Some popular packages don't work correctly under SES

[kumavis]

Some popular packages don't work correctly under SES

This is primarily seems to be caused by setting properties that appear in the frozen primordials like x.toString = y

I'll record them here

regenerator-runtime 16,886,889 downloads / week

• v0.13.3 requires non-strict mode?
  https://github.com/facebook/regenerator/blob/6e9e8d7747c2ab49927bdd9dd6261753181faec1/packages/regenerator-runtime/runtime.js#L713-L726
• v0.11.1: deriving a global from return this https://github.com/Agoric/SES/issues/140
  https://github.com/facebook/regenerator/blob/610e60882404480d5dec4fdbeaa56e1773dbfe37/packages/regenerator-runtime/runtime-module.js#L10

symbol-observable 6,602,849 downloads / week

• tries to mutate Symbol https://github.com/benlesh/symbol-observable/blob/e56e765476fd96dcb430fd44d936bc543d4d97ba/es/ponyfill.js#L9-L10

deep-equal 6,532,310 downloads / week

• 1.0.1 accidentally assigns "shim" to Object.keys https://npmfs.com/package/deep-equal/1.0.1/lib/keys.js

underscore 6,453,579 downloads / week

• overriding Object.prototype properties
  https://github.com/jashkenas/underscore/blob/36eef3c118041ae6386b6bba2b48b099e57ca0e5/underscore.js#L1676
• overriding Function.prototype properties
  https://github.com/jashkenas/underscore/blob/36eef3c118041ae6386b6bba2b48b099e57ca0e5/underscore.js#L772

crypto-js 909,612 downloads/week

• overriding toString via computed set (this[propertyName] = properties[propertyName]) https://github.com/brix/crypto-js/blob/8e6d15bf2e26d6ff0af5277df2604ca12b60a718/src/core.js#L132
  Setting via computed assign previously defeated my babel-plugin workaround, but I added support for it

[kumavis]

@erights would the "override mistake" workaround be part of the SES standard? or would this issue be present and only fixable by library authors?

[erights]

Standard. Probably suppressible by an option, but default on. We just need to decide between the Salesforce (just 5 primordial prototype) and the Node (all primordial prototypes) approaches. I'm inclined to start with Salesforce's and see what still breaks.

[michaelfig]

@kumavis, thanks for this and the other reports. I'll be giving SES some love over the coming week, and will link back to each of your issues when I have a failing test case for each.

[ljharb]

deep-equal v2, when released, won't need to be included in this list, fwiw.

[michaelfig]

@kumavis, does Agoric/SES#150 (now merged to master, with the repair plan additions you specified in the comments) fix these cases for you?

[ljharb]

I published deep-equal v1.1.0 btw so i assume it can be removed from the list?

[kumavis]

@michaelfig I need to update this list, many can be removed now

[turadg]

Can this be closed now in favor of … ?

• Ecosystem Compatibility (2024-02-05 onward) #2037

[kriskowal]

Can this be closed now in favor of … ?

• Ecosystem Compatibility (2024-02-05 onward) #2037

It can now. I’ve merged the report above into the description.