Leave my git hooks alone

[Bittarman]

Version

5.0.8

Environment info

any

Steps to reproduce

depend on this package, or something that depends on it

What is expected?

No git hooks to be installed / overwritten

What is actually happening?

git hooks being installed / overwritten

---

Remove the dependancy on yorkie, or make it a dev dependency.
To have your git hooks wiped by a dependancy of a dependancy is not expected, and very annoying.

[KSneijders]

It already is a devDependency:

https://github.com/vuejs/vue-cli/blob/dev/package.json#L75

[Dmarch28]

I don’t even know how this is Sent from Mail<https://go.microsoft.com/fwlink/?LinkId=550986> for Windows From: ***@***.***> Sent: Monday, August 15, 2022 12:54 PM To: ***@***.***> Cc: ***@***.***> Subject: Re: [vuejs/vue-cli] Leave my git hooks alone (Issue #7236) It already is a devDependency: https://github.com/vuejs/vue-cli/blob/dev/package.json#L75 — Reply to this email directly, view it on GitHub<#7236 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/ALLSKLKE5ABDZMQEDJQG54DVZJ765ANCNFSM53RNPIDA>. You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[MnM]

OP might be using @vue/cli-plugin-eslint, where it's a regular dependency.

[hamish-smith]

I am using @vue/cli-plugin-eslint 5.0.8 and yorkie is a regular dependency.

https://github.com/vuejs/vue-cli/blob/dev/packages/%40vue/cli-plugin-eslint/package.json#L30C6-L30C12

Is is needed for the plugin to run or should it be a dev dependency?

Also yorkie is using an old version of execa (0.8.0) which has a critical security vulnerability (there is a PR open on yorkie to fix that yyx990803/yorkie#10).

It would be good to drop yorkie down to a dev dependency for the plugin if possible (so that applications using the plugin are not getting pinged on security scans for a critical issue is a transitive dependency that should not be being executed in their application).