Skip to content

Replace deprecated boolean dependency — GitHub repo is gone (404) #18

Description

@BhuannaichFhirinn

Hi — flagging a supply chain issue with the boolean dependency. I noticed it appears across several packages you maintain — axe, frisbee, @ladjs/passport, @ladjs/policies, @ladjs/web, @ladjs/api, @ladjs/shared-config, @ladjs/mongoose, @ladjs/proxy, mongoose-common-plugin, and forward-email.

Two things have happened:

  1. The GitHub repository no longer exists. https://github.com/thenativeweb/boolean returns a 404. The source code cannot be viewed on GitHub, the repo cannot be forked, and no issues can be filed. The npm Code tab is the only remaining way to read the implementation — which makes any security audit of these packages' dependency trees significantly harder.

  2. The package is officially deprecated, last published in February 2022, and will never receive another patch.

A maintained drop-in replacement is available: barbero (MIT, zero dependencies, actively maintained).

Current Replacement
boolean(value) parseBoolean(value) from barbero
isBooleanable(value) isBooleanable(value) from barbero (same name, no change)

parseBoolean() has identical behaviour to boolean() for all values that boolean recognised — this should be a non-breaking change for existing tests.

barbero ships:

  • CommonJS (dist/index.cjs) — works with require()
  • ES Module (dist/index.mjs) — works with import
  • TypeScript declarations (dist/index.d.ts)

Given the number of packages involved, I'd suggest tackling them as a batch — the change is mechanical across all of them (update package.json, rename the import). I'm happy to open PRs if that would be useful.

Disclosure: I maintain barbero.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions