Bump which to v4
#139
Bump which to v4
#139
Conversation
This comment was marked as outdated.
This comment was marked as outdated.
| @@ -12,6 +12,10 @@ var sandbox = require('sandboxed-module'); | |||
| var binary = utils.normalizeBinary; | |||
|
|
|||
| sandbox.configure({ | |||
| requires: { | |||
| // sandboxed-module is unable to find this module directly | |||
There was a problem hiding this comment.
... because it is not listed at https://github.com/felixge/node-sandboxed-module/blob/v2.0.4/lib/builtin_modules.json and would therefore result in the module being resolved as a relative file path?
There was a problem hiding this comment.
I opened a PR upstream. This PR can be merged in the meanwhile because that package hasn't seen updates in 4 years.
| @@ -23,7 +23,7 @@ | |||
| "dependencies": { | |||
| "commander": "2.9.0", | |||
| "shell-quote": "1.8.1", | |||
| "which": "1.2.4", | |||
| "which": "^4.0.0", | |||
There was a problem hiding this comment.
Version 4.0.0 drops Node 14 support, and does not have other significant changes, per https://github.com/npm/node-which/blob/main/CHANGELOG.md#400-2023-08-29
If we are planning to release a major version then this lgtm. Otherwise we should use 3.0.1 instead.
Considering that we are indeed preparing for a major version in #89, 4.0.0 here is acceptable.
In retrospect, I should have updated
whichbefore or together with droppingwhen😅 but hindsight is 20/20