chore: self vendor boolean@3.2.0 by octavian-snyk · Pull Request #7011 · snyk/cli

octavian-snyk · 2026-07-20T06:41:37Z

Pull Request Submission Checklist

Follows CONTRIBUTING guidelines
Commit messages
are release-note ready, emphasizing
what was changed, not how.
Includes detailed description of changes
Contains risk assessment (Low | Medium | High)
Highlights breaking API changes (if applicable)
Links to automated tests covering new functionality
Includes manual testing instructions (if necessary)
Updates relevant GitBook documentation (PR link: ___)
Includes product update to be announced in the next stable release notes

What does this PR do?

This PR aims to remove the deprecation warning when installing the CLI from npm.

Bundles boolean, and by extension roarr, and global-agent.

Where should the reviewer start?

Test current behaviour.

cd ts-binary-wrapper
rm -rf wrapper_dist
npm run build
npm install
npm pack
npm install -g ./snyk-1.0.0-monorepo.tgz # Warning is showed

How should this be manually tested?

cd ts-binary-wrapper
rm -rf wrapper_dist
npm run build
npm install
npm pack
fnm use 12.0
npm install -g ./snyk-1.0.0-monorepo.tgz # No warning is showed

What's the product update that needs to be communicated to CLI users?

Nothing.

What are the relevant tickets?

CLI-1417

snyk-io · 2026-07-20T06:42:02Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

octavian-snyk · 2026-07-20T06:43:45Z

@@ -0,0 +1,19 @@
+const boolean = function (value: any): boolean {


context:

./vendor/boolean/build/lib is needed such that we do not require an extra build step.

./vendor/boolean/lib could be removed.

including both is common

please remove vendor/boolean/lib to tighten the diff

octavian-snyk · 2026-07-20T06:46:08Z

    "global-agent": "^3.0.0"
-  }
+  },
+  "overrides": {


both are needed to create a package that does not contain the warning when ran with npm 12.

robertolopezlopez · 2026-07-20T09:25:29Z

The vendored TS is not really needed IMO. Please just keep JS + metadata + license.

robertolopezlopez

if it is just about vendoring one package, it seems good

danskmt · 2026-07-20T13:52:05Z

+declare const isBooleanable: (value: any) => boolean;
+export { isBooleanable };


do we need these .ts files?

It can successfully pack without them. I removed them.

snyk-pr-review-bot · 2026-07-21T09:37:59Z

PR Reviewer Guide 🔍

🧪 No relevant tests
🔒 No security concerns identified
⚡ Recommended focus areas for review Broken Lockfile Resolution 🔴 [critical] The `package-lock.json` contains incorrect resolution paths for the `boolean` package. It points `resolved` to `node_modules/global-agent/vendor/boolean`, but the PR places the files at `ts-binary-wrapper/vendor/boolean`. This will cause `npm install` to fail in CI environments because the link target does not exist. Furthermore, the entry for `node_modules/global-agent/vendor/boolean` in the lockfile is an empty object, missing necessary package metadata. "node_modules/boolean": { "resolved": "node_modules/global-agent/vendor/boolean", "link": true }, Incomplete Bundling Configuration 🟠 [major] The `node_modules/boolean` entry in `package-lock.json` is missing the `"inBundle": true` property. While `global-agent` and `roarr` have this flag, its absence for `boolean` means `npm pack` may skip including it in the final tarball, despite it being listed in `bundleDependencies`. This defeats the purpose of the PR to vendor and bundle the dependency to avoid registry warnings. "node_modules/boolean": { "resolved": "node_modules/global-agent/vendor/boolean", "link": true Override Path Mismatch 🟠 [major] There is a conflict between the `package.json` override and the `package-lock.json` resolution. `package.json` uses `file:vendor/boolean`, but the `dependencies` fallback section in the lockfile (line 4957) uses `file:node_modules/global-agent/vendor/boolean`. This inconsistency suggests the lockfile was generated in a dirty environment or using a non-standard resolution strategy that will not replicate in CI. "boolean": { "version": "file:node_modules/global-agent/vendor/boolean" },
📚 Repository Context Analyzed This review considered 20 relevant code sections from 11 files (average relevance: 0.65) ts-binary-wrapper/vendor/boolean/lib/boolean.ts (lines 1-20) ts-binary-wrapper/vendor/boolean/lib/isBooleanable.ts (lines 1-31) package.json (lines 1-235) ts-binary-wrapper/package-lock.json (5 segments, lines 1870-2087) ts-binary-wrapper/vendor/boolean/build/lib/isBooleanable.d.ts (lines 1-3) ts-binary-wrapper/vendor/boolean/lib/index.ts (lines 1-5) ts-binary-wrapper/vendor/boolean/build/lib/index.d.ts (lines 1-4) ... and 4 more file(s)
🤖 Repository instructions applied (from `AGENTS.md`)

octavian-snyk requested a review from a team as a code owner July 20, 2026 06:41

This comment has been minimized.

Sign in to view

octavian-snyk commented Jul 20, 2026

View reviewed changes

octavian-snyk force-pushed the chore/CLI-1417_vendor-boolean branch 2 times, most recently from 32d9ba0 to 0efd62c Compare July 20, 2026 09:59

This comment has been minimized.

Sign in to view

robertolopezlopez approved these changes Jul 20, 2026

View reviewed changes

danskmt reviewed Jul 20, 2026

View reviewed changes

octavian-snyk force-pushed the chore/CLI-1417_vendor-boolean branch from 0efd62c to 6b17a6a Compare July 21, 2026 06:38

This comment has been minimized.

Sign in to view

octavian-snyk force-pushed the chore/CLI-1417_vendor-boolean branch from 6b17a6a to 879dd0d Compare July 21, 2026 06:40

This comment has been minimized.

Sign in to view

chore: self vendor boolean@3.2.0

eac323a

octavian-snyk force-pushed the chore/CLI-1417_vendor-boolean branch from 879dd0d to eac323a Compare July 21, 2026 09:36

octavian-snyk enabled auto-merge July 21, 2026 09:36

		@@ -0,0 +1,19 @@
		const boolean = function (value: any): boolean {

		declare const isBooleanable: (value: any) => boolean;
		export { isBooleanable };

Uh oh!

Conversation

octavian-snyk commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Submission Checklist

What does this PR do?

Where should the reviewer start?

How should this be manually tested?

What's the product update that needs to be communicated to CLI users?

What are the relevant tickets?

Uh oh!

snyk-io Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

This comment has been minimized.

octavian-snyk Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

robertolopezlopez Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

robertolopezlopez Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

octavian-snyk Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

octavian-snyk Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

robertolopezlopez Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

robertolopezlopez commented Jul 20, 2026

Uh oh!

This comment has been minimized.

This comment has been minimized.

robertolopezlopez left a comment

Choose a reason for hiding this comment

Uh oh!

danskmt Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

octavian-snyk Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

This comment has been minimized.

snyk-pr-review-bot Bot commented Jul 21, 2026

PR Reviewer Guide 🔍

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

octavian-snyk commented Jul 20, 2026 •

edited

Loading

snyk-io Bot commented Jul 20, 2026 •

edited

Loading

octavian-snyk Jul 20, 2026 •

edited

Loading