-
Notifications
You must be signed in to change notification settings - Fork 2.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Update deps of run-lifecycle package #2987
Comments
Now that macOS 12.3 has officially removed Python 2, lerna relies on the deprecated/outdated npm-lifecycle and node-gyp packages (of which version 5.0.2 relies on Python 2). Are there plans to migrate to @npmcli/run-script? |
Hi Folks 👋 You may or may not know that lerna is now under the stewardship of Nrwl (announcement here #3121), a company with a long history of not just producing valuable open-source software (OSS), but also backing others (at the time of writing, Nrwl has donated over $50,000 to OSS it hasn't created, see https://opencollective.com/nx for full details). Quite simply, Nrwl ❤️ OSS, and is committed to making lerna the best it can be. We use it ourselves. We hope you will continue to be a part of this community as we look to take things forward from here! Please see #3140 for more details on our plans for 2022. In the case of this specific issue, we already addressed the outdated dependencies mentioned here as part of our v5 release of lerna. If you run into any issues on the latest version of lerna, please feel free to open a new issue and follow the instructions: Many thanks 🙏 |
Since npm 7, npm-lifescyle has been deprecated and its suggested to use @npmcli/run-script: https://github.com/npm/npm-lifecycle. This would also remove outdated deps, such as node-gyp@5.0.2
Expected Behavior
No security alerts
Current Behavior
Security alert because node-gyp@5.0.2 has a dep on tar@4.4.12
Possible Solution
Update the deps
The text was updated successfully, but these errors were encountered: