Repository navigation
fix(nodejs): clear the open Dependabot alerts on dev dependencies - #124
Merged
Merged
Conversation
Refresh the lockfile so the transitive brace-expansion (1.1.21 / 2.1.7) and js-yaml (4.3.2) resolve to their patched releases, closing Dependabot alerts #20, #27 and #28 (GHSA-q2hr-2g5m-vwhr, GHSA-2883-xcg3-v3hh). Also pin serialize-javascript to ^7.0.5 through an npm override, since mocha 10 and 11 still depend on the vulnerable 6.x line (GHSA-5c6j-r48x-rmvq, GHSA-qj8w-gfj5-8c6v) and mocha 12 drops Node 18. Mocha only requires it lazily in --parallel mode, which this suite does not use.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
After #123 cleared the shipped-dependency audit, three Dependabot alerts were still open on
main, all on dev-only transitive packages undernodejs/:A local
npm auditalso flaggedserialize-javascript6.0.2 (via mocha 10) for GHSA-5c6j-r48x-rmvq and GHSA-qj8w-gfj5-8c6v. These are not CI-blocking because the workflow audits with--omit=dev, but they are cheap to close.What
package-lock.jsonso brace-expansion and js-yaml resolve to their patched releases (plainnpm audit fix, no manifest ranges changed).overridesentry pinningserialize-javascriptto^7.0.5. Mocha 10 and 11 both still depend on the vulnerable 6.x line, and mocha 12 requires Node ^20.19 || >=22.12, which would break the 18.x matrix leg. Mocha only requires serialize-javascript lazily in--parallelmode, which this suite does not use, so the override is inert at runtime.Not addressed
npm auditstill reports a chain rooted inbraces(GHSA-vfj7-8cjw-p6xm, via micromatch/chokidar under mocha and tsd). That advisory has no patched release yet (<=3.0.3is the latest), so there is nothing to bump to. It is dev-only and not tracked as a Dependabot alert.Verification
Locally on Node 22:
npm audit --omit=dev --audit-level=high: 0 vulnerabilitiesnpm run lint,npm run test:types,npm run test:offline: all passing (94 offline tests)