EDIT: Before using this fix, be aware of the risks...
# javascriptr
Rob Murdock
12/14/2021, 9:35 PMEDIT: Before using this fix, be aware of the risks - see links in thread for details.
passing this along, since I had to dig through things to figure it out for myself -
the 1.6.10 kotlin js plugin automatically defaults to “yarn --ignoreScripts=true”, which can break js libraries that depends on install scripts (I ran into this with an image processing library called sharp)
You can turn it off again by putting
Copy code
yarn.ignoreScripts = falseRob Murdock
12/14/2021, 9:35 PMI assume it was changed for a good reason but I didn’t see anything mentioned in the commit history that introduced the change
t
turansky
12/14/2021, 9:50 PMe
ephemient
12/14/2021, 9:50 PMpart of the resolution of https://blog.jetbrains.com/kotlin/2021/10/important-ua-parser-js-exploit-and-kotlin-js/
install scripts are a terrible idea and should be nuked
👍 1
r
Rob Murdock
12/14/2021, 9:52 PMah very good
Rob Murdock
12/14/2021, 9:52 PMknew there’d be something! 😉
Rob Murdock
12/14/2021, 9:56 PMI added a warning to the top level message. Knowing there are a number of javascript libraries that depend on install scripts to do binary linking, as well as other wacky things, I imagine people will still need to know the workaround for a while
8 Views