Bump mocha from 11.7.6 to 11.8.0 - #511
Conversation
dependabot
Bot
added
dependencies
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
dependabot
Bot
added
dependencies
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit d345206. Configure here.
| "integrity": "sha512-ATTK5Q4gFVg0YDp1my2vqygyvhcklD/UV5GIlYHooGTn/NogJqIzpetkD6E5kmuVULqz/S9inUL25XcAgDRJQg==", | ||
| "version": "6.0.2", | ||
| "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-6.0.2.tgz", | ||
| "integrity": "sha512-Saa1xPByTTq2gdeFZYLLo+RFE35NHZkAbqZeWNd3BpzppeVisAqpDjcp8dyf6uIvEqJRd46jemmyA4iFIeVk8g==", |
There was a problem hiding this comment.
Vulnerable dependency pin undone
High Severity
The mocha bump pulls serialize-javascript down to 6.0.2, which is affected by GHSA-5c6j-r48x-rmvq (RCE). That undoes the existing resolutions pin to ^7.0.6. This repo installs with npm, so Yarn resolutions are ignored; without an npm overrides entry (or a direct dependency), the lockfile keeps the vulnerable 6.x release.
Additional Locations (2)
Reviewed by Cursor Bugbot for commit d345206. Configure here.
Bumps [mocha](https://github.com/mochajs/mocha) from 11.7.6 to 11.8.0. - [Release notes](https://github.com/mochajs/mocha/releases) - [Changelog](https://github.com/mochajs/mocha/blob/v11.8.0/CHANGELOG.md) - [Commits](mochajs/mocha@v11.7.6...v11.8.0) --- updated-dependencies: - dependency-name: mocha dependency-version: 11.8.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
d345206 to
f369715
Compare
Bumps mocha from 11.7.6 to 11.8.0.
Release notes
Sourced from mocha's releases.
Changelog
Sourced from mocha's changelog.
Commits
90c1bb3chore(v11.x): release 11.8.0 (#6076)05aec43chore(CI): bump Node from 22 to 24 in publish action (#6206)1f44d5fchore: change site title to Mocha 11, update index note (#6086)26deb23chore: add modern Netlify to v11.x branch (#6082)7830309feat: add --fail-hook-affected-tests option to report skipped tests as failed...41f2b95chore(v11.x): release 11.7.7 (#6068)3477563fix: surface ts-node compile errors (#6045)Note
Low Risk
Dev-only test dependency bump with no changes to the published extension or production code paths.
Overview
Bumps the mocha dev dependency from 11.7.6 to 11.8.0 in
package.jsonand refreshespackage-lock.jsonaccordingly.This is a test-runner-only dependency change with no extension runtime impact. Mocha 11.8.0 adds the optional
--fail-hook-affected-testsflag and includes a ts-node compile error surfacing fix from 11.7.7.Reviewed by Cursor Bugbot for commit f369715. Bugbot is set up for automated code reviews on this repo. Configure here.