Dependabot complaint due to perfectionist dependency

hyperlink (due to assetgraph) is giving me dependabot warnings (CVE-2021-23382) due to hyperlink@5.0.4 requires postcss@^5.0.8 via a transitive dependency on perfectionist@2.4.0

https://github.com/ben-eb/perfectionist was last updated five years ago, and has been archived by the author.

I presume it will be a ‘bit’ of a pain to eliminate this dependency, so I’m wondering if there is an ETA on a version of assetgraph that eliminates the problem? I thought I saw somewhere you had a new major version in the works; am I mistaken (and if not, any ETA?).

I really love your hyperlink package which depends on assetgraph, so I am hoping this is something that is in the works, though that is obviously entirely dependent on your time, energy, interest, etc.

Cheers, and thanks for the great work!

[danielfdickinson]

Dependabot has quit whining! At least for now…

I’ll have to see if your suggestion on my recent commit to my GitHub Action that uses hyperlink (and thus assetgraph) is correct (that it is the use of package-lock.json that is the issue) and if so, if I can change things up so that other people’s tools don’t complain at me about a lack of package-lock.json.

So this issue can be closed, if you wish. Since you get notifications when I @mention you, I will do so in my ‘perfectionist-dfd’ repo as I (hopefully) make progress.

[papandreou]

Getting rid of babel would be nice, and I don’t mind require/common.js. Assetgraph 7.x has to support node.js 12 anyway, and unflagged ESM didn’t land until 13/14.

Looking forward to hear how you’re doing 👏

BTW have you considered using GitHub Discussions? I’m getting a little off-topic, for which I apologize.

It’s fine, really!