Skip to content

feat: move to maintained fork of gray-matter library - #7511

Open
ignatiusm wants to merge 2 commits into
refinedev:mainfrom
ignatiusm:7510-use-11ty-gray-matter
Open

feat: move to maintained fork of gray-matter library#7511
ignatiusm wants to merge 2 commits into
refinedev:mainfrom
ignatiusm:7510-use-11ty-gray-matter

Conversation

@ignatiusm

Copy link
Copy Markdown

PR Checklist

Please check if your PR fulfills the following requirements:

Bugs / Features

What is the current behavior?

refinedev/cli and refinedev/devtools-server use an unmaintained library gray-matter

What is the new behavior?

refinedev/cli and refinedev/devtools-server have been updated to use 11ty's maintained fork of gray-matter: https://github.com/11ty/gray-matter

fixes 7510

Notes for reviewers

I did not add additional tests, but I did run existing tests for cli (devtools-server has no tests that could run using pnpm test).

@changeset-bot

changeset-bot Bot commented Jul 29, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: be41403

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages
Name Type
@refinedev/devtools-server Minor
@refinedev/cli Minor
@refinedev/devtools Major

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@ignatiusm

ignatiusm commented Jul 29, 2026

Copy link
Copy Markdown
Author

Update: I had a PR on 11ty/gray-matter to use more up-to-date version of a dependency: 11ty/gray-matter#17

That PR has now been merged, so I have updated this PR to point to the latest version of @11ty/gray-matter (which addresses this security alert: https://security.snyk.io/vuln/SNYK-JS-JSYAML-18313070) with commit: be41403

@ignatiusm

Copy link
Copy Markdown
Author

Note in pnpm-lock.yaml there are still references to older versions of js-yaml. I contemplated adding an override to the package.json to address this, but that would expand the scope of this PR too much.

e.g.

diff --git a/package.json b/package.json
index 83e5047ef3..849dd44d88 100644
--- a/package.json
+++ b/package.json
@@ -97,6 +97,9 @@
     "patchedDependencies": {
       "@changesets/git@3.0.0": "patches/@changesets__git@3.0.0.patch",
       "react95@4.0.0": "patches/react95@4.0.0.patch"
+    },
+    "overrides": {
+      "js-yaml": "^5.2.2"
     }
   }
 }

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant