Zebra Flesh

CSP violation

3

This component generates a CSP violation using the default ember-cli CSP settings; you need to add a `'style-src': 'unsafe-inline'` directive to your server to make it go away. It looks...

Add SVG support

1

This is hardly the "ultimate previewer of source code" if it doesn't have SVG support. Either that or change the tag line so people aren't mislead.

Bad arch detection

6

If this is a question about how to use NVM4W, please use [stackoverflow](http://stackoverflow.com/questions/tagged/nvm-windows) instead. If this is an issue regarding antivirus, make sure you search the existing issues first. ###...

lerna add not using semver

2

When using `lerna add`, I can't get lerna to add a dependency using a semver range -- it's always installed with an exact version. Since my CI pipeline runs `npx...

lerna add with scope is creating lock files everywhere

4

All of my dependencies are hoisted to the root of my repo. When I attempt to `lerna add` a dependency, it creates a `package-lock.json` file in every package folder. This...

Add "files" to package.json

1

Using serverless-webpack 5.3.0, the eslint-plugin-node recommended ruleset flags `require('serverless-webpack')` as an unpublished module because the package.json file lacks a [`files` attribute](https://docs.npmjs.com/files/package.json#files). This requires specific eslint configuration to allow serverless-webpack to...

Custom headers?

3

Is there a way to invoke lighthouse with custom headers? The lighthouse docs say you can do this via a CLI flag: https://github.com/GoogleChrome/lighthouse/blob/master/docs/authenticated-pages.md#option-3-pass-custom-request-headers-with-lighthouse-cli, but I don't see a way to...

Vulnerability in yargs-parser

3

yargs-parser 16.1.0 has a prototype pollution vulnerability: https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381 This is fixed in 18.1.1 and later.

Benchmarks are off

4

Benchmarks in the readme are confusing; looks like there are some leftover rows from the 4.0 release which should no longer be there.

There's a new security advisory for the `ssri` package: https://github.com/advisories/GHSA-vx3p-948g-6vhq The dependency tree looks like: ```sh [email protected] └─┬ [email protected] └─┬ [email protected] └─┬ [email protected] └── [email protected] ```