Upgrading grunt 0.4 to 1
Breaking0.4.5 → 1.6.3Breaking4Security5Platform2Deprecated1New3Changed32Fixed8Other21
BreakingUpgrade verdict
4 breaking changes and 2 platform requirement changes and 5 security fixes.
In plain terms
- CoffeeScript is no longer bundled. If you load CoffeeScript files, install the coffeescript package yourself.
- Adds a note about a breaking change.
- Upgrades coffee-script to ~1.10.0, which could incur breaking changes in plugins and Gruntfiles.
- Upgrades nopt to ~3.0.6, so `--foo bar` now sets foo to true and runs task bar instead of passing 'bar'.
Must act Top 5 of 12 that need code or config changes
Node.js requirement changed in 1.6.0: >= 0.8.0 → >=16.
Adds grunt-cli ^1.4.3, grunt-known-options ~2.0.0.
Drops async, coffee-script, colors, getobject, hooker, lodash, rimraf, underscore.string, which.
Installs 97 packages in all (was 38).
What you must change
Breaking4
Removes coffeescript from dependencies; Grunt loads it if present, otherwise errors when a CoffeeScript file is loaded.
coffeescriptgrunt --require coffeescript/registerAdds a note about a breaking change.
Upgrades coffee-script to ~1.10.0, which could incur breaking changes in plugins and Gruntfiles.
coffee-scriptUpgrades nopt to ~3.0.6, so
--foo bar now sets foo to true and runs task bar instead of passing 'bar'.noptSecurity5
Updates js-yaml to 3.15.0 to fix a CVE.
js-yamlRace Condition in Grunt
High · CVSS 7.0Path Traversal in Grunt
Moderate · CVSS 5.5Arbitrary Code Execution in grunt
High · CVSS 7.1Updates js-yaml to address npm advisory 788.
js-yamlPlatform2
Drops support for Node versions below 8; only Node >= 8 is supported.
Drops support for Node 0.10 and 0.12.
Deprecations to plan for
Deprecated1
Upgrades lodash to ~4.3.0 and deprecates grunt.util._; template() now returns a compile function and flatten no longer flattens deeply.
grunt.util._grunt.util._.template()grunt.util._.flatten