Resolve all open Dependabot alerts in the dev dependency tree - #154
Resolve all open Dependabot alerts in the dev dependency tree#154jessicahearn wants to merge 1 commit into
Conversation
All 9 open alerts are transitive dependencies of dev dependencies, the one
exception being a low-severity formidable alert via superagent. npm audit
goes from 5 findings to 0.
The existing overrides were each one patch short of the current advisories
(js-yaml pinned to 3.15.0 where the fix is 3.15.1, and to 4.3.0 where the
fix is 4.3.1), which is why the alerts stayed open. Pinning override targets
to exact versions goes stale every time an advisory is extended, so this
refreshes the lock instead and keeps overrides only where a range genuinely
cannot reach the fix:
- mocha -> ^11.8.0. mocha 10.2.0 pinned js-yaml, minimatch and
serialize-javascript at exact versions, so no lock refresh could move
them. mocha 11 uses ranges, and drops the chokidar 3 (braces) and glob 7
subtrees entirely.
- serialize-javascript override ^7.0.5: even mocha 11 asks for ^6.0.2 while
the RCE advisory is only patched in 7.0.3 and the DoS in 7.0.5. mocha is
the sole consumer and uses it only on the parallel-worker path, which
.mocharc.json does not enable.
- diff override ^8.0.3 for the jsdiff parsePatch/applyPatch DoS.
- Drop the js-yaml and brace-expansion overrides. With the lock refreshed
these resolve to 3.15.1 / 4.3.1 and 1.1.18 / 2.1.4 inside their existing
caret ranges, so the pins are no longer load-bearing.
- pre-commit -> ^2.0.0, moving cross-spawn 5.1.0 -> ^7 and clearing a high
severity ReDoS.
- Remove dependency-lint: referenced by no npm script and no CI step, and
carried an unmaintained js-yaml 3.x / minimatch 3.x / glob 7 subtree.
- Pin the eight devDeps declared as "" (= any version). Left unpinned, a
lock regeneration pulls chai 4 -> 6, which is ESM-only and breaks every
require('chai') in the test suite.
CI drops node 18, as serialize-javascript 7.0.5 declares >=20 and mocha 11
needs >=18.18. The library's own engines: { node: ">=16" } is unchanged --
devDependencies are never installed for consumers, so this raises the floor
for contributors only.
249 tests pass, coverage still writes coverage/lcov.info, lint is clean.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
1eff45d to
d65fb3c
Compare
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
1 participant
Closes all 9 open Dependabot alerts (5 high, 3 medium, 1 low).
npm auditnow reports 0 vulnerabilities, down from 22.Every alert was a transitive dependency of a dev dependency — the one exception being a low-severity
formidablealert reaching in throughsuperagent. No shipped library code is affected.Why this wasn't just a lockfile refresh
mocha@10.2.0pinned three of the vulnerable packages at exact versions —js-yaml 4.1.0,minimatch 5.0.1,serialize-javascript 6.0.0— so no amount of lock refreshing could move them. And even the newestmocha@11.8.0requiresserialize-javascript ^6.0.2, while the high-severity RCE advisory is only patched in7.0.3. So this needed a mocha major bump plus an override.Separately,
npm installon its own kept every locked version that still satisfied its range even after deletingnode_modules— an explicitnpm updatewas required to pull the in-range patches forjs-yaml3.x,minimatch3.x,formidable, andqs.Changes
package.jsonmocha→^11.8.0braces) and glob 7 subtrees entirelynyc→^18.0.0istanbul-lib-processinfo@3.0.1dropsuuidas a dependency altogetherpre-commit→^2.0.0cross-spawn5.1.0 → ^7, clearing a high-severity ReDoSdependency-lintoverridesserialize-javascript: ^7.0.5(RCE + DoS),diff: ^8.0.3(jsdiffparsePatch/applyPatchDoS)""devDepsThe eight devDependencies declared as
""meant "any version". Left unpinned, regenerating the lock silently jumpschaifrom 4 to 6 — which is ESM-only and breaks everyrequire('chai').expectintest/chartmogul/. They are now pinned to their current majors..github/workflows/test.yml— matrix[16, 18, 20, '*']→[20, 22, '*'], sincemocha@11requires node>=18.18andserialize-javascript@7.0.5declares>=20. Also bumpsactions/checkoutandactions/setup-nodefrom the deprecated@v2runtimes to@v4.The library's own
engines: { node: ">=16" }is deliberately unchanged — devDependencies are never installed for consumers, so node 16 users are unaffected. This raises the floor for contributors only.package-lock.json— npm rewrotelockfileVersion2 → 3, hence the large diff (~2,700 net lines removed). Node 20 ships npm 10, so this reads fine across the new matrix. Also folds in the3.7.1→3.8.0version sync that #120 missed in the lock.Verification
npm run coverunder nyc 18 still writescoverage/lcov.infonpm run lintclean, no source files modifiednpm audit→ 0 vulnerabilities.braces,uuid, anddependency-lintgone from the tree;serialize-javascript7.1.0,js-yaml3.15.1 + 4.3.1,minimatch3.1.5/9.0.9,cross-spawn7.0.6 onlypre-commithook reinstalled and firing (it ran lint + tests on this commit)No release needed — only devDependencies and the lock file changed. The published package contents and its runtime dependency ranges are untouched.
🤖 Generated with Claude Code