Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade sane to 4.0.3 #8048

Merged
merged 1 commit into from
Mar 5, 2019
Merged

Upgrade sane to 4.0.3 #8048

merged 1 commit into from
Mar 5, 2019

Conversation

cpojer
Copy link
Member

@cpojer cpojer commented Mar 5, 2019

A module called merge that is dependent on by transitive dependencies of jest-haste-map contains a vulnerability. With this PR, I am updating sane (the direct dependency) that will remove this vulnerability.

Note that it is still part of the overall yarn.lock because of react-native depending on Metro depending on an older version of jest-haste-map. This will eventually be all upgraded in the future, but we gotta start somewhere :)

@@ -781,8 +781,6 @@ class HasteMap extends EventEmitter {
const Watcher: sane.Watcher =
canUseWatchman && this._options.useWatchman
? WatchmanWatcher
: os.platform() === 'darwin'
? sane.FSEventsWatcher
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

so no fsevents, huh? do we know how that affects performance without watchman?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As discussed on discord, it seems like it won't work with Node 12 anyway and it is currently being rewritten, so it doesn't seem like we have much of a choice.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

for anyone coming upon these comments later:

current versions won't work for node 12: fsevents/fsevents#252
Being rewritten (to not have features we need): fsevents/fsevents#247

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wut? The rewrite WOULD work with node 12+; just not the current version.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, but we want to support node 6 and 12 at the same time

@cpojer cpojer merged commit dd385b0 into jestjs:master Mar 5, 2019
@SimenB
Copy link
Member

SimenB commented Mar 5, 2019

Would be nice to upstream WatchmanWatcher back to sane as well...

@SimenB
Copy link
Member

SimenB commented Mar 5, 2019

@cpojer you skipped to changelog 😉

@vvo
Copy link
Contributor

vvo commented Mar 5, 2019

@SimenB thanks for keeping us all up to date on that :)

@pipobscure
Copy link

pipobscure commented Mar 7, 2019

Hi there, this is the first I have heard of this issue.

Let me clear some things up:

I am actively working on making the fsevents v1.x line work with node v12.x so that line should work with node v6 and v12 at the same time.

The fsevents v2.x line cannot ever work with node v6, but will work with v8+.

So all you have to do is stick with the v1.x line until you are ready to drop v6

The update to chokidar to v2.x should also be a major version bump. So again, stick with the current major until you are ready to drop node v6.

Given that node v6 looses any support in under 2 months, I’d encourage you to make plans for dropping it soon, but it’s entirely up to you.

In addition to all those exciting news, I’m also in conversation with the node team about bringing fsevents into core. But that’s another story.

TL;DR don’t panic, fsevents v1.x will support node v12 (v1.2.7 already supports v11.11.0 which is as close to v12 as we can currently get)

@SimenB
Copy link
Member

SimenB commented Mar 7, 2019

Thanks for clearing up my confusion @pipobscure!

I am actively working on making the fsevents v1.x line work with node v12.x so that line should work with node v6 and v12 at the same time.

Ah, ok. That's great news! Doesn't really change anything for Jest though, as we use an abstraction on top of fsevents again - sane which dropped fsevents in its latest major: amasad/sane#130.

The update to chokidar to v2.x should also be a major version bump. So again, stick with the current major until you are ready to drop node v6.

We don't use chokidar, so that doesn't affect us.

Given that node v6 looses any support in under 2 months, I’d encourage you to make plans for dropping it soon, but it’s entirely up to you.

Yeah, of course. Being a testing framework though, we want to not necessarily drop older nodes as quickly as others might.

In addition to all those exciting news, I’m also in conversation with the node team about bringing fsevents into core. But that’s another story.

Oh, that's very exciting indeed!

@pipobscure
Copy link

@SimenB that statement "Being a testing framework though..." grated on me all morning. I work in developing testing frameworks & tools as a dayjob and I'd claim the exact opposite. Especially for a testing framework you should drop versions as they loose support.

Any case, I hope we'll have the opportunity to discuss that over beers (for any value of beers) some time. I'll be at JSConf.eu and JSCamp Barcelona if you want to meet up.

@SimenB
Copy link
Member

SimenB commented Mar 8, 2019

I did not mean to sound dismissive, sorry if it came across like that! 🙏

My point was that "just" because a Node version won't be receiving updates doesn't mean libraries wants to stop supporting them. And for libraries to keep supporting them, you probably want to have your tests executed on that version. But maybe we just disagree on that point, which is perfectly fine.

As for Jest, we'll actually most likely be pretty quick to drop node 6 this spring - we use async-await all over the place and it'll be awesome to not transpile that down for node 6.

@github-actions
Copy link

This pull request has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.
Please note this issue tracker is not a help forum. We recommend using StackOverflow or our discord channel for questions.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators May 11, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants