Skip to content

Remove dependency on gulp-util - #11

Open
jonpearse wants to merge 2 commits into
ben-eb:masterfrom
jonpearse:master
Open

Remove dependency on gulp-util#11
jonpearse wants to merge 2 commits into
ben-eb:masterfrom
jonpearse:master

Conversation

@jonpearse

Copy link
Copy Markdown

gulp-util was deprecated a while back, and while this isn’t the end of the world, it in turn unfortunately depends on a version of lodash with a critical vulnerability.
This was causing security alerts on a project I’m working on, and in turn was causing our CTO to jump up and down in an amusingly animated manner :)

Either way, I’ve switched out replaceExtension calls to use the replace-ext module, and gutil.File to use standard Vinyl objects. I also switched instances of new Buffer() to Buffer.from(string) to get rid of some deprecation warnings.
I’ve not bumped any other deps—I’ll leave that to your discretion. Tests seem to pass OK, but apologies in advance if I’ve missed anything else.

Otherwise, thanks for making this plugin—switching to it shaved a couple minutes off our project’s build time, which makes me all kinds of happy!

jonpearse added 2 commits June 3, 2020 09:31
gulp-util is not only long-deprecated, but relies on a version of lodash.template with severe vulnerability issues.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant