Hi — flagging a supply chain issue with the boolean dependency. I noticed it appears across several packages you maintain — axe, frisbee, @ladjs/passport, @ladjs/policies, @ladjs/web, @ladjs/api, @ladjs/shared-config, @ladjs/mongoose, @ladjs/proxy, mongoose-common-plugin, and forward-email.
Two things have happened:
-
The GitHub repository no longer exists. https://github.com/thenativeweb/boolean returns a 404. The source code cannot be viewed on GitHub, the repo cannot be forked, and no issues can be filed. The npm Code tab is the only remaining way to read the implementation — which makes any security audit of these packages' dependency trees significantly harder.
-
The package is officially deprecated, last published in February 2022, and will never receive another patch.
A maintained drop-in replacement is available: barbero (MIT, zero dependencies, actively maintained).
| Current |
Replacement |
boolean(value) |
parseBoolean(value) from barbero |
isBooleanable(value) |
isBooleanable(value) from barbero (same name, no change) |
parseBoolean() has identical behaviour to boolean() for all values that boolean recognised — this should be a non-breaking change for existing tests.
barbero ships:
- CommonJS (
dist/index.cjs) — works with require()
- ES Module (
dist/index.mjs) — works with import
- TypeScript declarations (
dist/index.d.ts)
Given the number of packages involved, I'd suggest tackling them as a batch — the change is mechanical across all of them (update package.json, rename the import). I'm happy to open PRs if that would be useful.
Disclosure: I maintain barbero.
Hi — flagging a supply chain issue with the
booleandependency. I noticed it appears across several packages you maintain —axe,frisbee,@ladjs/passport,@ladjs/policies,@ladjs/web,@ladjs/api,@ladjs/shared-config,@ladjs/mongoose,@ladjs/proxy,mongoose-common-plugin, andforward-email.Two things have happened:
The GitHub repository no longer exists.
https://github.com/thenativeweb/booleanreturns a 404. The source code cannot be viewed on GitHub, the repo cannot be forked, and no issues can be filed. The npm Code tab is the only remaining way to read the implementation — which makes any security audit of these packages' dependency trees significantly harder.The package is officially deprecated, last published in February 2022, and will never receive another patch.
A maintained drop-in replacement is available: barbero (MIT, zero dependencies, actively maintained).
boolean(value)parseBoolean(value)frombarberoisBooleanable(value)isBooleanable(value)frombarbero(same name, no change)parseBoolean()has identical behaviour toboolean()for all values thatbooleanrecognised — this should be a non-breaking change for existing tests.barberoships:dist/index.cjs) — works withrequire()dist/index.mjs) — works withimportdist/index.d.ts)Given the number of packages involved, I'd suggest tackling them as a batch — the change is mechanical across all of them (update
package.json, rename the import). I'm happy to open PRs if that would be useful.Disclosure: I maintain
barbero.