Remove `simple-swizzle`

[43081j]

As per the readme of the package itself:

NOTE: ⚠️ Don't use this package in new projects. It is a huge anti-pattern and will only confuse and annoy people who use whatever code you write with it.

Project:
https://github.com/qix-/node-simple-swizzle

lets run the fuzzy tool to find who uses this, but i suspect in all cases it just isn't necessary anymore

it was also compromised recently which is another good reason to drop unmaintained deep dependencies like this

---

#	Downloads	Traffic	Version	Package
1	1.25k	2.41 MB	^0.2.2	@kommunicate/kommunicate-chatbot-plugin

which suggests this is being pulled from dev tools rather than regular dependents

[mrginglymus]

https://github.com/lovell/sharp

Sharp is pulling color@^4.2.3 -> color-string@^1.9.0 -> simple-swizzle@^0.2.2

[43081j]

ok so the solution seems to be to help update consumers from color-string@1 to color-string@2 and this is solved

if we can find dependents of a particular semver range (or version), we can probably contrib to those

[mrginglymus]

lovell/sharp#4449

Sharp is the first package not to have a version that doesn't include swizzle, so this will unlock future work.

Sharp's downloads itself are split 50/50 between 0.34 and 0.33; we'll need to sniff around and find what's using those

[43081j]

we also have github search to help a bit but no real way to sort it:
https://github.com/search?q=%22%5C%22color-string%5C%22%3A+%5C%22%5E1%22+path%3Apackage.json+AND+NOT+is%3Afork&type=code

[43081j]

Prod dependencies:

https://github.com/diegomura/react-pdf/blob/ee5c96b80326ba4441b71be4c7a85ba9f61d4174/packages/render/package.json#L28
https://github.com/mapbox/react-colorpickr/blob/a7179f2f6bade1c74ac6283f21b936add2867ed4/package.json#L39
https://github.com/opendatacam/opendatacam/blob/93de3bb667ab967522a54c3a4f115908b4d9fcd5/package.json#L20

low downloads (high github stars):

https://github.com/vadimdemedes/tailwind-rn/blob/8e74787db5561fa23cf38bef633f69c6cb176c74/package.json#L35

Dev dependencies:

https://github.com/windicss/windicss/blob/671780a804db9b2dd46551c9f7820b6ff0fb88c9/package.json#L134
https://github.com/akira-cn/ICG-WebGL/blob/a7e9c8a2a34655ffdab50dce996052d617b5f794/package.json#L49

let's open PRs for these when we can to bump to 2.x

[mrginglymus]

Next in the chain of sharp is next, which has sharp as an optional peer dep. v15 depends on 0.34, v14 and below depends on v0.33

[43081j]

it does seem like next is the big one here

e.g. tailwind depends on next which depends on sharp

edit:

ok as of writing this, npm i next does pull down the compromised package

same for astro apparently

so sorting sharp will go upstream and fix everything (outside of security though this will be a good thing to do)

[outslept]

another part is

colorspace latest pulls color@3.2.1 which pulls color-string 1.x 💀

https://www.npmjs.com/package/colorspace

UPD:

Biggest consumer is

Dependents sorted by downloads:
 #1  50.86M ⬇️ , 101.16 GB - @dabh/diagnostics              1.1.x  https://npmjs.com/@dabh/diagnostics
 #2   2.50M ⬇️ ,   4.98 GB - diagnostics                    1.1.x  https://npmjs.com/diagnostics

And it (@dabh/diagnostics) is used in

 #1  64.64M ⬇️ , 647.97 GB - winston                                     ^2.0.2 https://npmjs.com/winston

Also

3rd-Eden/colorspace#9

[43081j]

for @dabh/diagnostics, i think the colorspace code should just be inlined given how small it is:
https://unpkg.com/colorspace@1.1.4/index.js

afaict dabh is a maintainer of that fork and of winston, so we should be able to open an issue there to do that

cc @DABH if you want any visibility of this

[DABH]

Howdy - I'm open to a PR if you want to make one for @dabh/diagnostics . Cheers!

[outslept]

Also found this chain

@react-pdf/renderer@3.4.5(react@18.3.1) → @react-pdf/font@2.5.2 → @react-pdf/types@2.9.0 → @react-pdf/stylesheet@6.1.0 → color-string@1.9.1

Project link - https://github.com/diegomura/react-pdf

[mrginglymus]

https://www.npmjs.com/package/@flmngr/flmngr-server-node-express?activeTab=dependents is a large and rising consumer of sharp on 0.32, so it'll need updating

[outslept]

https://www.npmjs.com/package/@antv/scale/v/0.4.16?activeTab=code ehh?
https://www.npmjs.com/package/react-base16-styling?activeTab=readme

[Fuzzyma]

@43081j you can use the tool to check for dev deps as well with the -D flag