| 13 Sep 2022 |
 f0x | In reply to @hexa:lossy.network
but that is pretty much downgrading the dependency? yeah, so it doesn't depend on the rust stuff | 13:08:41 |
| f0x | and the bridge uses none of the crypto stuff anyways | 13:08:54 |
| f0x | but fair, yeah | 13:09:00 |
 hexa | wow 😕 | 13:09:06 |
| f0x | it's a dependency downgrade, but still in the supported semver by matrix-appservice-bridge^3.2.0 | 13:11:41 |
| f0x | * it's a dependency downgrade, but still in the supported version range by matrix-appservice-bridge^3.2.0 | 13:11:47 |
| hexa | I don't have a strong opinion in this case | 13:19:25 |
| hexa | I'm not sure if or when they will bump the lower end | 13:19:56 |
| hexa | both are band-aids | 13:20:11 |
| hexa | * both solutions are band-aids | 13:20:15 |
| f0x | yep.. | 13:20:38 |
| hexa | https://matrix.org/blog/2022/09/13/security-release-of-matrix-appservice-irc-0-35-0-high-severity | 16:25:22 |
| hexa | unstable-small has the bump fwiw | 16:25:29 |
 @pacien:pacien.net | In reply to @hexa:lossy.network
roast me (╯°□°)╯︵ ┻━┻
(ノಠ益ಠ)ノ✂️
https://github.com/NixOS/nixpkgs/pull/186316#discussion_r970080894 | 21:06:14 |
| hexa | Notkea: if you could try building the rust native thing, unless you're in a hurry | 21:07:23 |
| hexa | that would be neat | 21:07:29 |
| @pacien:pacien.net | I tried. This requires napi-rs, which requires Yarn v2, whose lock format isn't supported by our yarn2nix… | 21:08:05 |
| hexa | oh boy | 21:08:23 |
| hexa invited  Winter (she/her). | 21:08:28 |
| hexa | winter was also going looking into that, the reason why I invited her | 21:11:05 |
| hexa | so, Dandellion, how's the worker setup going so far? 😛 | 21:14:21 |
| Winter (she/her) joined the room. | 21:48:19 |
| Winter (she/her) | oh, fun, yarn v2 | 21:48:35 |
| Winter (she/her) | let me see what i can do | 21:48:53 |
| Winter (she/her) | We have two options here, for the short-term.
- Ship napi-rs's CLI in """binary""" form. We're lucky enough that it is simply a bunch of JS files, and no dependencies are required that aren't already bundled -- that is to say that a simple fetchurl will work.
- Shim it, it's simple enough.
| 22:02:59 |
| Winter (she/her) | I vote #1. | 22:03:01 |
| Winter (she/her) | We already do it for ~all node packages anyways. | 22:03:11 |
| Winter (she/her) | going to work on this now | 22:03:19 |
| Winter (she/her) | Correction: it is a single JS file. | 22:07:22 |
| Winter (she/her) | Perfect. | 22:07:25 |
