Skip to content
This repository has been archived by the owner on Jan 23, 2024. It is now read-only.

migrate to tsup #36

Merged
merged 3 commits into from
May 1, 2023
Merged

migrate to tsup #36

merged 3 commits into from
May 1, 2023

Conversation

ndelangen
Copy link
Member

@ndelangen ndelangen commented Apr 28, 2023

similar to storybookjs/jest#26

Change Type

Indicate the type of change your pull request is:

  • maintenance
  • documentation
  • patch
  • minor
  • major
📦 Published PR as canary version: 0.1.1--canary.36.a6ec2ac.0

✨ Test out this PR locally via:

npm install @storybook/testing-library@0.1.1--canary.36.a6ec2ac.0
# or 
yarn add @storybook/testing-library@0.1.1--canary.36.a6ec2ac.0

Version

Published prerelease version: v0.1.1-future.1

Changelog

🐛 Bug Fix

⚠️ Pushed to future

  • update dependencies to future (@yannbf)

Authors: 2

@ndelangen ndelangen self-assigned this Apr 28, 2023
@ndelangen ndelangen requested a review from yannbf April 28, 2023 11:56
@socket-security
Copy link

New dependency changes detected. Learn more about Socket for GitHub ↗︎


🚨 Potential security issues found in this pull request. To accept the risk, merge this PR and you will not be notified again.

Bot Commands

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all

  • @SocketSecurity ignore esbuild@0.17.18
  • @SocketSecurity ignore mz@2.7.0
  • @SocketSecurity ignore tree-kill@1.2.2
  • @SocketSecurity ignore is-generator-function@1.0.10
  • @SocketSecurity ignore load-tsconfig@0.2.5
  • @SocketSecurity ignore rollup@3.21.0
  • @SocketSecurity ignore tsup@6.7.0
  • @SocketSecurity ignore source-map@0.8.0-beta.0
📜 Install scripts

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Package Script field Source
esbuild@0.17.18 (added) postinstall package.json via tsup@6.7.0
⚠️ Shell access

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Package Module Location Source
esbuild@0.17.18 (added) child_process install.js package.json via tsup@6.7.0
esbuild@0.17.18 (added) child_process lib/main.js package.json via tsup@6.7.0
mz@2.7.0 (added) child_process child_process.js package.json via tsup@6.7.0
tree-kill@1.2.2 (added) child_process index.js package.json via tsup@6.7.0
⚠️ Uses eval

Package uses eval() which is a dangerous function. This prevents the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Avoid packages that use eval, since this could potentially execute any code.

Package Eval Type Location Source
is-generator-function@1.0.10 (added) Function index.js package.json via util@0.12.5
load-tsconfig@0.2.5 (added) Function dist/index.cjs package.json via tsup@6.7.0
load-tsconfig@0.2.5 (added) Function dist/index.js package.json via tsup@6.7.0
rollup@3.21.0 (added) Function dist/shared/loadConfigFile.js package.json via tsup@6.7.0
rollup@3.21.0 (added) Function dist/shared/loadConfigFile.js package.json via tsup@6.7.0
tsup@6.7.0 (added) Function dist/chunk-OSC67C6M.js package.json
tsup@6.7.0 (added) Function dist/rollup.js package.json
⚠️ New author

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Package New Author Previous Author Source
source-map@0.8.0-beta.0 (added) loganfsmyth nickfitzgerald package.json via tsup@6.7.0
Pull request alert summary
Issue Status
Install scripts ⚠️ 1 issue
Native code ✅ 0 issues
Bin script confusion ✅ 0 issues
Bin script shell injection ✅ 0 issues
Shell access ⚠️ 4 issues
Uses eval ⚠️ 7 issues
Unresolved require ✅ 0 issues
Invalid package.json ✅ 0 issues
HTTP dependency ✅ 0 issues
Git dependency ✅ 0 issues
GitHub dependency ✅ 0 issues
New author ⚠️ 1 issue
Potential typo squat ✅ 0 issues
Known Malware ✅ 0 issues
Telemetry ✅ 0 issues
Protestware/Troll package ✅ 0 issues

📊 Modified Dependency Overview:

➕ Added Package Capability Access +/- Transitive Count Publisher
util@0.12.5 environment +1 goto-bus-stop
tsup@6.7.0 eval, network, filesystem, environment +46 egoist
⬆️ Updated Package Version Diff Added Capability Access +/- Transitive Count Publisher
typescript@5.0.4 4.9.5...5.0.4 None +0/-0 typescript-bot

package.json Outdated Show resolved Hide resolved
@ndelangen ndelangen requested a review from yannbf April 28, 2023 12:12
@ndelangen
Copy link
Member Author

@yannbf 👍 ?

@ndelangen ndelangen merged commit 0985aec into future May 1, 2023
@ndelangen ndelangen deleted the norbert/use-tsup branch May 1, 2023 08:21
@github-actions github-actions bot added the prerelease This change is available in a prerelease. label May 1, 2023
@ndelangen ndelangen mentioned this pull request May 1, 2023
@yannbf yannbf mentioned this pull request Jun 19, 2023
5 tasks
@github-actions
Copy link

🚀 PR was released in v0.2.0 🚀

@github-actions github-actions bot added released This issue/pull request has been released. and removed prerelease This change is available in a prerelease. labels Jun 20, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
released This issue/pull request has been released.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants