node-fetch vulnerability issue (denial of service) about recompose HOT 8 OPEN

Could we have an update on this? Or should we consider this project is dead?

from recompose.

If anybody wants to download a version of recompose with the packages updated, see:

https://github.com/shakacode/recompose
https://www.npmjs.com/package/@shakacode/recompose

I just updated the dependencies other than FBJS and FBJS is removed.

from recompose.

Hi, as I can see there was a commit to remove the fbjs related stuffs: 68c560b

But the latest version (v0.30.0) was released before the fbjs removement, so I think that a new release could fix this vulnerability. (If a new release is possible.)

from recompose.

Thank you @ridesz, yes that would be great!
What do you think @acdlite ?

from recompose.

I am looking for a fix as well.

from recompose.

This project seems totally dead...
What a pity, it was one of the great projet for react.

Hooks are destroying everything. I will never work with spaghetti code like hooks. This is such a regression, I don't even understand what facebook is doing... Code for kids?

Anyway, I will fork this project and create a new lib for being able to still work with clean and optimised code.

from recompose.

Would love to have a fix for this as well.

from recompose.

@justin808 The NPM release of @shakacode/recompose seems to be missing a large number of files (e.g. pure.js) that are present in the GitHub sources and the upstream's NPM release, but not in the fork's release 🙁

from recompose.