Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: correct optional peer dependencies #1238

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

alumni
Copy link

@alumni alumni commented Dec 6, 2024

Currently optional peer dependencies are not declared correctly, they are declared twice: as mandatory peer dependencies as well as optional direct dependencies.

This often causes false positives during security scans. E.g.: preview-email is not needed in production, however it has often been the cause of failing security audits.

This PR aims to declare them according to the package.json spec, i.e. using peerDependenciesMeta. This is available since [email protected] (August 2019), so any package manager in use nowadays should be able to handle this:

With this change, apps relying on @nestjs-modules/mailer will be able to avoid installing some of these optional peer dependencies if they are not needed (e.g. via pnpm.ignoredOptionalDependencies).

@alumni
Copy link
Author

alumni commented Dec 6, 2024

@juandav Could you please review? Thank you :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants