{"action":"closed","issue":{"url":"https://api.github.com/repos/instana/nodejs-sensor/issues/47","repository_url":"https://api.github.com/repos/instana/nodejs-sensor","labels_url":"https://api.github.com/repos/instana/nodejs-sensor/issues/47/labels{/name}","comments_url":"https://api.github.com/repos/instana/nodejs-sensor/issues/47/comments","events_url":"https://api.github.com/repos/instana/nodejs-sensor/issues/47/events","html_url":"https://github.com/instana/nodejs-sensor/issues/47","id":309521944,"number":47,"title":"Proposal: drop v8-profiler dependency","user":{"login":"cjihrig","id":2512748,"avatar_url":"https://avatars1.githubusercontent.com/u/2512748?v=4","gravatar_id":"","url":"https://api.github.com/users/cjihrig","html_url":"https://github.com/cjihrig","followers_url":"https://api.github.com/users/cjihrig/followers","following_url":"https://api.github.com/users/cjihrig/following{/other_user}","gists_url":"https://api.github.com/users/cjihrig/gists{/gist_id}","starred_url":"https://api.github.com/users/cjihrig/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cjihrig/subscriptions","organizations_url":"https://api.github.com/users/cjihrig/orgs","repos_url":"https://api.github.com/users/cjihrig/repos","events_url":"https://api.github.com/users/cjihrig/events{/privacy}","received_events_url":"https://api.github.com/users/cjihrig/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-03-28T20:35:57Z","updated_at":"2018-04-03T09:32:38Z","closed_at":"2018-04-03T09:32:38Z","author_association":"CONTRIBUTOR","body":"`v8-profiler` appears to be unmaintained, and it triggers nsp vulnerabilities via:\r\n\r\n```\r\ninstana-nodejs-sensor@1.37.0 > v8-profiler@5.7.0 > node-pre-gyp@0.6.39 > hawk@3.1.3 > hoek@2.16.3 \r\n```\r\n\r\nWe've been adding nsp exceptions on our repos like [this](https://github.com/joyent/webconsole-instances/blob/master/app/.nsprc), but it's far from ideal.\r\n\r\nFurthermore, it appears that `v8-profiler` is unnecessary on the newest versions of Node due to the [`inspector`](https://nodejs.org/api/inspector.html) core module.\r\n\r\nPerhaps in the future a semver major release could drop `v8-profiler` and adopt Node's inspector module?"}}
{"actor":{"display_login":"bripkens"}}