Dependabot cleanup - #1234
Merged
Merged
Conversation
b94a023 bumped mocha to ^11.7.5 in package.json but left package-lock.json resolving mocha at 10.2.0, so CI kept installing the old tree. Regenerate the lock so the declared version is what actually gets installed. Clears the mocha-transitive alerts that v11 fixes (nanoid, several minimatch and js-yaml ranges, yargs-parser).
The vendored copies of long@4.0.0 and jspack@0.0.4 kept the devDependencies from their published package.json. npm installs devDependencies of file: dependencies, so "webpack": "^3.10.0" in the vendored long dragged in the whole webpack@3 / node-libs-browser / crypto-browserify tree: elliptic, sha.js, cipher-base, pbkdf2, browserify-sign, json5 and braces, every one of them with open advisories. Neither vendored copy is built here - long ships a prebuilt dist and we do not run their test suites - so these serve no purpose. Takes the installed tree from 640 to 283 packages and clears 13 Dependabot alerts including 5 of the 7 criticals.
The "lint" script is not run by any workflow or shell script in the tree, so eslint@6 (EOL 2019) and its babel-eslint@10 parser (deprecated, renamed to @babel/eslint-parser) have been installed by CI for years without ever being invoked. Between them they pull in @babel/traverse, lodash, flatted, tmp, ajv and semver, all with open advisories. glob and winston are declared as dependencies but required by nothing in the repo - winston appears only in a comment about the caller-supplied logger object. Drop all four along with the now-dead lint script and .eslintrc.json. Anyone wanting linting back should add eslint@9 with @babel/eslint-parser and actually wire it into CI. generator/javascript goes from 283 to 123 installed packages, generator/javascript_stable to 114. Clears 20 alerts including the remaining 2 criticals. npm test still passes: 2772 tests.
Hard-pinned at 1.12.1, which is affected by GHSA-qpx9-hpmf-5gmw (unbounded recursion in _.flatten and _.isEqual). 1.13.8 is the fix. Only the stable generator emits code that requires underscore; the current generator does not use it at all. npm test still passes: 2772 tests.
javascript_stable left mocha, should and sinon unversioned (""), so its
lock drifted and pinned mocha 11.7.1. Pin them to the same versions the
other generator uses and npm update both lockfiles.
Picks up glob 10.5.0, minimatch 9.0.9 and js-yaml 4.3.0 in place of the
older versions mocha's tree was holding.
The refresh moves both files to lockfileVersion 3. CI's oldest node is 18
(npm 9), which reads v3 natively.
npm test still passes: 2772 tests. What remains in npm audit is 6
advisories inside mocha's own dependency tree - brace-expansion, diff,
glob, minimatch, serialize-javascript - none of which mocha has published
a fix for; installing mocha@latest standalone reproduces the same 6.
This was referenced Jul 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.