Repository navigation
Bump node-notifier from 8.0.0 to 8.0.1 - #323
Merged
Merged
Conversation
dependabot
Bot
added
the
dependencies
Bumps [node-notifier](https://github.com/mikaelbr/node-notifier) from 8.0.0 to 8.0.1. - [Release notes](https://github.com/mikaelbr/node-notifier/releases) - [Changelog](https://github.com/mikaelbr/node-notifier/blob/v8.0.1/CHANGELOG.md) - [Commits](mikaelbr/node-notifier@v8.0.0...v8.0.1) Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/node-notifier-8.0.1
branch
from
January 19, 2021 16:26
532da64 to
ccf3a38
Compare
rekmarks
approved these changes
Jan 22, 2021
Mrtenz
pushed a commit
that referenced
this pull request
Oct 16, 2025
amitabh94
pushed a commit
to amitabh94/core
that referenced
this pull request
Jun 16, 2026
Naz-Ovh
pushed a commit
to 0x-fork/metamask-core
that referenced
this pull request
Sep 13, 2026
Replaces MetaMask#324, which GitHub auto-closed as merged during a stack reorder when its head briefly became an ancestor of its base. The changes never reached `main`; this carries the same two commits. Mirrors [MetaMask#9976](MetaMask#9976), the bottom of core's foundational stack. | | Before | After | | --- | --- | --- | | `engines.node` | `^18.18 \|\| ^20.14 \|\| >=22` | `^22.14.0 \|\| ^24` | | `@types/node` | `~18.18.14` | `^22.13.14` | | CI matrix | 18, 20, 22 | 22, 24 | `constraints.pro` is updated so `yarn constraints` enforces the new range. Core makes the `@types/node` bump in this same PR rather than with its TypeScript change, since the types track the supported runtime. ## Position in the stack This now sits **below** the ESM conversion (MetaMask#323), so everything up to and including this PR is still a hybrid CJS/ESM build: ``` main → … → MetaMask#322 → this → MetaMask#323 (ESM only) → MetaMask#325 (TypeScript) ``` That matters for testing. A preview build from here still resolves through `main: ./dist/index.cjs` with the `require` condition intact, so it can be consumed by `metamask-extension` as-is. Everything below the ESM cut can therefore be verified against a real downstream consumer before the breaking change lands. <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Semver-breaking runtime requirement may block consumers still on Node 18 or 20; in-repo changes are mostly policy, CI, and test cleanup with limited logic impact. > > **Overview** > **Breaking:** supported Node is now `^22.14.0 || ^24` instead of 18/20/22. That is enforced in `package.json`, `constraints.pro`, and documented under Unreleased in `CHANGELOG.md`. > > CI **prepare**, **test**, and **compatibility-test** jobs now run on Node **22.x** and **24.x** only (18 and 20 dropped from the matrix). Dev typings move from `@types/node` ~18 to **^22.13.14**, with matching `yarn.lock` updates. > > Test and lint tooling align with the new floor: ESLint comments for `n/no-unsupported-features/node-builtins` reflect that global `crypto` is expected on 22+, and `hashing.test.ts` drops the Node 18 `webcrypto` polyfill/`beforeEach` setup—tests assume `globalThis.crypto.subtle` exists. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit ba81eca2d4fa1d9a00faa1bd7e975d1b5d02fc8d. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
Naz-Ovh
pushed a commit
to 0x-fork/metamask-core
that referenced
this pull request
Sep 13, 2026
Top of stack MetaMask#315, on MetaMask#322. Core is moving to an ESM only monorepo ([MetaMask#9536](MetaMask#9536)), so this package should arrive already converted rather than landing as the only hybrid one in it. ## Breaking `require('@metamask/utils')` now fails with `ERR_REQUIRE_ESM`. `main` and `module` are gone, and both `.` and `./node` resolve through `exports` to a single `./dist/*.js` with `./dist/*.d.ts` types. Consumers already using `import` are unaffected. | | Before | After | | --- | --- | --- | | build | `ts-bridge` | `tsc` | | output | `.cjs` + `.mjs` + `.d.cts` + `.d.mts` | `.js` + `.d.ts` | | `@ts-bridge/cli` | yes | removed (`rimraf` added for cleaning) | `ts-bridge` exists to emit both formats, so it goes with the CJS half. ## Import specifiers 102 relative specifiers across 45 files gained explicit `.js` extensions, which ESM requires; directories resolve to `/index.js`. Core's sources already look like this and enforce it with `n/file-extension-in-import`, so the same three import rules are adopted here verbatim. ## Two things only the built output revealed Neither would have been caught by the test suite, because tests run against `src/`: - **`lodash`** — `import { memoize } from 'lodash'` throws at runtime under ESM: Node's lexer cannot see named exports through lodash's CJS. Switched to `lodash/memoize.js`, a default import of the single method. Core hit the same wall and solved it with `lodash-es` plus a jest `moduleNameMapper`; this approach needs neither. - **`@metamask/scure-bip39`** — the deep wordlist import needed an explicit `.js`. Every other CJS dependency survives named imports untouched. `semver`, `@metamask/superstruct`, `@scure/base`, `@noble/hashes` and `pony-cause` all have lexer friendly CJS. Verified by importing all 27 built modules individually, plus the exports map by bare specifier. ## Tooling `jest.config.js` and `.prettierrc.js` are renamed to `.cjs`, since `"type": "module"` makes bare `.js` files ESM. Tests still compile to CommonJS via a ts-jest `transform` override (matching core) with a `moduleNameMapper` stripping the `.js` specifiers back off. `constraints.pro` is rewritten for the single entrypoint shape. <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **High Risk** > Dropping CommonJS and changing the public export map is a breaking integration change for any consumer still on `require()` or dual-package resolution, despite unchanged utility APIs. > > **Overview** > **Breaking:** The package is now **ESM-only** (`"type": "module"`). `main` / dual `import`/`require` exports are removed; `.` and `./node` resolve to single `./dist/*.js` + `./dist/*.d.ts`. Plain `require('@metamask/utils')` fails with `ERR_REQUIRE_ESM` unless consumers use Node 22+ `require(esm)` or dynamic import (noted in `CHANGELOG.md`). > > **Build & publish:** Output moves from `ts-bridge` dual **`.cjs`/`.mjs`** artifacts to **`tsc`-emitted `.js`** (see `tsconfig.build.json` — declarations are emitted with JS, not declaration-only). `@ts-bridge/*` is dropped; **`rimraf`** and `build:clean` handle dist cleanup. Yarn **`constraints.pro`** enforces the new export shape. > > **Sources:** Relative imports across `src/` use explicit **`.js`** specifiers (ESLint **`n/file-extension-in-import`** aligned with core). Runtime fixes for ESM: **`hex.ts`** uses `lodash/memoize.js` (default import) instead of `{ memoize } from 'lodash'`; **`mnemonic.ts`** adds `.js` on the deep `@metamask/scure-bip39` wordlist path. > > **Tooling:** Jest stays on **CommonJS** for tests via `ts-jest` override and a **`moduleNameMapper`** that strips `.js` from relative paths; config stays **`.cjs`** under `"type": "module"`. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 7c27d331053eb210347e8151885a9476ef0b2380. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps node-notifier from 8.0.0 to 8.0.1.
Changelog
Sourced from node-notifier's changelog.
Commits
5d62799v8.0.10c4a80dchore: adds changelogf5a7bc6fix: test casesb9d148dpatch: fixes possible injection issue for notify-sendDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)@dependabot use these labelswill set the current labels as the default for future PRs for this repo and language@dependabot use these reviewerswill set the current reviewers as the default for future PRs for this repo and language@dependabot use these assigneeswill set the current assignees as the default for future PRs for this repo and language@dependabot use this milestonewill set the current milestone as the default for future PRs for this repo and languageYou can disable automated security fix PRs for this repo from the Security Alerts page.