Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Totally remove lodash #1247

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Totally remove lodash #1247

wants to merge 3 commits into from

Conversation

JbIPS
Copy link

@JbIPS JbIPS commented Jul 22, 2024

Replace lodash functions by ESNext style functions or by deepmerge-ts (lighter and more maintened)

Replace lodash functions by ESNext style functions or by deepmerge-ts
(lighter and more maintened)
@w666 w666 self-requested a review July 23, 2024 06:41
pnpm-lock.yaml Outdated
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We use npm, please remove this file and run npm install so package-lock is in sync.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry I missed that. It's fixed

JbIPS added 2 commits July 23, 2024 09:26
`deepmerge-ts` seems to have an
[issue](RebeccaStevens/deepmerge-ts#488) with
a type file.

Skipping lib check in `tsconfig.json`
([doc](https://www.typescriptlang.org/tsconfig/#skipLibCheck)) works
around that and will increase compile time without drawbacks.
@w666
Copy link
Collaborator

w666 commented Aug 2, 2024

Seems like tests do not quite work.

@@ -368,7 +367,7 @@ export class Client extends EventEmitter {
if (!output || !output.$lookupTypes) {
debug('Response element is not present. Unable to convert response xml to json.');
// If the response is JSON then return it as-is.
const json = _.isObject(body) ? body : tryJSONparse(body);
const json = body !== null && typeof body === 'object' ? body : tryJSONparse(body);
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

body can be undefined, should be something like

const json = body && typeof body === 'object' ? body : tryJSONparse(body);

@w666
Copy link
Collaborator

w666 commented Aug 20, 2024

I was thinking about this change and don't see any benefits in removing lodash. While it was not updated for 4 years, seems like version 5 will be released at some point.

After my recent changes node-soap does not contain any vulnerabilities.

If you have different point of view ii I happy to discuss it.

@JbIPS
Copy link
Author

JbIPS commented Aug 20, 2024

I will update this PR after summer break.

Concerning the why, I have 2 reasons to remove this kind of dependency:

  • It can be considered as "unmaintained" after 4 years, and I personally doubt it will have a rebirth. The discovery of a vuln seems bound to happen
  • Most of the useful functions are now in the standard API
  • The package weight 1.41MB and you're just cherry-picking a few functions

I understand those are very opinionated reasons and I'll understand if you do not wish to remove it.

@w666
Copy link
Collaborator

w666 commented Aug 21, 2024

Hi @JbIPS,

Okay, happy to discuss proposed solution.

@w666
Copy link
Collaborator

w666 commented Oct 22, 2024

I had another look on it ... that is not that easy, deepmerge-ts is not enough. Some stuff can be replaced with native JS features, but not all. Too much work to replace what works just fine.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants