Skip to content

Conversation

@aduh95
Copy link
Contributor

@aduh95 aduh95 commented May 15, 2022

When working on #100, I noticed updating proxy-agent was blocked by some issue, so I left the outdated version in the other PR that was big enough as is.

Turned out the reason was upgrading proxy-agent adds vm2 to the dependency tree (even though it's never actually used, at least not by the APIs Corepack uses), and it seems that something between vm2, Webpack, and PnP is not behaving as expected and the build fails. I used yarn patch to basically remove all of vm2 code to replace it by some minimal mock file, and now Webpack doesn't freak out, and the tests are passing.

I've also bumped the other packages that were left over, and the Yarn version itself.

@aduh95
Copy link
Contributor Author

aduh95 commented May 23, 2022

@arcanis do you know why using a patch version breaks the CI?

@arcanis
Copy link
Contributor

arcanis commented May 23, 2022

The patch file might be gitignored and need an override in the gitignore file 🤔

@aduh95 aduh95 requested a review from arcanis May 23, 2022 23:34
@arcanis arcanis merged commit 648bd95 into main May 24, 2022
@arcanis arcanis deleted the update-deps branch May 24, 2022 14:22
@arcanis
Copy link
Contributor

arcanis commented Apr 11, 2023

Good thing you disabled vm2, it had a vulnerability: https://security.snyk.io/package/npm/vm2

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants