# Bleeding Edge WARNs (as of June 27th)

**URL:** <https://forums.bitovi.com/t/bleeding-edge-warns-as-of-june-27th/328>\
**Category:** Uncategorized\
**Created:** [June 27, 2016, 1:21pm UTC](https://forums.bitovi.com/t/bleeding-edge-warns-as-of-june-27th/328 "2016-06-27T13:21:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![leoj3n](https://yyz1.discourse-cdn.com/flex035/user_avatar/forums.bitovi.com/leoj3n/32/174_2.png) [@leoj3n](https://forums.bitovi.com/u/leoj3n)\
**Post date:** [June 27, 2016, 1:21pm UTC](https://forums.bitovi.com/t/bleeding-edge-warns-as-of-june-27th/328/1 "2016-06-27T13:21:53Z")

</div>

## With these “bleeding-edge” dependencies in `package.json`:

```auto
  "dependencies": {
    "can-component": "canjs/can-component#master",
    "can-define": "canjs/can-define#master",
    "can-map": "canjs/can-map#master",
    "can-map-define": "canjs/can-map-define#master",
    "can-stache": "canjs/can-stache#master",
    "can-view-autorender": "canjs/can-view-autorender#master",
    "can-view-model": "canjs/can-view-model#master",
    "can-zone": "canjs/can-zone#master",
    "jquery": "~3.0.0",
  },
  "devDependencies": {
    "documentjs": "^0.4.4",
    "done-serve": "donejs/done-serve#can3",
    "donejs-cli": "donejs/cli#can3",
    "generator-donejs": "donejs/generator-donejs#can3",
    "jshint": "^2.9.2",
    "steal": "stealjs/steal#major",
    "steal-css": "stealjs/steal-css#master",
    "steal-stache": "canjs/steal-stache#master",
    "steal-qunit": "stealjs/steal-qunit#master",
    "steal-tools": "stealjs/steal-tools#major",
    "testee": "bitovi/testee#update-dependencies"
  }

```

## These WARNs are generated:

```auto
npm WARN deprecated cross-spawn-async@2.2.4: cross-spawn no longer requires a build toolchain, use it instead!
npm WARN deprecated minimatch@1.0.0: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue
npm WARN deprecated graceful-fs@3.0.8: graceful-fs v3.0.0 and before will fail on node releases >= v7.0. Please update to graceful-fs@^4.0.0 as soon as possible. Use 'npm ls graceful-fs' to find it in the tree.
npm WARN deprecated minimatch@2.0.10: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue
npm WARN deprecated babel-core@5.8.14: Babel 5 is no longer being maintained. Upgrade to Babel 6.
npm WARN deprecated line-numbers@0.2.0: Copy its ~20 LOC directly into your code instead.
npm WARN deprecated minimatch@0.3.0: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue
npm WARN deprecated jade@0.26.3: Jade has been renamed to pug, please install the latest version of pug instead of jade

> fsevents@1.0.12 install /Users/leoj/workspace/donejs-plugin-bootstrap/node_modules/fsevents
> node-pre-gyp install --fallback-to-build

gyp WARN download NVM_NODEJS_ORG_MIRROR is deprecated and will be removed in node-gyp v4, please use NODEJS_ORG_MIRROR
gyp WARN download NVM_NODEJS_ORG_MIRROR is deprecated and will be removed in node-gyp v4, please use NODEJS_ORG_MIRROR
gyp WARN download NVM_NODEJS_ORG_MIRROR is deprecated and will be removed in node-gyp v4, please use NODEJS_ORG_MIRROR

```

## Based on that, here’s everything that should probably be updated:

can-map-define

```auto
─┬ can-map-define@3.0.0-pre.2 (git://github.com/canjs/can-map-define.git#2533465c297654f5f879c677d7d83c029c77b7ce)
 └── jquery@2.2.4 << Update to jQuery 3.0.0 >>

```

documentjs

```auto
─┬ documentjs@0.4.4
 ├─┬ chokidar@1.6.0
 │ ├─┬ fsevents@1.0.12 << NVM_NODEJS_ORG_MIRROR is deprecated and will be removed in node-gyp v4 https://github.com/strongloop/fsevents/issues/136 >>
 │ │ └─┬ node-pre-gyp@0.6.25
 │ │ ├─┬ rimraf@2.5.2
 │ │ │ └─┬ glob@7.0.3
 │ │ │ ├─┬ minimatch@3.0.0 << Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue >>
 │ │ └─┬ tar-pack@3.1.3
 │ │ ├─┬ fstream-ignore@1.0.3
 │ │ │ └─┬ minimatch@3.0.0 << Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue >>
 ├─┬ cross-spawn-async@2.2.4 << cross-spawn no longer requires a build toolchain, use it instead! >>
 ├─┬ less@1.7.5
 │ ├── graceful-fs@3.0.8 << graceful-fs v3.0.0 and before will fail on node releases >= v7.0. Please update to graceful-fs@^4.0.0 as soon as possible. >>
 ├─┬ minimatch@1.0.0 << Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue >>
 ├─┬ steal-tools@0.13.6
 │ ├─┬ glob@4.5.3
 │ │ └── minimatch@2.0.10 << Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue >>
 │ ├─┬ transpile@0.9.7
 │ │ ├─┬ babel-core@5.8.14 << Babel 5 is no longer being maintained. Upgrade to Babel 6. >>
 │ │ │ ├─┬ line-numbers@0.2.0 << Copy its ~20 LOC directly into your code instead. >>
 │ │ │ ├── minimatch@2.0.10 << Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue >>

```

generator-donejs

```auto
─┬ generator-donejs@0.10.0-pre.4 (git://github.com/donejs/generator-donejs.git#6979b518fb2c34e349bd58e0cc397abafd2f4fff)
 └─┬ yeoman-generator@0.20.3
   ├─┬ findup-sync@0.2.1
   │ └─┬ glob@4.3.5
   │ └── minimatch@2.0.10 << Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue >>

```

jshint

```auto
─┬ jshint@2.9.2
 ├─┬ cli@0.6.6
 │ └─┬ glob@3.2.11
 │ └─┬ minimatch@0.3.0 << Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue >>
 ├─┬ minimatch@2.0.10 << Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue >>

```

steal-stache

```auto
─┬ steal-stache@3.0.0-pre.2 (git://github.com/canjs/steal-stache.git#73bc376b5e41b69b45c4953fdf899c94777510a0)
 └── jquery@2.2.4 << Update to jQuery 3.0.0 >>

```

steal-tools

```auto
─┬ steal-tools@1.0.0-beta.0 (git://github.com/stealjs/steal-tools.git#e6bc91cda9167061dbeb914bbd67c1c5fc6b58d5)
 ├─┬ glob@4.5.3
 │ └── minimatch@2.0.10 << Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue >>
 ├─┬ traceur@0.0.91
 │ ├─┬ glob@4.3.5
 │ │ └── minimatch@2.0.10 << Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue >>
 ├─┬ istanbul@0.4.4
 │ ├─┬ fileset@0.2.1
 │ │ └── minimatch@2.0.10 << Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue >>
 ├─┬ miner@0.2.1
 │ ├─┬ browserstacktunnel-wrapper@1.4.2
 │ │ └─┬ unzip@0.1.11
 │ │ ├─┬ fstream@0.1.31
 │ │ │ └── graceful-fs@3.0.8 << graceful-fs v3.0.0 and before will fail on node releases >= v7.0. Please update to graceful-fs@^4.0.0 as soon as possible. >>
 ├─┬ mocha@2.5.3
 │ ├─┬ glob@3.2.11
 │ │ └─┬ minimatch@0.3.0 << Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue >>
 │ ├─┬ jade@0.26.3 << Jade has been renamed to pug, please install the latest version of pug instead of jade >>

```

Which will of course probably be done by upstream maintainers in the near future.

---

<div class="post-metadata">

**Author:** ![leoj3n](https://yyz1.discourse-cdn.com/flex035/user_avatar/forums.bitovi.com/leoj3n/32/174_2.png) [@leoj3n](https://forums.bitovi.com/u/leoj3n)\
**Post date:** [June 27, 2016, 1:33pm UTC](https://forums.bitovi.com/t/bleeding-edge-warns-as-of-june-27th/328/2 "2016-06-27T13:33:27Z")

</div>

I guess the only thing I’m not so sure about is:

Whether or not `can-map-define` and `steal-stache` will (or should) be updated to `jQuery 3.0.0`?

---

<div class="post-metadata">

**Author:** ![matthewp](https://yyz1.discourse-cdn.com/flex035/user_avatar/forums.bitovi.com/matthewp/32/77_2.png) [@matthewp](https://forums.bitovi.com/u/matthewp)\
**Post date:** [June 27, 2016, 8:58pm UTC](https://forums.bitovi.com/t/bleeding-edge-warns-as-of-june-27th/328/3 "2016-06-27T20:58:13Z")

</div>

Thanks for doing all of this research? Mind sending some PRs for the stuff you know can be upgraded?

In regard to jquery, in CanJS 3.0 jQuery won’t be required. I think (or hope) that any can libraries using them are only using them as devDependencies (in tests).

---

<div class="post-metadata">

**Author:** ![leoj3n](https://yyz1.discourse-cdn.com/flex035/user_avatar/forums.bitovi.com/leoj3n/32/174_2.png) [@leoj3n](https://forums.bitovi.com/u/leoj3n)\
**Post date:** [July 2, 2016, 5:47am UTC](https://forums.bitovi.com/t/bleeding-edge-warns-as-of-june-27th/328/4 "2016-07-02T05:47:27Z")

</div>

## can-map-define

- `jquery` - **I’ll send PR** [`2.2.4` ➧ `3.0.0`]

## documentjs

- `chokidar` - awaiting next release - **Will need PR**
  - Waiting on `fsevents` to release with `node-pre-gyp 0.6.29`
    - **Issue** : [https://github.com/strongloop/fsevents/issues/136](https://github.com/strongloop/fsevents/issues/136)

  - `glob`'s `minimatch` - has been updated
  - [`package.json`](https://github.com/isaacs/node-glob/blob/master/package.json#L23)
  - The next releae of `chokidar` should have it because `rimraf` deps `glob@^7.0.0`
  - `fstream-ignore`'s `minimatch` - needs to be updated
    - [`package.json`](https://github.com/npm/fstream-ignore/blob/master/package.json#L17)
    - **Issue** : [https://github.com/npm/fstream-ignore/issues/14](https://github.com/npm/fstream-ignore/issues/14)

- `cross-spawn-async` - has been deprecated - **I’ll send PR** [cross-spawn-async ➧ cross-spawn]
- `less` - **I’ll send PR** [`1.7.5` ➧ `2.7.1`]
  - [`package.json`](https://github.com/less/less.js/blob/master/package.json#L44)
  - `graceful-fs` [`3.0.8` ➧ `4.1.4`]

- `minimatch` - **I’ll send PR** [`1.0.0` ➧ `3.0.2`]
- `steal-tools`'s `glob` - **I’ll send PR** [`4.5.3` ➧ `7.0.5`]
- `transpile` - **Will need PR** (once @matthewp releases `1.0.0`)
  - `babel-core` [currently `5.8.14` ➧ `6.9.1` in `1.0.0-pre.1`]
    - [`package.json`](https://github.com/stealjs/transpile/blob/major/package.json#L11)
    - `line-numbers` - has been removed
    - `minimatch` - has been updated
      - [`package.json`](https://github.com/babel/babel/blob/master/packages/babel-core/package.json#L41)

## generator-donejs

- `yeoman-generator` - **I’ll send PR** [`0.20.3` ➧ `0.23.4`]
  - `findup-sync` - has been removed

## jshint

- Awaiting next release - **Will need PR** (within `generator-donejs` templates)
- `minimatch` && `cli` - have been updated
  - [`05d7a3`](https://github.com/jshint/jshint/commit/05d7a317f910e2565f079df544030c87512cdd58)

## steal-stache

- `jquery` - **I’ll send PR** [`2.2.4` ➧ `3.0.0`]

## steal-tools

- `glob` - **I’ll send PR** [`4.5.3` ➧ `7.0.5`]
- `traceur` - this one is a bit strange _(see below)_ - **I’ll send PR** [`0.0.91` ➧ `0.0.111`]
  - `glob` - [`5.0.x`](https://github.com/google/traceur-compiler/blob/master/package.json#L69) _(kinda old)_
    - `minimatch` - [`2 || 3`](https://github.com/isaacs/node-glob/blob/v5.0.15/package.json#L22) _(implications?)_

- `istanbul`'s `fileset` - needs to be updated - **Will need PR**
  - **Issue** : [https://github.com/gotwarlost/istanbul/issues/653](https://github.com/gotwarlost/istanbul/issues/653)

- `miner` - have no idea where this is coming from _(not in `package.json`???)_
- `mocha` - awaiting next release - **Will need PR**
  - [`package.json`](https://github.com/mochajs/mocha/blob/v3.0.0/package.json#L325)
  - **Issue** : [https://github.com/mochajs/mocha/pull/2325](https://github.com/mochajs/mocha/pull/2325)

- `jade` - **I’ll send PR** [`jade` ➧ `pug`]

Please 👍 the **Issue** links, like I’ve done myself, to let them know we care.  
Here they are again, all in a row:

- [https://github.com/strongloop/fsevents/issues/136](https://github.com/strongloop/fsevents/issues/136)
- [https://github.com/npm/fstream-ignore/issues/14](https://github.com/npm/fstream-ignore/issues/14)
- [https://github.com/gotwarlost/istanbul/issues/653](https://github.com/gotwarlost/istanbul/issues/653)
- [https://github.com/mochajs/mocha/pull/2325](https://github.com/mochajs/mocha/pull/2325)