Skip to content

Convert to npm #45

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
peachbits wants to merge 6 commits into
base: master
Choose a base branch
from
Open

Convert to npm #45

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
3f358c4
Convert from yarn to npm
May 26, 2026
f69e946
Apply Socket-recommended security upgrades
Jun 2, 2026
0b41075
Apply major version Socket-recommended security upgrades
peachbits Jun 2, 2026
f026e19
Pin get-func-name to 2.0.2 so chai loads under mocha (fixes ERR_UNKNO…
j0ntz Jun 2, 2026
4cfd8fd
fixup! Convert from yarn to npm
Jun 9, 2026
83af13f
fixup! Apply Socket-recommended security upgrades
Jun 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,6 @@ lib/
*.tgz
node_modules/
npm-debug.log
package-lock.json
yarn-error.log

# Editors:
Expand Down
1 change: 1 addition & 0 deletions .npmrc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
legacy-peer-deps=true
8 changes: 4 additions & 4 deletions .travis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,8 @@ language: node_js
node_js:
- "16"
install:
- yarn install --frozen-lockfile
- yarn prepare
- npm ci
- npm run prepare
script:
- yarn lint
- yarn test
- npm run lint
- npm run test

@cursor cursor Bot Jun 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Agentic Security Review
Severity: MEDIUM

The migration enables dependency lifecycle script execution in CI by replacing yarn install --frozen-lockfile (paired previously with repo-level Yarn --ignore-scripts true) with npm ci while the new root .npmrc does not set ignore-scripts=true. This widens exposure to install-time script execution from compromised or malicious transitive dependencies during CI installs.

Impact: A poisoned dependency could execute arbitrary commands in the CI runner during install, increasing supply-chain attack risk for this repository’s build pipeline.

Fix in Cursor Fix in Web

Reviewed by Cursor Security Reviewer for commit 4cfd8fd. Configure here.

1 change: 0 additions & 1 deletion .yarnrc
View file
Open in desktop

This file was deleted.

2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ Disklet requires a `Promise` implementation, but is plain ES5 otherwise. The lib

## React Native

To use this library on React Native, simply run `react-native link disklet` after installing via yarn / NPM.
To use this library on React Native, simply run `react-native link disklet` after installing via npm install / NPM.

## Legacy API

Expand Down
2 changes: 2 additions & 0 deletions ReactNativeDiskletTest/.npmrc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
legacy-peer-deps=true
ignore-scripts=true
2 changes: 1 addition & 1 deletion ReactNativeDiskletTest/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,6 @@

This app runs Disklet unit tests on React Native.

To launch the tests, first run `yarn install` in this folder to set up the dependencies, and then run either `yarn android` or `yarn ios`.
To launch the tests, first run `npm install` in this folder to set up the dependencies, and then run either `npm run android` or `npm run ios`.
Comment thread
cursor[bot] marked this conversation as resolved.

If you want to edit the Disklet library while using this app, run the `update-rn-test.sh` script located in the outer folder to copy your changes into `node_modules`.
Loading
Loading