Update rollup-plugin-md for security alerts and modern build by BobKerns · Pull Request #6 · xiaofuzi/rollup-plugin-md

BobKerns · 2020-12-26T22:42:03Z

The plugin is referencing downrev versions of marked and other dependencies that result in security alerts with npm and github.

This updates the dependencies, drops the use of buble, updates how rollup is called, and adds a Github action to do a CI test build.

I also suggest adding the following .github/workflows/npm.yaml file to publish to npm whenever you create a release in github. I did not include it as you may have your own workflow you prefer.

name: Node.js Package
on:
  release:
    types: [created]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      # Setup .npmrc file to publish to npm
      - uses: actions/setup-node@v1
        with:
          node-version: '14.x'
          registry-url: 'https://registry.npmjs.org'
      - run: npm install
      - run: npm publish --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}

BobKerns · 2020-12-26T22:53:10Z

-    const filter = createFilter( options.include || [ '**/*.md'], options.exclude );
-    if(options.marked){
-      marked.setOptions(options.marked)
-    }
-    return {
-        name: 'md',
+	const filter = createFilter( options.include || [ '**/*.md'], options.exclude );
+	if (options.marked) {
+		marked.setOptions(options.marked);
+	}
+	return {
+		name: 'md',

-        transform ( md, id ) {
-            if ( !ext.test( id ) ) return null;
-            if ( !filter( id ) ) return null;
+		transform ( md, id ) {
+			if ( !ext.test( id ) ) return null;
+			if ( !filter( id ) ) return null;

-            const data = marked( md );
-            return {
-                code: `export default ${JSON.stringify(data.toString())};`,
-                map: { mappings: '' }
-            };
-        }
-    };
+			const data = marked( md );
+			return {
+				code: `export default ${JSON.stringify(data.toString())};`,
+				map: { mappings: '' }
+			};
+		}
+	};


Indentation only, no code changes in this section.

BobKerns · 2020-12-26T22:58:00Z

 var rollup = require( 'rollup' );
 var md = require( '../dist/rollup-plugin-md.js' );
-var npm = require( 'rollup-plugin-node-resolve' );
+var npm = require( '@rollup/plugin-node-resolve' );


This plugin moved.

BobKerns · 2020-12-26T22:58:06Z

 function executeBundle ( bundle ) {
-    var generated = bundle.generate();
-    var code = generated.code;
+	var generated = bundle.generate();
+	var code = generated.code;

-    var fn = new Function( 'assert', code );
-    fn( assert );
+	var fn = new Function( 'assert', code );
+	fn( assert );
 }

 describe( 'rollup-plugin-md', function () {
-    it( 'converts md', function () {
-        return rollup.rollup({
-            entry: 'samples/main.js',
-            plugins: [ md({
-                marked: {
-                      gfm: true,
-                      tables: true,
-                      breaks: false,
-                      pedantic: false,
-                      sanitize: true,
-                      smartLists: true,
-                      smartypants: false
-                }
-            }) ]
-        }).then( executeBundle );
-    });
+	it( 'converts md', function () {
+		return rollup.rollup({
+			input: 'samples/main.js',
+			plugins: [ md({
+				marked: {
+					gfm: true,
+					tables: true,
+					breaks: false,
+					pedantic: false,
+					sanitize: true,
+					smartLists: true,
+					smartypants: false
+				}
+			}) ]
+		}).then( executeBundle );
+	});
 });


The code change here is on line 21: 'entry' => 'input' to match the current rollup API. The rest is indentation.

I am not a fan of tabs, but since you set up the .eslint rules to call for it, I invoked the rules, so you would not have mixed indentation.

BobKerns · 2020-12-26T22:59:04Z

-import buble from 'rollup-plugin-buble';
-
-var pkg = require('./package.json')
+var pkg = require('./package.json');


Buble is no longer needed, and no longer works with mocha.

BobKerns · 2020-12-26T22:59:53Z

-    entry: 'src/index.js',
-    plugins: [ buble({ sourceMap: true }) ],
-    targets: [
-        {
-            format: 'cjs',
-            dest: pkg['main']
-        },
-        {
-            format: 'es',
-            dest: pkg['jsnext:main']
-        }
-    ],
-    external: external,
-    sourceMap: true
+	input: 'src/index.js',
+	output: [
+		{
+			format: 'cjs',
+			file: pkg['main'],
+			sourcemap: true,
+			exports: 'auto'
+		},
+		{
+			format: 'es',
+			file: pkg['jsnext:main'],
+			sourcemap: true
+		}
+	],
+	external: external


The rollup API has changed. This should be equivalent.

BobKerns · 2020-12-26T23:00:57Z

  "jsnext:main": "dist/rollup-plugin-md.mjs",
  "scripts": {
-    "test": "mocha test/*.js --compilers js:buble/register",
+    "test": "mocha test/*.js",


The --compilers option is deprecated, and buble/register no longer works. Removed since it is no longer needed.

BobKerns · 2020-12-26T23:15:19Z

This should fix issue #4.

…tial skew with #5.

BobKerns · 2020-12-26T23:57:02Z

This should subsume #5; the changes are a superset.

BobKerns · 2020-12-30T11:07:32Z

It looks like @dagda1 did a substantial amount of work on #5 since, so this is no longer a superset; perhaps even a subset.

I haven't yet reviewed his changes to see if this PR should be closed.

dagda1 · 2020-12-30T12:37:21Z

I haven't yet reviewed his changes to see if this PR should be closed.

@BobKerns I ended up just forking to my own repo and using some of my own packages to build, test and also use my own tsconfig base and eslint.

I did not think this repo was being maintained but if you still want me to reopen with my changes then let me know.

Apologies if I jumped the gun

BobKerns · 2020-12-30T14:38:04Z

Apologies if I jumped the gun

Nothing to apologize for; we're both jumping in here. I don't know if it's maintained or not, @xiaofuzi has had activity in the past few days, so he may pop in here. But they haven't touched this repo in 4 years.

I was reacting to the same issues you were, but you got around to a pull request first.

It looked to me like from the commit comments like you were making it more maintainable. I hope to see this folded together under one umbrella or another.

dagda1 · 2020-12-30T15:33:12Z

@BobKerns I don't think anything will happen here.

Let me know if there is anything I can do.

xiaofuzi · 2020-12-31T07:53:06Z

there are some conflicts

Bumps [marked](https://github.com/markedjs/marked) from 1.2.7 to 4.0.10. - [Release notes](https://github.com/markedjs/marked/releases) - [Changelog](https://github.com/markedjs/marked/blob/master/.releaserc.json) - [Commits](markedjs/marked@v1.2.7...v4.0.10) --- updated-dependencies: - dependency-name: marked dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [lodash](https://github.com/lodash/lodash) from 4.17.20 to 4.17.21. - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.20...4.17.21) --- updated-dependencies: - dependency-name: lodash dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [path-parse](https://github.com/jbgutierrez/path-parse) from 1.0.6 to 1.0.7. - [Release notes](https://github.com/jbgutierrez/path-parse/releases) - [Commits](https://github.com/jbgutierrez/path-parse/commits/v1.0.7) --- updated-dependencies: - dependency-name: path-parse dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [glob-parent](https://github.com/gulpjs/glob-parent) from 5.1.1 to 5.1.2. - [Release notes](https://github.com/gulpjs/glob-parent/releases) - [Changelog](https://github.com/gulpjs/glob-parent/blob/main/CHANGELOG.md) - [Commits](gulpjs/glob-parent@v5.1.1...v5.1.2) --- updated-dependencies: - dependency-name: glob-parent dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

…nt-5.1.2 Bump glob-parent from 5.1.1 to 5.1.2

…e-1.0.7 Bump path-parse from 1.0.6 to 1.0.7

…17.21 Bump lodash from 4.17.20 to 4.17.21

…0.10 Bump marked from 1.2.7 to 4.0.10

Bumps [minimatch](https://github.com/isaacs/minimatch) to 3.1.2 and updates ancestor dependency [mocha](https://github.com/mochajs/mocha). These dependencies need to be updated together. Updates `minimatch` from 3.0.4 to 3.1.2 - [Release notes](https://github.com/isaacs/minimatch/releases) - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.0.4...v3.1.2) Updates `mocha` from 8.2.1 to 10.1.0 - [Release notes](https://github.com/mochajs/mocha/releases) - [Changelog](https://github.com/mochajs/mocha/blob/master/CHANGELOG.md) - [Commits](mochajs/mocha@v8.2.1...v10.1.0) --- updated-dependencies: - dependency-name: minimatch dependency-type: indirect - dependency-name: mocha dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>

…-and-mocha-3.1.2 Bump minimatch and mocha

Bumps [ansi-regex](https://github.com/chalk/ansi-regex) from 5.0.0 to 5.0.1. - [Release notes](https://github.com/chalk/ansi-regex/releases) - [Commits](chalk/ansi-regex@v5.0.0...v5.0.1) --- updated-dependencies: - dependency-name: ansi-regex dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [nanoid](https://github.com/ai/nanoid) to 3.3.3 and updates ancestor dependency [mocha](https://github.com/mochajs/mocha). These dependencies need to be updated together. Updates `nanoid` from 3.1.12 to 3.3.3 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.1.12...3.3.3) Updates `mocha` from 8.2.1 to 10.1.0 - [Release notes](https://github.com/mochajs/mocha/releases) - [Changelog](https://github.com/mochajs/mocha/blob/master/CHANGELOG.md) - [Commits](mochajs/mocha@v8.2.1...v10.1.0) --- updated-dependencies: - dependency-name: nanoid dependency-type: indirect - dependency-name: mocha dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [word-wrap](https://github.com/jonschlinkert/word-wrap) from 1.2.3 to 1.2.4. - [Release notes](https://github.com/jonschlinkert/word-wrap/releases) - [Commits](jonschlinkert/word-wrap@1.2.3...1.2.4) --- updated-dependencies: - dependency-name: word-wrap dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

…x-5.0.1 Bump ansi-regex from 5.0.0 to 5.0.1

…d-mocha-3.3.3 Bump nanoid and mocha

…-1.2.4 Bump word-wrap from 1.2.3 to 1.2.4

Bumps [serialize-javascript](https://github.com/yahoo/serialize-javascript) to 6.0.2 and updates ancestor dependency [mocha](https://github.com/mochajs/mocha). These dependencies need to be updated together. Updates `serialize-javascript` from 6.0.0 to 6.0.2 - [Release notes](https://github.com/yahoo/serialize-javascript/releases) - [Commits](yahoo/serialize-javascript@v6.0.0...v6.0.2) Updates `mocha` from 10.1.0 to 10.8.2 - [Release notes](https://github.com/mochajs/mocha/releases) - [Changelog](https://github.com/mochajs/mocha/blob/main/CHANGELOG.md) - [Commits](mochajs/mocha@v10.1.0...v10.8.2) --- updated-dependencies: - dependency-name: serialize-javascript dependency-version: 6.0.2 dependency-type: indirect - dependency-name: mocha dependency-version: 10.8.2 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>

…6de2e4f1 Bump serialize-javascript and mocha

Bumps [rollup](https://github.com/rollup/rollup) from 2.35.1 to 2.79.2. - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v2.35.1...v2.79.2) --- updated-dependencies: - dependency-name: rollup dependency-version: 2.79.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [braces](https://github.com/micromatch/braces) from 3.0.2 to 3.0.3. - [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md) - [Commits](micromatch/braces@3.0.2...3.0.3) --- updated-dependencies: - dependency-name: braces dependency-version: 3.0.3 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

….79.2 Bump rollup from 2.35.1 to 2.79.2

….0.3 Bump braces from 3.0.2 to 3.0.3

Rename rollup.config with .cjs extension.

BobKerns added 6 commits December 26, 2020 13:53

Update dependencies for security alerts

bb60848

Remove unused import

6df6dba

Update rollup config to modern rollup options

64d5d3b

Add CI build github action.

ed5fa2d

Remove buble and update tests.

2315938

Fix indentation to match existing files and eslint rules.

908c5df

BobKerns commented Dec 26, 2020

View reviewed changes

Bump package version number.

6ef1e60

BobKerns mentioned this pull request Dec 26, 2020

dependencies out of date (throw security warning) #4

Open

Update eslint to 7.16.0, subsumes dependabot pull request #3.

9348524

BobKerns mentioned this pull request Dec 26, 2020

upgrade rollup config work with 2.35.1 and other dependencies #5

Closed

BobKerns added 3 commits December 26, 2020 15:44

Bump version to 1.0.1. The plugin is ver stable, and this avoid poten…

14f444a

…tial skew with #5.

Bring the remaining dependencies up to latest.

c4a6c85

Remove deprecated 'sanitize' option from the test.

2fee9ce

dependabot Bot added 4 commits December 5, 2022 11:33

BobKerns and others added 24 commits December 5, 2022 04:02

Merge pull request #5 from BobKerns/dependabot/npm_and_yarn/glob-pare…

87dfbca

…nt-5.1.2 Bump glob-parent from 5.1.1 to 5.1.2

Merge pull request #4 from BobKerns/dependabot/npm_and_yarn/path-pars…

e2759ad

…e-1.0.7 Bump path-parse from 1.0.6 to 1.0.7

Merge pull request #3 from BobKerns/dependabot/npm_and_yarn/lodash-4.…

922d254

…17.21 Bump lodash from 4.17.20 to 4.17.21

Merge pull request #2 from BobKerns/dependabot/npm_and_yarn/marked-4.…

e048b1d

…0.10 Bump marked from 1.2.7 to 4.0.10

Merge pull request #6 from BobKerns/dependabot/npm_and_yarn/minimatch…

5b1f4e4

…-and-mocha-3.1.2 Bump minimatch and mocha

Merge pull request #7 from BobKerns/dependabot/npm_and_yarn/ansi-rege…

d9c5027

…x-5.0.1 Bump ansi-regex from 5.0.0 to 5.0.1

Merge pull request #8 from BobKerns/dependabot/npm_and_yarn/nanoid-an…

ead8f70

…d-mocha-3.3.3 Bump nanoid and mocha

Merge pull request #9 from BobKerns/dependabot/npm_and_yarn/word-wrap…

d429731

…-1.2.4 Bump word-wrap from 1.2.3 to 1.2.4

Merge pull request #10 from BobKerns/dependabot/npm_and_yarn/multi-45…

2f97ef3

…6de2e4f1 Bump serialize-javascript and mocha

Merge pull request #11 from BobKerns/dependabot/npm_and_yarn/rollup-2…

59f2efe

….79.2 Bump rollup from 2.35.1 to 2.79.2

Merge pull request #12 from BobKerns/dependabot/npm_and_yarn/braces-3…

be25832

….0.3 Bump braces from 3.0.2 to 3.0.3

Bump release # to 1.0.4

938c06e

Update dependencies.

4feda7a

Need a more current version of node.js

c74f20c

Rename rollup.config.js to rollup.config.cjs

f6ee493

Rename rollup.config with .cjs extension.

Update and rename rollup.config.cjs to rollup.config.mjs

b0e8beb

Try it without the assert.

8b08a2c

Conversation

BobKerns commented Dec 26, 2020

Uh oh!

BobKerns Dec 26, 2020

Choose a reason for hiding this comment

Uh oh!

BobKerns Dec 26, 2020

Choose a reason for hiding this comment

Uh oh!

BobKerns Dec 26, 2020

Choose a reason for hiding this comment

Uh oh!

BobKerns Dec 26, 2020

Choose a reason for hiding this comment

Uh oh!

BobKerns Dec 26, 2020

Choose a reason for hiding this comment

Uh oh!

BobKerns Dec 26, 2020

Choose a reason for hiding this comment

Uh oh!

BobKerns commented Dec 26, 2020

Uh oh!

BobKerns commented Dec 26, 2020

Uh oh!

BobKerns commented Dec 30, 2020

Uh oh!

dagda1 commented Dec 30, 2020

Uh oh!

BobKerns commented Dec 30, 2020

Uh oh!

dagda1 commented Dec 30, 2020

Uh oh!

xiaofuzi commented Dec 31, 2020

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants