Update rollup-plugin-md for security alerts and modern build #6

BobKerns · 2020-12-26T22:42:03Z

The plugin is referencing downrev versions of marked and other dependencies that result in security alerts with npm and github.

This updates the dependencies, drops the use of buble, updates how rollup is called, and adds a Github action to do a CI test build.

I also suggest adding the following .github/workflows/npm.yaml file to publish to npm whenever you create a release in github. I did not include it as you may have your own workflow you prefer.

name: Node.js Package
on:
  release:
    types: [created]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      # Setup .npmrc file to publish to npm
      - uses: actions/setup-node@v1
        with:
          node-version: '14.x'
          registry-url: 'https://registry.npmjs.org'
      - run: npm install
      - run: npm publish --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}

BobKerns · 2020-12-26T22:53:10Z

src/index.js

-    const filter = createFilter( options.include || [ '**/*.md'], options.exclude );
-    if(options.marked){
-      marked.setOptions(options.marked)
-    }
-    return {
-        name: 'md',
+	const filter = createFilter( options.include || [ '**/*.md'], options.exclude );
+	if (options.marked) {
+		marked.setOptions(options.marked);
+	}
+	return {
+		name: 'md',

-        transform ( md, id ) {
-            if ( !ext.test( id ) ) return null;
-            if ( !filter( id ) ) return null;
+		transform ( md, id ) {
+			if ( !ext.test( id ) ) return null;
+			if ( !filter( id ) ) return null;

-            const data = marked( md );
-            return {
-                code: `export default ${JSON.stringify(data.toString())};`,
-                map: { mappings: '' }
-            };
-        }
-    };
+			const data = marked( md );
+			return {
+				code: `export default ${JSON.stringify(data.toString())};`,
+				map: { mappings: '' }
+			};
+		}
+	};


Indentation only, no code changes in this section.

BobKerns · 2020-12-26T22:58:00Z

test/test.js

-var npm = require( 'rollup-plugin-node-resolve' );
+var npm = require( '@rollup/plugin-node-resolve' );


This plugin moved.

BobKerns · 2020-12-26T22:58:06Z

test/test.js

-    var generated = bundle.generate();
-    var code = generated.code;
+	var generated = bundle.generate();
+	var code = generated.code;

-    var fn = new Function( 'assert', code );
-    fn( assert );
+	var fn = new Function( 'assert', code );
+	fn( assert );
 }

 describe( 'rollup-plugin-md', function () {
-    it( 'converts md', function () {
-        return rollup.rollup({
-            entry: 'samples/main.js',
-            plugins: [ md({
-                marked: {
-                      gfm: true,
-                      tables: true,
-                      breaks: false,
-                      pedantic: false,
-                      sanitize: true,
-                      smartLists: true,
-                      smartypants: false
-                }
-            }) ]
-        }).then( executeBundle );
-    });
+	it( 'converts md', function () {
+		return rollup.rollup({
+			input: 'samples/main.js',
+			plugins: [ md({
+				marked: {
+					gfm: true,
+					tables: true,
+					breaks: false,
+					pedantic: false,
+					sanitize: true,
+					smartLists: true,
+					smartypants: false
+				}
+			}) ]
+		}).then( executeBundle );
+	});
 });


The code change here is on line 21: 'entry' => 'input' to match the current rollup API. The rest is indentation.

I am not a fan of tabs, but since you set up the .eslint rules to call for it, I invoked the rules, so you would not have mixed indentation.

BobKerns · 2020-12-26T22:59:04Z

rollup.config.js

-import buble from 'rollup-plugin-buble';
-
-var pkg = require('./package.json')
+var pkg = require('./package.json');


Buble is no longer needed, and no longer works with mocha.

BobKerns · 2020-12-26T22:59:53Z

rollup.config.js

-    entry: 'src/index.js',
-    plugins: [ buble({ sourceMap: true }) ],
-    targets: [
-        {
-            format: 'cjs',
-            dest: pkg['main']
-        },
-        {
-            format: 'es',
-            dest: pkg['jsnext:main']
-        }
-    ],
-    external: external,
-    sourceMap: true
+	input: 'src/index.js',
+	output: [
+		{
+			format: 'cjs',
+			file: pkg['main'],
+			sourcemap: true,
+			exports: 'auto'
+		},
+		{
+			format: 'es',
+			file: pkg['jsnext:main'],
+			sourcemap: true
+		}
+	],
+	external: external


The rollup API has changed. This should be equivalent.

BobKerns · 2020-12-26T23:00:57Z

package.json

-    "test": "mocha test/*.js --compilers js:buble/register",
+    "test": "mocha test/*.js",


The --compilers option is deprecated, and buble/register no longer works. Removed since it is no longer needed.

BobKerns · 2020-12-26T23:15:19Z

This should fix issue #4.

…tial skew with #5.

BobKerns · 2020-12-26T23:57:02Z

This should subsume #5; the changes are a superset.

BobKerns · 2020-12-30T11:07:32Z

It looks like @dagda1 did a substantial amount of work on #5 since, so this is no longer a superset; perhaps even a subset.

I haven't yet reviewed his changes to see if this PR should be closed.

dagda1 · 2020-12-30T12:37:21Z

I haven't yet reviewed his changes to see if this PR should be closed.

@BobKerns I ended up just forking to my own repo and using some of my own packages to build, test and also use my own tsconfig base and eslint.

I did not think this repo was being maintained but if you still want me to reopen with my changes then let me know.

Apologies if I jumped the gun

BobKerns · 2020-12-30T14:38:04Z

Apologies if I jumped the gun

Nothing to apologize for; we're both jumping in here. I don't know if it's maintained or not, @xiaofuzi has had activity in the past few days, so he may pop in here. But they haven't touched this repo in 4 years.

I was reacting to the same issues you were, but you got around to a pull request first.

It looked to me like from the commit comments like you were making it more maintainable. I hope to see this folded together under one umbrella or another.

dagda1 · 2020-12-30T15:33:12Z

@BobKerns I don't think anything will happen here.

Let me know if there is anything I can do.

xiaofuzi · 2020-12-31T07:53:06Z

there are some conflicts

Bumps [marked](https://github.com/markedjs/marked) from 1.2.7 to 4.0.10. - [Release notes](https://github.com/markedjs/marked/releases) - [Changelog](https://github.com/markedjs/marked/blob/master/.releaserc.json) - [Commits](markedjs/marked@v1.2.7...v4.0.10) --- updated-dependencies: - dependency-name: marked dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]>

Bumps [lodash](https://github.com/lodash/lodash) from 4.17.20 to 4.17.21. - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.20...4.17.21) --- updated-dependencies: - dependency-name: lodash dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]>

Bumps [path-parse](https://github.com/jbgutierrez/path-parse) from 1.0.6 to 1.0.7. - [Release notes](https://github.com/jbgutierrez/path-parse/releases) - [Commits](https://github.com/jbgutierrez/path-parse/commits/v1.0.7) --- updated-dependencies: - dependency-name: path-parse dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]>

Bumps [glob-parent](https://github.com/gulpjs/glob-parent) from 5.1.1 to 5.1.2. - [Release notes](https://github.com/gulpjs/glob-parent/releases) - [Changelog](https://github.com/gulpjs/glob-parent/blob/main/CHANGELOG.md) - [Commits](gulpjs/glob-parent@v5.1.1...v5.1.2) --- updated-dependencies: - dependency-name: glob-parent dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]>

…nt-5.1.2 Bump glob-parent from 5.1.1 to 5.1.2

…e-1.0.7 Bump path-parse from 1.0.6 to 1.0.7

…17.21 Bump lodash from 4.17.20 to 4.17.21

…0.10 Bump marked from 1.2.7 to 4.0.10

Bumps [minimatch](https://github.com/isaacs/minimatch) to 3.1.2 and updates ancestor dependency [mocha](https://github.com/mochajs/mocha). These dependencies need to be updated together. Updates `minimatch` from 3.0.4 to 3.1.2 - [Release notes](https://github.com/isaacs/minimatch/releases) - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.0.4...v3.1.2) Updates `mocha` from 8.2.1 to 10.1.0 - [Release notes](https://github.com/mochajs/mocha/releases) - [Changelog](https://github.com/mochajs/mocha/blob/master/CHANGELOG.md) - [Commits](mochajs/mocha@v8.2.1...v10.1.0) --- updated-dependencies: - dependency-name: minimatch dependency-type: indirect - dependency-name: mocha dependency-type: direct:development ... Signed-off-by: dependabot[bot] <[email protected]>

…-and-mocha-3.1.2 Bump minimatch and mocha

BobKerns added 6 commits December 26, 2020 13:53

Update dependencies for security alerts

bb60848

Remove unused import

6df6dba

Update rollup config to modern rollup options

64d5d3b

Add CI build github action.

ed5fa2d

Remove buble and update tests.

2315938

Fix indentation to match existing files and eslint rules.

908c5df

BobKerns commented Dec 26, 2020

View reviewed changes

Bump package version number.

6ef1e60

BobKerns mentioned this pull request Dec 26, 2020

dependencies out of date (throw security warning) #4

Open

Update eslint to 7.16.0, subsumes dependabot pull request #3.

9348524

BobKerns mentioned this pull request Dec 26, 2020

upgrade rollup config work with 2.35.1 and other dependencies #5

Closed

BobKerns added 3 commits December 26, 2020 15:44

Bump version to 1.0.1. The plugin is ver stable, and this avoid poten…

14f444a

…tial skew with #5.

Bring the remaining dependencies up to latest.

c4a6c85

Remove deprecated 'sanitize' option from the test.

2fee9ce

dependabot bot added 4 commits December 5, 2022 11:33

BobKerns and others added 6 commits December 5, 2022 04:02

Merge pull request #5 from BobKerns/dependabot/npm_and_yarn/glob-pare…

87dfbca

…nt-5.1.2 Bump glob-parent from 5.1.1 to 5.1.2

Merge pull request #4 from BobKerns/dependabot/npm_and_yarn/path-pars…

e2759ad

…e-1.0.7 Bump path-parse from 1.0.6 to 1.0.7

Merge pull request #3 from BobKerns/dependabot/npm_and_yarn/lodash-4.…

922d254

…17.21 Bump lodash from 4.17.20 to 4.17.21

Merge pull request #2 from BobKerns/dependabot/npm_and_yarn/marked-4.…

e048b1d

…0.10 Bump marked from 1.2.7 to 4.0.10

Merge pull request #6 from BobKerns/dependabot/npm_and_yarn/minimatch…

5b1f4e4

…-and-mocha-3.1.2 Bump minimatch and mocha

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update rollup-plugin-md for security alerts and modern build #6

Update rollup-plugin-md for security alerts and modern build #6

BobKerns commented Dec 26, 2020

BobKerns Dec 26, 2020

BobKerns Dec 26, 2020

BobKerns Dec 26, 2020

BobKerns Dec 26, 2020

BobKerns Dec 26, 2020

BobKerns Dec 26, 2020

BobKerns commented Dec 26, 2020

BobKerns commented Dec 26, 2020

BobKerns commented Dec 30, 2020

dagda1 commented Dec 30, 2020

BobKerns commented Dec 30, 2020

dagda1 commented Dec 30, 2020

xiaofuzi commented Dec 31, 2020

		var npm = require( 'rollup-plugin-node-resolve' );
		var npm = require( '@rollup/plugin-node-resolve' );

		"test": "mocha test/*.js --compilers js:buble/register",
		"test": "mocha test/*.js",

Update rollup-plugin-md for security alerts and modern build #6

Are you sure you want to change the base?

Update rollup-plugin-md for security alerts and modern build #6

Conversation

BobKerns commented Dec 26, 2020

BobKerns Dec 26, 2020

Choose a reason for hiding this comment

BobKerns Dec 26, 2020

Choose a reason for hiding this comment

BobKerns Dec 26, 2020

Choose a reason for hiding this comment

BobKerns Dec 26, 2020

Choose a reason for hiding this comment

BobKerns Dec 26, 2020

Choose a reason for hiding this comment

BobKerns Dec 26, 2020

Choose a reason for hiding this comment

BobKerns commented Dec 26, 2020

BobKerns commented Dec 26, 2020

BobKerns commented Dec 30, 2020

dagda1 commented Dec 30, 2020

BobKerns commented Dec 30, 2020

dagda1 commented Dec 30, 2020

xiaofuzi commented Dec 31, 2020