Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade to lodash@4.17.11 #240

Merged
merged 9 commits into from
Feb 25, 2019
Merged

Upgrade to lodash@4.17.11 #240

merged 9 commits into from
Feb 25, 2019

Conversation

js-kyle
Copy link
Owner

@js-kyle js-kyle commented Feb 23, 2019

#239

Would like to get this through, so I can then upgrade the mincer version of connect-assets which relies on mincer heavily (security updates for Lodash)

Edit: please let me know about the build status - there is a test failing on the Node.js 6 which also fails locally. Not sure what is going on with Node 4, and whether or not it is related

@puzrin
Copy link
Contributor

puzrin commented Feb 23, 2019

1 test broken, could you fix it?

@@ -150,9 +150,9 @@ getter(AssetAttributes.prototype, 'extensions', function () {
* // -> ".js"
**/
getter(AssetAttributes.prototype, 'formatExtension', function () {
return _.find(this.extensions.reverse(), function (ext) {
return _.find(this.extensions.reverse(), _.bind(function (ext) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What are reasons to use lodash's _.bind() instead of native .bind()?

Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The reason for that, is because I followed the details in the Lodash change log, for Lodash 3 to 4 compatibility. which suggests this way https://github.com/lodash/lodash/wiki/Changelog#compatibility-warnings

Copy link
Contributor

@puzrin puzrin Feb 24, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

_.bind() cares about special cases like Object, but we have only functions here. I think native .bind() will be ok, and less messy.

Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK cool, will update

@js-kyle
Copy link
Owner Author

js-kyle commented Feb 24, 2019

@puzrin thanks for initial feedback, I will look into the test

@js-kyle
Copy link
Owner Author

js-kyle commented Feb 24, 2019

@puzrin When running the tests on the master branch, they pass on Node 6, but Node 4 fails, which is the same case as this branch. So I'm not convinced they are related to this branch, unless you can confirm otherwise? Or perhaps there is some extra configuration needed which my environment doesn't have

@puzrin
Copy link
Contributor

puzrin commented Feb 24, 2019

https://travis-ci.org/nodeca/mincer/builds/497372081

As far as i see, "ping" fails everywhere, before this PR too. Other tests - depends on node version.

I'd suggest to prepare release v2.0.0, and drop all old nodes there (if you don't need those in your connect-assets).

@js-kyle
Copy link
Owner Author

js-kyle commented Feb 24, 2019

@puzrin I have addressed the things discussed above, as well as the server ping test failing on master (this was due to some breaking changes in latest releases of csswring and uglify-js

@puzrin
Copy link
Contributor

puzrin commented Feb 24, 2019

Hm. Lets split to different PR-s, for clear?

  • Could you leave here only 1 final commit with .bind()? I will merge it.
  • Then, new PR with csswring & uglifyify lock.
  • Don't tuch travis & vesrion in packege.json, i should fo id myself.

@puzrin
Copy link
Contributor

puzrin commented Feb 24, 2019

Or just create a new PR with lodash-related fix only, and i'll commit the rest.

Also, let me know what minimal node version do you need? Is 6.0 still required or we can start from 8.0?

@js-kyle
Copy link
Owner Author

js-kyle commented Feb 25, 2019

@puzrin thanks. This PR is now the lodash 3 to 4 upgrade only, which includes the .bind() refactor. I've created another PR with the devDependency updates.

I think that it would be good to keep it at Node 6 as a minimum, as we have a passing build with that version

@puzrin puzrin merged commit 24c9c9f into js-kyle:master Feb 25, 2019
@js-kyle
Copy link
Owner Author

js-kyle commented Feb 26, 2019

@puzrin thanks for expediting this - could you please publish 2.0.0 to npm?

@puzrin
Copy link
Contributor

puzrin commented Feb 26, 2019

done

mike-suggitt added a commit to mike-suggitt/mincer that referenced this pull request Dec 6, 2019
* Upgrade to lodash@4.17.11 (js-kyle#240)

Close js-kyle#239

* Lock devDependencies before breaking change versions

* Deps: drop ndoc due problems with install

* Travis: drop node v4, add latest

* 2.0.0 released

* Revert "Deps: drop ndoc due problems with install" (highlight.js fixed)

This reverts commit 3139dcd.

* security: lodash@4.17.14

* Travis-CI: update minimal node version to 8

* Dev deps bump & CS update

* Added deprecation warning

* 2.0.1 released

* nodeca = js-kyle

* update Makefile
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants