turbo
1a3ae1d2 - fix: Replace ts-node with tsx to resolve diff DoS vulnerability (#11708)

Commit
113 days ago
fix: Replace ts-node with tsx to resolve diff DoS vulnerability (#11708) ## Summary - Replaces `ts-node` with `tsx` in `@turbo/gen` (production dependency) and removes unused `ts-node` from `@turbo/utils` (devDependency) - Eliminates `diff@4.0.2` (DoS vulnerability in `parsePatch`/`applyPatch`) from the dependency tree entirely ## Context `ts-node@10.9.2` depends on `diff@^4.0.1` which resolved to the vulnerable `4.0.2`. ts-node is effectively unmaintained with no newer release available. `tsx` is an actively maintained drop-in alternative that uses esbuild and has no dependency on `diff`. The only code-level usage of ts-node was in `packages/turbo-gen/src/utils/plop.ts`, where `ts-node`'s `register()` was used to enable TypeScript config file loading for plop generators. This is replaced with `tsx`'s CJS register API (`tsx/cjs/api`), which provides the same require-hook functionality. Ref: TURBO-5241
Author
Parents
Loading