Skip to content

Commit e4d21ba

Browse files
authored
refactor(node-resolve): remove deep-freeze from dependencies (#529)
`deep-freeze` is licensed as Public Domain, which might be problematic for some 3rd parties such as the Angular CLI. In Angular CLI we have a license validator that validates direct and transitive dependencies, and Public Domain is a problematic license becuse it falls under the "unencumbered' group which requires legal audit. More context: https://opensource.google/docs/thirdparty/licenses/#unencumbered
1 parent d7f06e9 commit e4d21ba

File tree

3 files changed

+12
-6
lines changed

3 files changed

+12
-6
lines changed

packages/node-resolve/package.json

-1
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,6 @@
5252
"@rollup/pluginutils": "^3.1.0",
5353
"@types/resolve": "1.17.1",
5454
"builtin-modules": "^3.1.0",
55-
"deep-freeze": "^0.0.1",
5655
"deepmerge": "^4.2.2",
5756
"is-module": "^1.0.0",
5857
"resolve": "^1.17.0"

packages/node-resolve/src/index.js

+11-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22
import { dirname, normalize, resolve, sep } from 'path';
33

44
import builtinList from 'builtin-modules';
5-
import deepFreeze from 'deep-freeze';
65
import deepMerge from 'deepmerge';
76
import isModule from 'is-module';
87

@@ -19,6 +18,17 @@ import {
1918
const builtins = new Set(builtinList);
2019
const ES6_BROWSER_EMPTY = '\0node-resolve:empty.js';
2120
const nullFn = () => null;
21+
const deepFreeze = object => {
22+
Object.freeze(object);
23+
24+
for (const value of Object.values(object)) {
25+
if (typeof value === 'object' && !Object.isFrozen(value)) {
26+
deepFreeze(value);
27+
}
28+
}
29+
30+
return object;
31+
};
2232
const defaults = {
2333
customResolveOptions: {},
2434
dedupe: [],

pnpm-lock.yaml

+1-4
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)