Dependency Update

[rowanmanning]

We've been putting off some major dependency updates which we should probably look at. Some of these will require a bunch of testing (could we rope QA in?) and reading of changelogs.

It's a big job, so a few of us could take a dependency each:

• csswring
• ejs
• postcss
• qs
• saucelabs

Who knows the most about each of these?

[debugwand]

mincer macros might replace ejs

[andrewmee]

csswring has updated to postcss 5, which has dropped support for node 0.10. We'll need to also drop support for 0.10 in order to update that dependancy.

[andrewmee]

ejs 2.x is a complete rewrite of of the 0.x/1.x code-base we were using. It is however a breaking change since it removes the ability to use filters which was present in the previous version.

Since Shunter allows people to write their own EJS helpers, I believe this will therefore need to be a major version update for us also (though I wouldn't imagine it will have much of an effect in practice).

[andrewmee]

PostCSS probably shouldn't be included explicitly any more (after we update csswring) - it's only used by csswring which is actively maintained, so we can contribute to that project for any updates to PostCSS that we want.

[andrewmee]

It looks like the qs team wants out; ljharb/qs#140.
In light of that, we might be better off switching to something else which will be actively supported - particularly if we don't foresee a need for any of the more complex behaviours that qs supports.

Otherwise you can see a summary of the breaking changes between our current 3.0 and their latest 6.0 release here: https://github.com/hapijs/qs/issues?q=label%3A%22breaking+changes%22+is%3Aclosed

[andrewmee]

Mincer can't be updated to 1.4 until csswring is updated; https://github.com/nodeca/mincer#notice-on-upgrade-to-14x

[rowanmanning]

@andrewmee: so if we do drop Node.js 0.10/0.12 support (#110), then we can update all of these dependencies?

[andrewmee]

@rowanmanning csswring requires Node.js >= 5.0.0, annoyingly. So we can't update that all the way to the latest without also dropping support for Node.js v4 (which I think is premature). But we can use csswring 4.x.

[rowanmanning]

Yeah Node.js 4 has long term support until 2018-04-01 so that's super premature 😐 surprises me that they did that