Upgrading npm-run-all 1 to 2
Breaking1.8.0 → 2.3.0Breaking3Security2Deprecated1New5Changed2
SecurityUpgrades shell-quote to address a command injection advisory.shell-quote_command-injection ↗
BreakingUpgrade verdict
3 breaking changes and 2 security fixes.
In plain terms
- The short flags -S and -P no longer exist; use -c or -c -p instead.
- With --continue-on-error, the command now reports failure if any script failed, where before it always reported success.
- These options now affect every script in the command, not just the last group of scripts.
- Updates a helper library that had a security flaw allowing command injection.
Must act Top 5 of 6 that need code or config changes
Requires Node.js >= 0.10 from 2.0.0 (none stated before).
Adds cross-spawn ^4.0.0, object-assign ^4.0.1, pinkie-promise ^2.0.1, read-pkg-up ^1.0.1.
Drops babel-runtime, cross-spawn-async.
Installs 148 packages in all (was 147).
Also installs find-up, path-exists.
No longer installs core-js, regenerator-runtime.
What you must change
Breaking3
Removes the -S and -P shorthand options; use -c and -c -p instead.
-S-P-c-pChanges --continue-on-error so npm-run-all exits with a non-zero code when a script fails, instead of always exiting 0.
--continue-on-errornpm-run-allChanges --print-label, --print-name and --continue-on-error to apply to the whole command rather than only one script group.
--print-label--print-name--continue-on-errorSecurity2
Upgrades shell-quote to address a command injection advisory.
shell-quoteUpgrades minimatch to address a regular expression denial of service advisory.
minimatchDeprecations to plan for
Deprecated1
Notes that cross-spawn-async has been deprecated.
cross-spawn-async