fix(deps): resolve all npm audit vulnerabilities (39 → 0) - #220
Merged
Conversation
Override brace-expansion to 5.0.8 (patched, clears the minimatch/glob cascade across eslint, @typescript-eslint, jest and babel tooling) and bump the undici override from the still-vulnerable 6.24.1 to 6.28.0. Reduces npm audit from 39 vulnerabilities (31 high) to 6 (all moderate, all in the @octokit/rest production chain, addressed separately). Lint clean, 220/220 tests pass.
…lities Bumps @octokit/rest 18 -> 22.0.1, resolving the remaining ReDoS advisories in the octokit request chain and bringing npm audit to 0 vulnerabilities. @octokit/rest v22 is ESM-only and uses native fetch, which required: - jest.config: transpile the ESM @octokit/* deps via ts-jest and whitelist them in transformIgnorePatterns so jest's CJS runtime can load them. - @kie/mock-github 1.1.0 -> 2.0.2 (nock 14) so mocks intercept native fetch; nock 13 only intercepts the http/https modules. - Codeberg mocks: pass explicit path params to previously no-arg endpoint mocks. Moctokit builds an anchored regex path for no-arg mocks, which nock does not prefix with Codeberg's /api/v1 base path, causing no-match. - listCommitsParams helper to work around mock-github 2.0.2 typing GET endpoints (e.g. pulls.listCommits) with `params?: undefined`. mock-github 2.0.2 requires Node >=24, so the CI test matrix drops Node 20/22. No engines constraint is added: the published dist/ is a self-contained ncc bundle, so end users are unaffected; only contributors running tests need 24.
Contributor
Coverage report
Test suite run success220 tests passing in 18 suites. Report generated by 🧪jest coverage report action from 20826ae |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Brings
npm auditfrom 39 vulnerabilities (31 high, 8 moderate) to 0, in two logically separate commits.All 39 issues traced to three root packages; everything else was transitive.
Commit 1 — dev-only transitive vulns via
overrides(39 → 6)Zero-risk, no direct dependency versions changed:
brace-expansion→5.0.8— clears theminimatch/globcascade across eslint,@typescript-eslint, jest, and babel tooling (~31 high).undicioverride bumped6.24.1→6.28.0(the previous pin was itself still vulnerable, fix landed in 6.27.0) — clears the release-it chain.Commit 2 —
@octokit/rest18 → 22 (6 → 0)The only vulnerability affecting production/runtime code (3× ReDoS in the octokit request chain). v22 is ESM-only and uses native
fetch, which required test-infra changes:@octokit/*deps viats-jest+ whitelist them intransformIgnorePatternsso jest's CJS runtime can load them.@kie/mock-github1.1.0 → 2.0.2 (nock 14) so mocks intercept nativefetch; nock 13 only hooks thehttp/httpsmodules./api/v1base path → no-match.listCommitsParamshelper to work around mock-github 2.0.2 typing GET endpoints (e.g.pulls.listCommits) asparams?: undefined.Tradeoff to note for reviewers
@kie/mock-github@2.0.2requires Node ≥24, so the CI test matrix drops Node 20/22 ([20,22,24]→[24]; coverage job 22 → 24). This is a test-tooling constraint only:enginesconstraint is added topackage.json. The publisheddist/is a self-containednccbundle, so end users on older Node are unaffected; only contributors running the test suite need Node 24.MockAgent— a larger test rewrite. Happy to go that route instead if maintaining the wider Node range is preferred.Verification
npm audit→ 0 vulnerabilitiesnpm test→ 220/220 passingnpm run lint→ cleannpm run build→dist/rebuilt and in sync (verify-dist check passes); bundle is smaller (octokit v22 is leaner)