0",
|
|
107
|
-
"css-parse": "^2.0.0",
|
|
108
106
|
"cssnano": "^7.0.7",
|
|
109
107
|
"depcheck": "^1.4.7",
|
|
110
108
|
"env-cmd": "^10.1.0",
|
|
@@ -119,7 +117,6 @@
|
|
|
119
117
|
"open": "^8.4.0",
|
|
120
118
|
"ora": "^8.0.1",
|
|
121
119
|
"postcss": "^8.5.3",
|
|
122
|
-
"postcss-comment": "^2.0.0",
|
|
123
120
|
"postcss-font-magician": "^4.0.0",
|
|
124
121
|
"postcss-import": "^16.1.0",
|
|
125
122
|
"postcss-loader": "^8.1.1",
|
|
@@ -127,7 +124,6 @@
|
|
|
127
124
|
"postcss-nested": "^7.0.2",
|
|
128
125
|
"postcss-preset-env": "^10.1.5",
|
|
129
126
|
"postcss-reporter": "^7.1.0",
|
|
130
|
-
"postcss-strip-inline-comments": "^0.1.5",
|
|
131
127
|
"postcss-url": "^10.1.3",
|
|
132
128
|
"react-refresh": "^0.18.0",
|
|
133
129
|
"react-refresh-typescript": "^2.0.10",
|
|
@@ -158,7 +154,6 @@
|
|
|
158
154
|
"babel-jest": "^29.7.0",
|
|
159
155
|
"husky": "^9.0.11",
|
|
160
156
|
"jest": "^29.7.0",
|
|
161
|
-
"optimize-css-assets-webpack-plugin": "^6.0.1",
|
|
162
157
|
"pinst": "^3.0.0",
|
|
163
158
|
"prettier": "^3.2.5",
|
|
164
159
|
"testcontainers": "^10.13.2"
|