chore(deps): bump piscina from 3.2.0 to 5.2.0 - #174
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [piscina](https://github.com/piscinajs/piscina) from 3.2.0 to 5.2.0. - [Release notes](https://github.com/piscinajs/piscina/releases) - [Changelog](https://github.com/piscinajs/piscina/blob/v5.2.0/CHANGELOG.md) - [Commits](piscinajs/piscina@v3.2.0...v5.2.0) --- updated-dependencies: - dependency-name: piscina dependency-version: 5.2.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Hi @tuananh , unfortunately it looks like your 1 dependency, piscina, has a fairly serious vulnerability that breaks our audit checks, and the fix by updating to 5.2.0 doesn't work in Node 16 and 17 (Piscina now supports Node.js 20.x and higher). Node 16/17 reached EOL about 3 years ago, 22 is the current LTS version of node. Would you consider dropping 16/17 support and pushing out this fix? |
|
ive been meaning to do that for awhile. |
|
Looks like piscina is up-to-date now, so this is no longer needed. |
|
@esp-edocg Fixed in latest release |
|
Great! Thanks! |
can you share the failed tests. i would like to take a look at that |
Difficult to share because these are integration tests parsing large XML files in a private code base, but for example for the following XML: We had a test that would look at the 3rd |
|
are you using |
|
Yes: |
|
i added a test for that here Line 182 in 89fcbc7 can you try with i also add some perf improvement in there so see if it works for your use cases. |
|
Hm, I get an error when trying to run tests after installing that version |
|
i forgot to publish some new files. my bad |
|
@esp-edocg i cut a test release │ File: index.js
─────┼───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
1 │ const { transform } = require('camaro')
2 │
3 │ async function main() {
4 │ const result = await transform('<item value="42"/>', {
5 │ present: 'number(/item/@value)',
6 │ absent: 'number(/item/@missing)',
7 │ })
8 │
9 │ console.log(result)
10 │ }
11 │
12 │ main()output |
|
That seems to work! Our tests are broken again 😄 |
release 6.5.0 |
|
Thanks! |
2 participants
Bumps piscina from 3.2.0 to 5.2.0.
Release notes
Sourced from piscina's releases.
... (truncated)
Changelog
Sourced from piscina's changelog.
... (truncated)
Commits
8baaa1bchore(release): 5.2.0107b09aMerge commit from fork3eeaa37docs: correct typo 'maintanance' in CONTRIBUTING.md (#1071)b7d4d61fix: include skipQueue in queueSize calculation (#1030)6beabe0feat: Add idleThreads getter (#1059)e104a89chore(deps): Bump fast-uri from 3.0.6 to 3.1.2 in /docs in the npm_and_yarn g...779c640fix: eagerly spawn workers up to maxThreads on cold-pool burst (#1043)469cb93docs: Update Fastify listen() calls to use { port: 3000 } in docs and example...d752afd[Backport v5] chore(deps): docs: Bump lodash from 4.17.23 to 4.18.1 in /docs ...6ed6284chores: gh actions least privilege (#1013) (#1015)Maintainer changes
This version was pushed to npm by metcoder95, a new releaser for piscina since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)