Replies: 1 comment
-
+1, looks like |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
vanilla-extract/integration
has a dependency onvite
, but not all users use thevite-plugin
. Vite is a heavy weight dependency and has pretty regular dependabot security issues (most recently https://nvd.nist.gov/vuln/detail/CVE-2024-23331). So it's unfortunate for webpack users to have to both install it and force resolve to newer versions when it's not used.In cases like these, it's usually most appropriate for optional dependencies to be marked
peerDependencies
instead ofdependencies
. Is it possible for vite to be a peer dependency ofintegration
and a hard dependency ofvite-plugin
?Beta Was this translation helpful? Give feedback.
All reactions