[epic] vinyl-fs version 3.0.0

[phated]

I'm creating this issue to get some more visibility on outstanding issues in vinyl-fs for it to reach 3.0 (which we'd like to ship with gulp 4).

If you are able to tackle any of these, the help would be very much appreciated.

• Decouple opening and closing of file descriptors from src and dest - Decouple opening and closing of file descriptors from src and dest vinyl-fs#158
• Support changing uid/gid from the vinyl object to the file on disk - Support changing uid/gid from the vinyl object to the file on disk vinyl-fs#157
• Support setting setuid/setgid/sticky bits - Support setting setuid/setgid/sticky in updateMetadata vinyl-fs#156
• Support functions for all options - Support functions for all options vinyl-fs#139
• kebabCase the filenames - kebabCase the filenames vinyl-fs#152
• vfs.dest(outfolder, { base.. }) ignores outfolder? - vfs.dest(outfolder, { base.. }) ignores outfolder? vinyl-fs#141
• The mkdirp module doesn't handle modes in the best way - The mkdirp module doesn't handle modes in the best way vinyl-fs#165
• Account for process.umask - Account for process.umask vinyl-fs#166
• Test refactor - (Don't Merge) Test refactor vinyl-fs#194
• Separate prepareWrite into own module - Proposal to allow files to pass through dest without writing them to disk.  vinyl-fs#193
• Fix Symlink TODOs (issues need to be created)
• Sink the symlink stream - Needs to sink the symlink stream vinyl-fs#195
• Get https://github.com/gulpjs/vinyl-sourcemap up-to-snuff
• Rebase vinyl-fs to generate conventional changelog (Rebase review!!! vinyl-fs#284)
• Finalize documentation

[phated]

Updated! We've had some excellent contributions by @hgwood and @tmcgee123
Some of the improvements brought to light a couple of other things we need help with.

[phated]

Almost all these are wrapping up. We need to get some more tests in place for the changes and solidify the "Support functions for all options" stuff.

Still looking for someone to tackle the uid/gid stuff.

[odino]

What about a smaller update to vinyl? With this issue on minimatch everyone gets lots of sec. alerts :)

[phated]

@odino no, those alerts don't matter. If you are passing user input directly to gulp, you have bigger problems.

[odino]

That's true, but those alerts will keep coming due to gulp requiring the
library. So even if this has never been exploited people are gonna
"wtf?!?!" anyway unless they really dig into it and figure out that this is
not an issue at all.

If there's an easy way to upgrade to a version that has the patch I would
suggest to go for it, else if its a big PITA then never mind :)
On Jul 12, 2016 1:40 PM, "Blaine Bublitz" notifications@github.com wrote:

@odino https://github.com/odino no, those alerts don't matter. If you
are passing user input directly to gulp, you have bigger problems.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
#1604 (comment), or mute
the thread
https://github.com/notifications/unsubscribe/AAUC5BPlBGK1FkEyh0WVf2e_q6GkZku2ks5qU2ElgaJpZM4IIqCY
.

[strugee]

@phated the UID/GID item should be checked off, no?

[ilanbiala]

@phated any update on ^^?

[atomantic]

re @odino and security fix. this could be fixed just by updating the version of vinyl-fs that gulp installs. Currently you get vinyl-fs@^0.3.0 which translates to a really old version of vinyl-fs (0.3.14).

This is a problem for anyone requiring nsp check to pass for a build to succeed.

[Den-dp]

this could be fixed just by updating the version of vinyl-fs

@atomantic a lot of things was changed since vinyl-fs@0.3.14 https://github.com/gulpjs/vinyl-fs/blob/master/CHANGELOG.md#v0314-20150921-2357-0000 so it is impossible just bump the version.
In fact, migration to vinyl-fs@3.0.0 is a thing and the whole point of this issue.

[phated]

@strugee @ilanbiala thanks, I've updated the list. However, a few more things had to be added to account for things I've found during the test refactor.

[atomantic]

got it. Yeah, I noticed tests pass as long as I upgrade vinyl-fs to latest version and include glob-watcher 0.0.8--but that's still a really old version of glob-watcher. glob-watcher@3.0.0 has some differences that break it.

[phated]

@atomantic the gulp tests are just a smoke test because each underlying library has a full test suite that we aren't going to duplicate. Extreme amounts of stuff has changed and you should not assume everything will just work.