Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Vulnerability] es-lint-config: Glob@7.2.3 dependency Inflight@1.0.6 contains memory leak #8271

Open
rreeves8 opened this issue Dec 12, 2023 · 3 comments
Labels
bug:unverified dependencies Pull requests that update a dependency file package:eslint-config

Comments

@rreeves8
Copy link

rreeves8 commented Dec 12, 2023

Vulnerability in dependency es-lint

Glob version is outdated using inflight dependency that contains memory leak. Rimraf version should be set to 5.0.5 to in package flat-cache to resolve.

package remix-eslint-config

Screenshot 2023-12-12 at 4 40 30 PM

snyk

#isaacs/inflight#5

@rreeves8
Copy link
Author

rreeves8 commented Dec 12, 2023

this is a build step so not a pressing issue, but will help resolve teams code scanners from freaking out allow remix to pass security scan

@rreeves8 rreeves8 changed the title [Vulnerability] Glob@7.2.3 dependency Inflight@1.0.6 contains memory leak [Vulnerability] es-lint-config: Glob@7.2.3 dependency Inflight@1.0.6 contains memory leak Dec 12, 2023
@brophdawg11
Copy link
Contributor

We'd accept a community PR for this if you'd be interested, but FWIW we're planning to deprecate the @remix-run/eslint-config package in favor of industry "recomended" presets. It's really a team decision (not Remix's!) what your lint rules should look like so we'll be starting Remix apps off with a minimal config of industry best practice rules (see https://github.com/remix-run/indie-stack/blob/main/.eslintrc.js for an example).

@brophdawg11 brophdawg11 added package:eslint-config dependencies Pull requests that update a dependency file labels Dec 13, 2023
@rreeves8
Copy link
Author

We'd accept a community PR for this if you'd be interested, but FWIW we're planning to deprecate the @remix-run/eslint-config package in favor of industry "recomended" presets. It's really a team decision (not Remix's!) what your lint rules should look like so we'll be starting Remix apps off with a minimal config of industry best practice rules (see https://github.com/remix-run/indie-stack/blob/main/.eslintrc.js for an example).

Thats great to hear! Just waiting on the package flat-cache to be updated, once it is I'll try and get some pr's with new package versions.

Maybe this will be implemented by then anyway

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug:unverified dependencies Pull requests that update a dependency file package:eslint-config
Projects
None yet
Development

No branches or pull requests

2 participants