Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue URL: internal
What is the current behavior?
crowdin@3.5.0is deprecated, and its dependency tree is the source of the repo's only two outstanding advisories,form-data(critical) andgot(moderate).What is the new behavior?
@crowdin/cli@5.0.1, which is maintained and is the package Docusaurus's i18n guide prescribes. Both advisories go with the old tree, and the lockfile drops 333 lines: 50 transitive packages out, 8 in.It's also the package our setup was always written for.
crowdin:synccallscrowdin upload && crowdin download, but the old package is an API client with nobin, so those were commands that didn't exist.Does this introduce a breaking change?
prebuildonly callscrowdin:syncwhenCROWDIN_PERSONAL_TOKENis set, and it isn't set in Vercel. The sync didn't run before and doesn't now.Other information
Whether Crowdin is still in use is unresolved.
crowdin.ymlhasn't been touched since April 2023, while Japanese prose arrives throughscripts/i18n.shfrom the actively maintainedtranslation/jpbranch. Until we know which it is, being on a maintained package beats sitting on a deprecated one with a critical advisory. Removing it outright is the other option, but that decision needs the answer first.Verified without credentials: the CLI parses
crowdin.ymland resolvesapi_token_env; with a placeholder token it reaches Crowdin and stops at authorization, uploading nothing. Plainnpm ciworks and the binary survives it.One thing to note for whoever picks up the ownership question. Two things used to prevent the sync running, no binary and no token. Now only the token does, and if one is added,
crowdin downloadruns afteri18n.shand writes into the same path thetranslation/jptarball unpacks into.