A one-line package broke `npm create-react-app`

#1

Post by tessela » Sat, Apr 25, 2020, 4:31 PM UTC

A one-line package broke `npm create-react-app`
github.com

Re: A one-line package broke `npm create-react-app`

#2

Post by TechBro8615 » Sat, Apr 25, 2020, 5:14 PM UTC

The package referred to in the clickbait title is `is-promise`

Re: A one-line package broke `npm create-react-app`

#3

Post by 0xff00ffee » Sat, Apr 25, 2020, 5:15 PM UTC

This is why regression suites are important.

EDIT: I wasn't dissing the developers. They have regression, this was just an accident. I was stating it is important. My bad (too late to delete).

Re: A one-line package broke `npm create-react-app`

#4

Post by SSchick » Sat, Apr 25, 2020, 5:16 PM UTC

Probably also broke eslint too since `is-promise` is also a sub-dependency of that as well.

This is much less of an issue when using a lockfile, at least for existing packages/projects.

Re: A one-line package broke `npm create-react-app`

#5

Post by esaym » Sat, Apr 25, 2020, 5:16 PM UTC

You had one job...

Re: A one-line package broke `npm create-react-app`

#6

Post by ajross » Sat, Apr 25, 2020, 5:17 PM UTC

TechBro8615 wrote: post #2

The package referred to in the clickbait title is `is-promise`

I don't know how "clickbait" that title can be when it is, in fact, longer than the line of code in question:

    declare function isPromise(obj: Promise | S): obj is Promise;

This is, indeed, the only line of exported code in the entire package.

I genuinely don't understand the NPM world.

Re: A one-line package broke `npm create-react-app`

#7

Post by chvid » Sat, Apr 25, 2020, 5:17 PM UTC

And the source code of the library is:

   function isPromise(obj) {
     return !!obj && (typeof obj === 'object' || typeof obj === 'function') && typeof obj.then === 'function';
   }

Re: A one-line package broke `npm create-react-app`

#8

Post by SSchick » Sat, Apr 25, 2020, 5:18 PM UTC

0xff00ffee wrote: post #3

This is why regression suites are important. EDIT: I wasn't dissing the developers. They have regression, this was just an accident. I was stating it is important. My bad (too late to delete).

The package does have CI setup, however the test matrix does not cover the latest node versions (which are the ones that are affected).

See https://github.com/then/is-promise/blob/master/.travis.yml (missing v11, v12, v13, v14)

Re: A one-line package broke `npm create-react-app`

#9

Post by ng12 » Sat, Apr 25, 2020, 5:18 PM UTC

Looks like it broke @angular/cli too.

Re: A one-line package broke `npm create-react-app`

#10

Post by RyJones » Sat, Apr 25, 2020, 5:19 PM UTC

SSchick wrote: post #8

0xff00ffee wrote: post #3

This is why regression suites are important. EDIT: I wasn't dissing the developers. They have regression, this was just an accident. I was stating it is important. My bad (too late to delete).

The package does have CI setup, however the test matrix does not cover the latest node versions (which are the ones that are affected). See https://github.com/then/is-promise/blob/master/.travis.yml (missing v11, v12, v13, v14)

And CI is failing[0].

[0]: https://travis-ci.org/github/then/is-promise/builds