[Pkg-javascript-devel] Bug#1103615: node-dompurify: please update to latest version

[Paul Gevers]

Hi,

On Sat, 19 Apr 2025 19:28:11 +0200 Paul Gevers <elbrus at debian.org> wrote:
> I was struggling to package the latest version of `liferea` because I 
> didn't want to use the upstream vendored purify (and handlebars). It 
> turns out that the Debian version of node-dompurify is too old. Is it 
> reasonable to upgrade?

For the purpose of liferea, it might be relevant to say that apparently 
it's using an ESM version of dompurify (and handlebars). As I'm all new 
to this, upstream pointed me at [1] which explains a bit. I have no idea 
if it's reasonably feasible for the Debian node ecosystem to provide 
both flavors (by means of a ESM wrapper around the CJS flavor if I 
understand correctly).

I guess for now I need to consider my options for liferea and I'm nearly 
convinced the best is to not try to ship the latest upstream version at 
this stage of trixie and leave that to forky.

Paul

[1] 
https://redfin.engineering/node-modules-at-war-why-commonjs-and-es-modules-cant-get-along-9617135eeca1

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 495 bytes
Desc: OpenPGP digital signature
URL: <http://alioth-lists.debian.net/pipermail/pkg-javascript-devel/attachments/20250420/8b6f925c/attachment.sig>