Skip to content

build: replace lodash with eta for nuspec templating#593

Open
MarshallOfSound wants to merge 3 commits intomainfrom
claude/remove-lodash-dependency-kE0Vh
Open

build: replace lodash with eta for nuspec templating#593
MarshallOfSound wants to merge 3 commits intomainfrom
claude/remove-lodash-dependency-kE0Vh

Conversation

@MarshallOfSound
Copy link
Copy Markdown
Member

@MarshallOfSound MarshallOfSound commented Apr 8, 2026

Removes the lodash dependency. The only usage was _.template() for rendering the .nuspec file, which is now handled by eta (pinned to an exact version).

Changes

  • package.json / yarn.lock — drop lodash and @types/lodash, add eta@4.5.1
  • src/index.ts — render the nuspec via new Eta({ autoTrim: false, useWith: true }).renderString(...)
  • template.nuspectemplate — change <%- expr %> to <%= expr %>

The Eta config (autoTrim: false, useWith: true) keeps the rendered output byte-identical to what lodash produced for the bundled template, including XML escaping and the additionalFiles loop.

Note on nuspecTemplate

Eta auto-escapes <%= %> and reserves <%- / -%> for whitespace trimming, so the lodash-style <%- expr %> escape tag is no longer supported. Consumers passing a custom nuspecTemplate should switch <%- expr %> to <%= expr %> (escaped) or <%~ expr %> (raw).

Replace the single use of lodash (`template`) with a small local
implementation that supports the same `<% %>`, `<%= %>` and `<%- %>`
delimiters, so existing custom `nuspecTemplate` files continue to work.
@MarshallOfSound MarshallOfSound requested a review from a team as a code owner April 8, 2026 22:50
@MarshallOfSound MarshallOfSound changed the title Replace lodash template with minimal custom implementation fix: replace lodash template with minimal custom implementation Apr 8, 2026
Copy link
Copy Markdown
Member

@dsanders11 dsanders11 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Test coverage would be good.

claude added 2 commits April 8, 2026 23:05
Replace the local template implementation with the eta package, pinned to
an exact version. eta's `<%= %>` tag is XML-escaped by default, so the
bundled template's `<%- %>` tags are updated accordingly. `autoTrim` is
disabled and `useWith` enabled so rendered output matches the previous
behaviour.
Remove the one-line src/template.ts wrapper and call eta directly at the
single call site.
@MarshallOfSound MarshallOfSound changed the title fix: replace lodash template with minimal custom implementation build: replace lodash with eta for nuspec templating Apr 8, 2026
@socket-security
Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addedeta@​4.5.19910010089100

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants