broccoli - npm Package Compare versions

Comparing version 0.13.0 to 0.13.1

CHANGELOG.md

 # master
 
+# 0.13.1
+
+* Update dependencies to fix
+  [various low-severity vulnerabilities](https://github.com/broccolijs/broccoli/issues/196)
+  in `broccoli serve`
+
 # 0.13.0
@@ -4,0 +10,0 @@

docs/symlink-change.md

 # Symlink Behavior In Broccoli Plugins
 
-**Summary:** We will soon be changing the contract between Broccoli plugins to
-mandate that plugins follow symbolic links inside their input trees. This
-includes recursing into symlinked directories.
+**Summary:** We are changing the contract between Broccoli plugins to mandate
+that plugins follow symbolic links inside their input trees. This includes
+recursing into symlinked directories.
 
@@ -45,3 +45,3 @@ ## Background
 
-The change will happen in two parts.
+The change is happening in two parts.
 
@@ -52,4 +52,2 @@ ### Part 1: Transparently Follow Symlinks
 
-This part is currently underway.
-
 This change should be mostly non-breaking. Breakage can occur when there are
@@ -66,3 +64,3 @@ broken symlinks in source trees, which will now result in build failures; and
 
-Notable places where we need to make changes are:
+Here is what plugins need to do accept symlinks:
 
@@ -111,39 +109,47 @@ #### Use `stat` Instead Of `lstat`
 
-#### Helper Packages
+#### Use Up-To-Date Helper Packages
 
-The node-walk-sync and broccoli-kitchen-sink-helpers helper packages currently
-do not follow symlinks. We will soon release updated versions that do. If your
-plugin uses either of those, make sure that you use a [floating version
-spec](https://www.npmjs.org/doc/misc/semver.html#ranges) with "~" or "^" to
-automatically get the update, like so:
+If you are using node-walk-sync or broccoli-kitchen-sink-helpers, be sure to
+use the latest versions, as they have been updated to follow symlinks:
 
 ```js
 "dependencies": {
-  "walk-sync": "^0.1.2",
-  "broccoli-kitchen-sink-helpers": "^0.2.4"
+  "walk-sync": "^0.1.3",
+  "broccoli-kitchen-sink-helpers": "^0.2.5"
 }
 ```
 
-#### Auto-Dereference Symlinks
+#### Do Not Crash On Broken Symlinks (Emacs Lockfiles)
 
-Once we start using symlinks, the output trees generated by plugins may
-contain symlinks.
+Emacs in its default configuration creates lockfiles of the form `.#foo.js`,
+which are broken symlinks. Trying to stat or open a broken symlink throws an
+`ENOENT` exception. It would seem to be wise to not crash when Emacs lockfiles
+appear in input trees.
 
-Broccoli will start automatically dereferencing symlinks in a soon-to-be
-released version, so that the output generated by `broccoli build` will only
-contain regular files and directories.
+When plugins iterate over all files in their input trees, they should
+generally expect to encounter Emacs lockfiles and ignore them [like
+so](https://github.com/joliss/node-walk-sync/blob/b2a3b178ea7bc681d4ab0221686e945f9453645e/index.js#L34-L38)
 
-If you have custom builder code, you may need to invoke
+This applies to directory traversal only. It is OK to crash when a file
+explicitly specified by the user is a broken symlink.
+
+#### Auto-Dereference Symlinks After Build
+
+Once we start emitting symlinks, the final output tree generated by Broccoli
+may contain symlinks into temporary directories.
+
+As of version 0.13.0, Broccoli automatically dereferences symlinks (that is,
+it replaces them with the files or directories they point to) when you call
+`broccoli build`.
+
+If you are maintaining code that uses Broccoli programmatically, use
 [node-copy-dereference](https://github.com/broccolijs/node-copy-dereference)
-on the final build output yourself.
+at the end of each build to dereference symlinks, [like so](https://github.com/broccolijs/broccoli/blob/48e9b5f450f4dd59e424713c7a9c901b15bc6746/lib/cli.js#L33).
 
 ### Part 2: Emit Symlinks As An Optimization
 
-* broccoli-merge-trees
-* later: broccoli-filter
+...
 
-## Emacs Lock Files
-
 ## Performance Gains
 
 ...

lib/builder.js

 var path = require('path')
 var findup = require('findup-sync')
-var Promise = require('rsvp').Promise
+var RSVP = require('rsvp')
 
@@ -18,3 +18,3 @@
 
-  return Promise.resolve()
+  return RSVP.resolve()
     .then(function () {
@@ -53,3 +53,3 @@ return readAndReturnNodeFor(self.tree) // call self.tree.read()
       }
-      return Promise.resolve(nodeCache[index])
+      return RSVP.resolve(nodeCache[index])
     }
@@ -66,3 +66,3 @@ var node = {
     if (typeof tree === 'string') {
-      treeDirPromise = Promise.resolve()
+      treeDirPromise = RSVP.resolve()
         .then(function () {
@@ -79,3 +79,3 @@ if (willReadStringTree) willReadStringTree(tree)
       var readTreeRunning = false
-      treeDirPromise = Promise.resolve()
+      treeDirPromise = RSVP.resolve()
         .then(function () {
@@ -93,3 +93,3 @@ return tree.read(function readTree (subtree) {
 
-            return Promise.resolve()
+            return RSVP.resolve()
               .then(function () {
@@ -96,0 +96,0 @@ return readAndReturnNodeFor(subtree) // recurse

lib/server.js

@@ -39,6 +39,5 @@ var Watcher = require('./watcher')
   var liveReload = function() {
-    // We could pass files: glob.sync('**', {cwd: ...}), but this spams
-    // stdout with messages and Chrome LiveReload doesn't seem to care
-    // about the specific files.
-    livereloadServer.changed({body: {files: ['LiveReload files']}})
+    // Chrome LiveReload doesn't seem to care about the specific files as long
+    // as we pass something.
+    livereloadServer.changed({body: {files: ['livereload_dummy']}})
   }
@@ -45,0 +44,0 @@

package.json

 {
   "name": "broccoli",
   "description": "Fast client-side asset builder",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "author": "Jo Liss <[e-mail]>",
   "main": "lib/index.js",
   "license": "MIT",
+  "keywords": ["builder", "build", "frontend", "browser", "asset", "pipeline"],
   "repository": {
@@ -15,12 +16,12 @@ "type": "git",
     "commander": "^2.0.0",
-    "connect": "~2.14.1",
+    "connect": "^3.2.0",
     "findup-sync": "^0.1.2",
-    "handlebars": "^1.3.0",
+    "handlebars": "^2.0.0",
     "mime": "^1.2.11",
     "copy-dereference": "^1.0.0",
     "rsvp": "^3.0.6",
-    "tiny-lr": "0.0.5"
+    "tiny-lr": "^0.1.4"
   },
   "devDependencies": {
-    "jshint": "~2.3.0",
+    "jshint": "~2.5.6",
     "tap": "^0.4.8"
@@ -27,0 +28,0 @@ },

No alert changes

Improved metrics

Total package byte prevSize

67083

increased by4.14%

Number of package files

23

increased by4.55%

Worsened metrics

Lines of code

469

decreased by-0.21%

Dependency changes

• + Addedbody-parser@1.8.4(transitive)

• + Addedbytes@1.0.0(transitive)

• + Addedconnect@3.7.0(transitive)

• + Addeddebug@2.0.02.6.9(transitive)

• + Addeddepd@0.4.5(transitive)

• + Addedee-first@1.0.51.1.1(transitive)

• + Addedencodeurl@1.0.2(transitive)

• + Addedescape-html@1.0.3(transitive)

• + Addedfaye-websocket@0.7.3(transitive)

• + Addedfinalhandler@1.1.2(transitive)

• + Addedhandlebars@2.0.0(transitive)

• + Addedhttp-parser-js@0.5.9(transitive)

• + Addediconv-lite@0.4.4(transitive)

• + Addedlivereload-js@2.4.0(transitive)

• + Addedmedia-typer@0.3.0(transitive)

• + Addedmime-db@1.12.0(transitive)

• + Addedmime-types@2.0.14(transitive)

• + Addedms@0.6.22.0.0(transitive)

• + Addedon-finished@2.1.02.3.0(transitive)

• + Addedparseurl@1.3.3(transitive)

• + Addedqs@2.2.42.2.5(transitive)

• + Addedraw-body@1.3.0(transitive)

• + Addedsafe-buffer@5.2.1(transitive)

• + Addedstatuses@1.5.0(transitive)

• + Addedtiny-lr@0.1.7(transitive)

• + Addedtype-is@1.5.7(transitive)

• + Addedunpipe@1.0.0(transitive)

• + Addedutils-merge@1.0.1(transitive)

• + Addedwebsocket-driver@0.7.4(transitive)

• + Addedwebsocket-extensions@0.1.4(transitive)

• - Removedabbrev@1.1.1(transitive)

• - Removedbasic-auth-connect@1.0.0(transitive)

• - Removedbatch@0.5.0(transitive)

• - Removedbuffer-crc32@0.2.1(transitive)

• - Removedbytes@0.2.10.3.0(transitive)

• - Removedcompressible@1.0.0(transitive)

• - Removedcompression@1.0.0(transitive)

• - Removedconnect@2.14.5(transitive)

• - Removedconnect-timeout@1.0.0(transitive)

• - Removedcookie@0.1.0(transitive)

• - Removedcookie-parser@1.0.1(transitive)

• - Removedcookie-signature@1.0.3(transitive)

• - Removedcore-util-is@1.0.3(transitive)

• - Removedcsurf@1.1.0(transitive)

• - Removeddebug@0.7.40.8.00.8.1(transitive)

• - Removederrorhandler@1.0.0(transitive)

• - Removedexpress-session@1.0.2(transitive)

• - Removedfaye-websocket@0.4.4(transitive)

• - Removedfresh@0.2.2(transitive)

• - Removedhandlebars@1.3.0(transitive)

• - Removedisarray@0.0.1(transitive)

• - Removedmethod-override@1.0.0(transitive)

• - Removedmethods@1.1.2(transitive)

• - Removedmime@1.2.11(transitive)

• - Removedmorgan@1.0.0(transitive)

• - Removedmultiparty@2.2.0(transitive)

• - Removednegotiator@0.3.00.4.2(transitive)

• - Removednopt@2.0.0(transitive)

• - Removednoptify@0.0.3(transitive)

• - Removedparseurl@1.0.1(transitive)

• - Removedpause@0.0.1(transitive)

• - Removedqs@0.5.60.6.6(transitive)

• - Removedrange-parser@1.0.3(transitive)

• - Removedraw-body@1.1.4(transitive)

• - Removedreadable-stream@1.1.14(transitive)

• - Removedresponse-time@1.0.0(transitive)

• - Removedscmp@0.0.3(transitive)

• - Removedsend@0.3.0(transitive)

• - Removedserve-index@1.0.1(transitive)

• - Removedserve-static@1.1.0(transitive)

• - Removedsetimmediate@1.0.1(transitive)

• - Removedstatic-favicon@1.0.2(transitive)

• - Removedstream-counter@0.2.0(transitive)

• - Removedstring_decoder@0.10.31(transitive)

• - Removedtiny-lr@0.0.5(transitive)

• - Removeduid2@0.0.30.0.4(transitive)

• - Removedutils-merge@1.0.0(transitive)

• - Removedvhost@1.0.0(transitive)

• Updatedconnect@^3.2.0

• Updatedhandlebars@^2.0.0

• Updatedtiny-lr@^0.1.4