Skip to content

Conversation

@alumni
Copy link

@alumni alumni commented Dec 6, 2024

Currently optional peer dependencies are not declared correctly, they are declared twice: as mandatory peer dependencies as well as optional direct dependencies.

This often causes false positives during security scans. E.g.: preview-email is not needed in production, however it has often been the cause of failing security audits.

This PR aims to declare them according to the package.json spec, i.e. using peerDependenciesMeta. This is available since npm@6.11 (August 2019), so any package manager in use nowadays should be able to handle this:

With this change, apps relying on @nestjs-modules/mailer will be able to avoid installing some of these optional peer dependencies if they are not needed (e.g. via pnpm.ignoredOptionalDependencies).

@alumni
Copy link
Author

alumni commented Dec 6, 2024

@juandav Could you please review? Thank you :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants