kevva / bin-check Goto Github PK

Because:

1. I don't want to see the logs of spawn-sync's postinstall script though I never use the .sync method.

2. spawn-sync package is quite big (about 0.5 MB 😨).

   $ npm install spawn-sync
   $ du -sh node_modules/spawn-sync
   > 468K  node_modules/spawn-sync
   

This would probably have a positive impact on imagemin/imagemin#97.

Hey team - our app is using bin-check library (actually @swc/cli which uses @mole-inc/bin-wrapper which uses bin-check) in it's latest version (4.1.0 - 6 years ago lol) and it's using execa library, versión ^0.7.0, which has critical vulnerabilities according to gemnasium dependency scanning. this scanner is recommending that we upgrade to version 2.0.0 at least. Upgrading the parent dependency, @swc/cli, to it's latest version unfortunately does nothing, and the vulnerability still appears.

is there any way you guys can upgrade this package to use at least execa version 2.0.0 ?? (latest is 7.0.0)

https://github.com/sindresorhus/execa/releases/tag/v2.0.0

Issue experienced on Linux 3.14: Variable 'msg' in https://github.com/kevva/bin-wrapper/blob/master/index.js#L145 was undefined, while the executable worked just fine.

Have attached a possibly cringe-worthy pull request that fixes the issue, though. Hope it serves to illustrate that at the core, the bug is just that we return on exit of the executable without waiting for the stdout stream to flush, possibly leaving data in the stream.