ionic-team/trapeze

[project] Unused npm-watch dependency

miqmago opened this issue · 6 comments

miqmago commented

The @trapezedev/project depends on npm-watch but it seems not to be used anywhere.

npm-watch seems not to be regularly mantained. npm-watch depends on nodemon@^2.0.7 (06/01/2021).
Right now nodemon is 3.0.1.

On an npm audit fix it raises a Severity: moderate

Maybe this dependency could be removed if not used anywhere.

chacabuk commented

Depends too on mergexml that seems not to be regularly mantained and depend on deprecated "formidable": "^1.2.1"

Ericlm commented

Just wanted to give support to this issue, as npm-watch is blocking updates of nodemon, and triggers vulnerability warning :)

  • 👍2
Ericlm commented

npm-watch received a recent release to address the nodemon dependency.
However, as @trapezedev/project is using npm-watch from 0.9.0 instead of 0.12.0, it continues to trigger audit warnings.
I think the simplest way is to remove the dependency as suggested, or at least upgrade npm-watch to ^0.12.0

  • 👍3