expression-eval@5.0.1: The expression-eval npm package is no longer maintained

[giovanni-bertoncelli]

I get this error while installing casbin:

npm WARN deprecated expression-eval@5.0.1: The expression-eval npm package is no longer maintained. The package was originally published as part of a now-completed personal project, and I do not have incentives to continue maintenance.

I think that dependency should be upgraded.

[casbin-bot]

@nodece @Shivansh-yadav13

[giovanni-bertoncelli]

Any thoughts on this? @nodece @hsluoyz
We have production code running on this

[nodece]

It is sad news that the expression-eval is no longer maintained, but we already used this library for a long time, and it is stable and safe(no CVE), so don't worry about this library.

@hsluoyz Should we fork the express-eval repo and publish our version?

If you hear anything, please let us know!

[hsluoyz]

Forking expression-eval is the last resort. Because we don't have that many developers to focus on maintaining it at the same time. What about switching to: https://github.com/silentmatt/expr-eval ?

[nodece]

The node-casbin depends on the async compile from expression-eval, could you switch to expre-eval, and try to test the async compile?