Skip to content

Fix severe vulnerability in cross-spawn; convert project from CommonJS to ES Modules#10

Open
aasmith2021 wants to merge 13 commits into
yyx990803:masterfrom
aasmith2021:convert-from-commonjs-to-esm
Open

Fix severe vulnerability in cross-spawn; convert project from CommonJS to ES Modules#10
aasmith2021 wants to merge 13 commits into
yyx990803:masterfrom
aasmith2021:convert-from-commonjs-to-esm

Conversation

@aasmith2021

@aasmith2021 aasmith2021 commented Aug 8, 2025

Copy link
Copy Markdown

Description

This PR updates yorkie from using CommonJS modules to ES Modules, and updates all dependencies to the latest version. As a result, the version of Node needed to run yorkie is now at least version 20.6.0.

Updating the dependencies to the latest version fixes a severe vulnerability found in the cross-spawn dependency.

@aasmith2021

aasmith2021 commented Aug 8, 2025

Copy link
Copy Markdown
Author

Hi @yyx990803! I really enjoy using yorkie for its simplicity! I created this PR to update yorkie because:

There's an advisory about a severe vulnerability using cross-spawn < 7.0.5, and I wanted to remove that vulnerability so that yorkie doesn't have any existing vulnerabilities.

Let me know if you see anything that needs to be updated - I'm happy to make any changes!

@aasmith2021 aasmith2021 changed the title Convert project from CommonJS to ES Modules Fix severe vulnerability in cross-spawn; convert project from CommonJS to ES Modules Aug 8, 2025
@hamish-smith

Copy link
Copy Markdown

Hi @yyx990803! I really enjoy using yorkie for its simplicity! I created this PR to update yorkie because:

There's an advisory about a severe vulnerability using cross-spawn < 7.0.5, and I wanted to remove that vulnerability so that yorkie doesn't have any existing vulnerabilities.

Let me know if you see anything that needs to be updated - I'm happy to make any changes!

Literally came here looking to see if execa could be upgraded. Thankyou! @aasmith2021!

@aasmith2021

Copy link
Copy Markdown
Author

Hi @yyx990803! Thank you for your work on yorkie — it's been a valuable tool that I've used on many projects. I put together this PR to help modernize some of its dependencies.

There seems to be some community interest in keeping it up to date. If you have a moment, I’d really appreciate your feedback. Totally understand if time is limited — just wanted to offer a small contribution to help. Thanks again!

@Loftee

Loftee commented Oct 2, 2025

Copy link
Copy Markdown

Came here for this exact issue. Would be great to have this PR merged in. @aasmith2021 thanks for your work!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants