[epic] vinyl-fs version 3.0.0 #1604

Open
phated opened this Issue Apr 15, 2016 · 31 comments

Projects

None yet
@phated
Member
phated commented Apr 15, 2016 edited

I'm creating this issue to get some more visibility on outstanding issues in vinyl-fs for it to reach 3.0 (which we'd like to ship with gulp 4).

If you are able to tackle any of these, the help would be very much appreciated.

@phated phated added this to the gulp 4 milestone Apr 15, 2016
@phated
Member
phated commented Apr 25, 2016

Updated! We've had some excellent contributions by @hgwood and @tmcgee123
Some of the improvements brought to light a couple of other things we need help with.

@phated
Member
phated commented Jun 28, 2016

Almost all these are wrapping up. We need to get some more tests in place for the changes and solidify the "Support functions for all options" stuff.

Still looking for someone to tackle the uid/gid stuff.

@Koslun Koslun referenced this issue in angular-fullstack/generator-angular-fullstack Jul 7, 2016
Closed

Gulp build failed. #2039

1 of 1 task complete
@odino
odino commented Jul 12, 2016

What about a smaller update to vinyl? With this issue on minimatch everyone gets lots of sec. alerts :)

@phated
Member
phated commented Jul 12, 2016

@odino no, those alerts don't matter. If you are passing user input directly to gulp, you have bigger problems.

@odino
odino commented Jul 12, 2016

That's true, but those alerts will keep coming due to gulp requiring the
library. So even if this has never been exploited people are gonna
"wtf?!?!" anyway unless they really dig into it and figure out that this is
not an issue at all.

If there's an easy way to upgrade to a version that has the patch I would
suggest to go for it, else if its a big PITA then never mind :)
On Jul 12, 2016 1:40 PM, "Blaine Bublitz" notifications@github.com wrote:

@odino https://github.com/odino no, those alerts don't matter. If you
are passing user input directly to gulp, you have bigger problems.


You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
#1604 (comment), or mute
the thread
https://github.com/notifications/unsubscribe/AAUC5BPlBGK1FkEyh0WVf2e_q6GkZku2ks5qU2ElgaJpZM4IIqCY
.

@strugee
strugee commented Jul 14, 2016

@phated the UID/GID item should be checked off, no?

@ilanbiala

@phated any update on ^^?

@atomantic
atomantic commented Jul 21, 2016 edited

re @odino and security fix. this could be fixed just by updating the version of vinyl-fs that gulp installs. Currently you get vinyl-fs@^0.3.0 which translates to a really old version of vinyl-fs (0.3.14).

This is a problem for anyone requiring nsp check to pass for a build to succeed.

@Den-dp
Den-dp commented Jul 21, 2016

this could be fixed just by updating the version of vinyl-fs

@atomantic a lot of things was changed since vinyl-fs@0.3.14 https://github.com/gulpjs/vinyl-fs/blob/master/CHANGELOG.md#v0314-20150921-2357-0000 so it is impossible just bump the version.
In fact, migration to vinyl-fs@3.0.0 is a thing and the whole point of this issue.

@phated
Member
phated commented Jul 21, 2016

@strugee @ilanbiala thanks, I've updated the list. However, a few more things had to be added to account for things I've found during the test refactor.

@atomantic

got it. Yeah, I noticed tests pass as long as I upgrade vinyl-fs to latest version and include glob-watcher 0.0.8--but that's still a really old version of glob-watcher. glob-watcher@3.0.0 has some differences that break it.

@phated
Member
phated commented Jul 21, 2016

@atomantic the gulp tests are just a smoke test because each underlying library has a full test suite that we aren't going to duplicate. Extreme amounts of stuff has changed and you should not assume everything will just work.

@phated
Member
phated commented Jul 22, 2016

I've submitted the test refactor for review at gulpjs/vinyl-fs#194 - I'd like to get feedback before I push it so feel free to comment.

@pgilad
Contributor
pgilad commented Aug 31, 2016

Hey - any news on this? gulp is bringing in an outdated version of minimatch (with security issues)..

@phated
Member
phated commented Aug 31, 2016

@pgilad I'm pretty diligent about updating this thread when there are updates, so no. You can follow the linked issues to see progress on the outstanding items (and even contribute). The minimatch warning you mention doesn't mean anything because you aren't passing raw user input to the gulp methods (or you shouldn't be).

This was referenced Aug 31, 2016
@addyosmani

@phated First, thanks for all the awesome contributions you continue to make to Gulp. Second, looking at the prepareWrite note it appears this is done as of gulpjs/vinyl-fs@cc99707 and the associated tests also landed. Was there more work to do before it could be checked off the list?

@phated
Member
phated commented Sep 15, 2016

@addyosmani unfortunately that commit didn't solve everything and caused problems with the symlink method so it was never merged. There are some more option normalizations that are in progress, so I have been focusing on the glob-stream and vinyl dependencies.

@haoranw
haoranw commented Sep 27, 2016

thanks for your contributions

@abhijeetkpawar

This epic is taking epic time to resolve :(

@strugee
strugee commented Oct 7, 2016

@abhijeetkpawar everyone working on Gulp is a volunteer. If you want it to go faster, you are welcome to volunteer as well.

@phated
Member
phated commented Nov 21, 2016

We've also just received https://github.com/gulpjs/vinyl-sourcemap as a dependency for vinyl-fs. There's still plenty of work to be done on it so any little bit helps.

@mcdado
mcdado commented Nov 24, 2016

I'm not that experienced, but I'd love to help.
I see that there are some points still unchecked. Any suggestions to which to roll up my sleeves at first, be it by priority or accessibility? (this last term used very vaguely, forgive me)

@strugee
strugee commented Nov 28, 2016

@nhaglind please don't comment on random issues with (somewhat) unrelated problems.

Normally I'd tell you to file a new issue, but it would just be a duplicate of #1571 anyway.

@kyleholzinger
kyleholzinger commented Dec 4, 2016 edited

Agreed @mcdado! I'd love to help in any way I can, any low hanging fruit that's just kind of tedious work for me to do? I just want to help out any way I can 😊

@strugee
strugee commented Dec 6, 2016

@phated in the interest of Gulp 4 hitting npm sooner, couldn't some of these issues be pushed past the release? E.g. supporting functions for all options and separating prepareWrite into a separate module don't seem like semver-major changes (although I of course am not an expert). This is especially relevant given that Node 7 is now released and breaking Gulp 3 installs left and right.

@phated
Member
phated commented Dec 6, 2016

@strugee no, that's a breaking change. This list is breaking change exclusive and everything else is being pushed. Feel free to contribute on the issues.

@strugee
strugee commented Dec 6, 2016

@phated ah, okay. I still don't see how, but I'll take your word for it :)

Thanks for the quick response.

@phated
Member
phated commented Dec 14, 2016

I need some help writing tests for gulpjs/glob-stream#85 if anyone is interested.

@kyleholzinger

I'd be down to help out @phated !

@phated
Member
phated commented Dec 14, 2016

@kyleholzinger awesome! shoot me a PR on the glob-stream repository when you have some tests. Many thanks!

@kyleholzinger

Will do

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment