chore: bump chokidar to v4 - #2235
Conversation
Chokidar v4 removed a bunch of its dependencies. Implicit dependecies, such as braces, have critical issues. braces's issue is particular is Uncontrolled resource consumption Updating Chokidar implicitly changes the requirement of supported node to >=14.16.0 since it is a requirement of its dependency: readdirp
✅ Deploy Preview for nodemon ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
|
@remy When you have a spare moment, curious if you have any thoughts |
|
I've not run tests on this yet, but I'm wary of creating a major version bump (because support is reduced). Nodemon doesn't have any telemetry (though there is an updater) so I can't tell with any degree at all how many devs are still on node@12. Just adding this comment so people understand where I'm coming from. I'll do some digging into the pr to understand the change that Chokidar brings and where the lost support is. |
|
Note for testing - CI fails on this test file: |
|
Related issue on Chokiar to see if node@12 can be supported through polyfill: paulmillr/chokidar#1390 |
I think there might be a couple of other test failures as well. I looked at them briefly. I think that the issue is that the nodemon watcher ignore uses glob patterns and glob support was dropped in chokidar 4 in favor of a filter function. If those glob patterns can be replaced that would be the best solution. |
|
@remy any news on that? We're getting hit with security alerts as well because of transient dependencies like picomatch. Can you please update chokidar to v4 or even v5? |
It's a fully breaking change, requiring me to jump to It's still on my radar, but harder to justify. |
Chokidar v4 removed a bunch of its dependencies.
Implicit dependecies, such as braces, have critical issues.
This issue was brought to my attention from Dependabot in my project and is the reason I am proposing this change.
Most notable is that Chokidar v4 reduced its dependencies from 13 to 1.
Updating Chokidar implicitly changes the requirement of supported node to >=14.16.0 since it is a requirement of Chokidar's now only dependency:
Due to the minimum requirement of node being changed to 14.6, I believe that this change requires a nodemon major version bump. I will defer this decision and action to the repo maintainer.
Following are edits by @remy