-
-
Notifications
You must be signed in to change notification settings - Fork 1.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
chore: bump chokidar to v4 #2235
base: main
Are you sure you want to change the base?
Conversation
Chokidar v4 removed a bunch of its dependencies. Implicit dependecies, such as braces, have critical issues. braces's issue is particular is Uncontrolled resource consumption Updating Chokidar implicitly changes the requirement of supported node to >=14.16.0 since it is a requirement of its dependency: readdirp
✅ Deploy Preview for nodemon ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
@remy When you have a spare moment, curious if you have any thoughts |
I've not run tests on this yet, but I'm wary of creating a major version bump (because support is reduced). Nodemon doesn't have any telemetry (though there is an updater) so I can't tell with any degree at all how many devs are still on node@12. Just adding this comment so people understand where I'm coming from. I'll do some digging into the pr to understand the change that Chokidar brings and where the lost support is. |
Note for testing - CI fails on this test file: |
Related issue on Chokiar to see if node@12 can be supported through polyfill: paulmillr/chokidar#1390 |
I think there might be a couple of other test failures as well. I looked at them briefly. I think that the issue is that the nodemon watcher ignore uses glob patterns and glob support was dropped in chokidar 4 in favor of a filter function. If those glob patterns can be replaced that would be the best solution. |
Chokidar v4 removed a bunch of its dependencies.
Implicit dependecies, such as braces, have critical issues.
This issue was brought to my attention from Dependabot in my project and is the reason I am proposing this change.
Most notable is that Chokidar v4 reduced its dependencies from 13 to 1.
Updating Chokidar implicitly changes the requirement of supported node to >=14.16.0 since it is a requirement of Chokidar's now only dependency:
Due to the minimum requirement of node being changed to 14.6, I believe that this change requires a nodemon major version bump. I will defer this decision and action to the repo maintainer.
Following are edits by @remy