Skip to content

Update [email protected] #1223

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
grease-work-23 opened this issue Mar 27, 2025 · 10 comments · May be fixed by #1226
Open

Update [email protected] #1223

grease-work-23 opened this issue Mar 27, 2025 · 10 comments · May be fixed by #1226
Labels
dependencies Pull requests that update a dependency file help wanted Extra attention is needed

Comments

@grease-work-23
Copy link

grease-work-23 commented Mar 27, 2025

When running cyclondedx v 2.1.0 on node 22 I get:

[INFO] Running 'npx @cyclonedx/cyclonedx-npm --mc-type library --output-file target/frontend.sbom.json' in /home/led/ws/inca1/vertigo/frontend
[INFO] (node:75084) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
[INFO] (Use `node --trace-deprecation ...` to show where the warning was created)

The issue stems from this library using an outdated third-party dep, this is the dep tree;

├─┬ @cyclonedx/[email protected]
│ ├─┬ @cyclonedx/[email protected]
│ │ ├─┬ [email protected] <------ DEPRECATED
│ │ │ ├── [email protected] deduped
│ │ │ ├── [email protected]
│ │ │ ├─┬ [email protected]
│ │ │ │ └── [email protected]
│ │ │ ├─┬ [email protected]
│ │ │ │ └─┬ [email protected]
│ │ │ │   ├── [email protected]
│ │ │ │   ├── [email protected]
│ │ │ │   ├── [email protected]
│ │ │ │   └─┬ [email protected]
│ │ │ │     ├── [email protected]
│ │ │ │     └── [email protected]
│ │ │ └─┬ [email protected]
│ │ │   └── [email protected] deduped
│ │ ├─┬ [email protected]
│ │ │ └── [email protected] deduped
│ │ ├─┬ [email protected]
│ │ │ ├── [email protected] deduped
│ │ │ ├── [email protected]
│ │ │ ├── [email protected]
│ │ │ └── [email protected]
│ │ ├─┬ [email protected]
│ │ │ ├─┬ [email protected]

https://www.npmjs.com/package/ajv-formats-draft2019 is 4 years old and can be updated.

See also CycloneDX/cyclonedx-webpack-plugin#1348 that was closed

@jkowalleck
Copy link
Member

is there any replacement for [email protected]?

@jkowalleck jkowalleck added the dependencies Pull requests that update a dependency file label Mar 27, 2025
@jkowalleck
Copy link
Member

jkowalleck commented Mar 27, 2025

Feel free to pullrequest a solution.

@jkowalleck jkowalleck added the help wanted Extra attention is needed label Mar 27, 2025
@grease-work-23
Copy link
Author

I assumed that ajv-formats is a drop-in replacement for ajv-formats-draft2019 but that might not be the case.

there are other people writing here:
luzlab/ajv-formats-draft2019#29 and the project seems abandoned.

Do you want me or the developers of this project to propose a solution in how to migrate from the abandoned third-party dep ajv-formats-draft2019 ?

@jkowalleck
Copy link
Member

jkowalleck commented Mar 27, 2025

today, there is simply no migration path. we are "stuck" with [email protected].

currently, ajv is our validator of choice, ajv-formats adds most string format validation, and ajv-formats-draft2019 adds validation for "iri-reference"/"idn-email" format.

I would be happy to review any pull request modernizing our dependencies.

@jkowalleck
Copy link
Member

jkowalleck commented Mar 27, 2025

@jkowalleck
Copy link
Member

jkowalleck commented Mar 27, 2025

after reading our code, I noticed

  • "iri-reference" format is not validated, since there is simply no working implementation out there.
  • "idn-email" is used.

offer still stands: feel free to rework/replace the things.
Don't be shy, any change is welcome - even breaking changes - dont worry, release manager will take care of it ;-)

PS: even crafting our own validator with the help of some libs would be acceptable/feasible - see luzlab/ajv-formats-draft2019#22 (comment)

@jkowalleck jkowalleck changed the title Update ajv-formats to v3 Update [email protected] Mar 27, 2025
@grease-work-23 grease-work-23 linked a pull request Mar 27, 2025 that will close this issue
@grease-work-23
Copy link
Author

I made a PR here; #1226. FYI used cursor IDE and ran the tests and it claims that
addFormats2019(ajv, { formats: ['idn-email'] }) can be replaced with ajv.addFormat('idn-email', true) which I noticed wont work,

https://ajv.js.org/guide/formats.html says:

Additional formats in ajv-formats-draft2019
JSON Schema draft-07 also defines formats iri, iri-reference, idn-hostname and idn-email for URLs, hostnames and emails with international characters. These formats are available in ajv-formats-draft2019

(opens new window) plugin.
#

Mabye a good next step is to copy the email format validation from the ajv-formats-draft2019) library?

@jkowalleck
Copy link
Member

Mabye a good next step is to copy the email format validation from the ajv-formats-draft2019) library?

then, go ahead, if you must. remember: copy foreign code falls under licensing and other rights. check carefully what you do there.

@jkowalleck jkowalleck linked a pull request Mar 28, 2025 that will close this issue
@grease-work-23
Copy link
Author

Ok, will look into in when I have some time over, I noted that ajv-formats-draft2019 is licensed under MIT which is ok.

@jkowalleck
Copy link
Member

Ok, will look into in when I have some time over, I noted that ajv-formats-draft2019 is licensed under MIT which is ok.

MIT, eh? then dont forget to include the original license, as the MIT license requires to do

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file help wanted Extra attention is needed
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants