Skip to content

add dependency updater tool to match deno releases#355

Closed
utyfua wants to merge 1 commit intorscarson:masterfrom
utyfua:dep-updater
Closed

add dependency updater tool to match deno releases#355
utyfua wants to merge 1 commit intorscarson:masterfrom
utyfua:dep-updater

Conversation

@utyfua
Copy link
Contributor

@utyfua utyfua commented Apr 1, 2025

I believe we should follow deno releases when we are updating dependencies.

This tool will help to keep it up to date.

I did not update dependecies itself due to additional work required to update to the latest deno version(2.2.6) such as:

  • add a new arg to write_utf8_v2 fn call - None should be fine
  • deal with new unsafe op op_get_ext_import_meta_proto in test::check_op_whitelist - idk what to to here

After using the tool first time it will resolve:

@rscarson
Copy link
Owner

rscarson commented Apr 1, 2025

Very similar to something I built into the rustyscript cli

@utyfua
Copy link
Contributor Author

utyfua commented Apr 2, 2025

  1. Is the rustyscript cli code available anywhere?
  2. What should we do with PR? Its fine if you have own tool or want to make it a separate repository.

utyfua added a commit to utyfua/rustyscript that referenced this pull request May 11, 2025
created using updater script rscarson#355
utyfua added a commit to utyfua/rustyscript that referenced this pull request May 11, 2025
created using updater script rscarson#355
@rscarson
Copy link
Owner

Just fyi, the check_op_whitelist test is to prevent sandbox-breaking vulnerabilties like op_panic

in src/op_whitelist.js you'll find the list. Basically I go to deno or deno_core where the op is defined, review their code to make sure it does not break sandbox, and add it to the list if it is clean

@rscarson
Copy link
Owner

I'd like to integrate this into the rustyscript-cli instead of the main crate!

@rscarson rscarson closed this Aug 16, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants