chore(deps): re-resolve the examples demo toolchain past its advisories - #9
Merged
Merged
Conversation
Security scanners flag twenty-three dependency lines in the examples lockfile, all but one with patched releases available. The demo declares chai, mocha, ts-node and typescript as `*`, so yarn froze them at whatever was current when the lockfile was first written; mocha stayed on a release that pins js-yaml, minimatch and serialize-javascript to exact versions, and an exact pin is beyond the reach of a lockfile bump, which is why the security updates kept clearing only part of the set. Pinning the four floating ranges at parity with the root package and regenerating the lockfile lifts every advisory that has a patch, serialize-javascript included, through the same resolutions entry the root already carries. chai stays on 4.x deliberately, because the specs are CommonJS while chai 5 and later are ESM only, and nothing here would catch that break: the wasm fixtures are gitignored and blanc++ is unavailable, so the demo suite cannot run. elliptic GHSA-848j-6mx2-7j84 is the one line no release fixes, and it stands open against the root lockfile for the same reason. The examples install inside the test script now runs frozen, so the publish workflow, which runs that script, installs the lockfile CI proved rather than resolving the demo afresh at release time. A version bump on the root package does not disturb it, because yarn keys the file entry on its pattern rather than on the resolved version.
There was a problem hiding this comment.
Pull request overview
Updates the examples toolchain to resolve dependency advisories and make release-time example installs reproducible.
Changes:
- Pins example test-tool dependencies to supported ranges.
- Regenerates the examples lockfile with patched transitive dependencies.
- Enforces frozen example installs during root tests.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
package.json |
Uses the frozen examples lockfile during tests. |
examples/package.json |
Pins toolchain ranges and resolves serialize-javascript. |
examples/yarn.lock |
Records the updated dependency graph. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Twenty-three Dependabot advisories stand against
examples/yarn.lock. Dependabot's own security update (#8) reaches ten of them and structurally cannot reach the rest: the demo declareschai,mocha,ts-nodeandtypescriptas*, and yarn froze those at the versions current when the lockfile was first written.mochastayed on 9.2.x, which pinsjs-yaml,minimatchandserialize-javascriptto exact versions, and an exact pin is beyond the reach of a lockfile bump.Pinning the four floating ranges at parity with the root package and regenerating the lockfile lifts every advisory that has a patched release.
mocha10.8.2 carries ranges rather than pins and needs the sameserialize-javascriptresolution the root already carries, because no patched 6.x exists. The file dependency on the root package re-reads its runtime dependencies, soellipticandbn.jsmove with it.chaistays on 4.x on purpose. The specs are CommonJS and chai 5 and later are ESM only, and no check here would catch that break, because the wasm fixtures are gitignored and blanc++ is unavailable.One advisory survives by design:
ellipticGHSA-848j-6mx2-7j84 has no patched version, and it stands open against the root lockfile for the same reason.The examples install inside the
testscript now runs frozen. The publish workflow runs that script, so a release installs the lockfile CI proved instead of resolving the demo afresh. This adds no release chore: yarn keys the file entry on its pattern rather than on the resolved version, so bumping the root version leaves the lockfile untouched, which was checked against a simulated 2.2.1 bump on a cleannode_modules.This supersedes #8, which will be closed once this merges.
Validation
Root install frozen,
yarn run build, 35 unit tests passing (the same count as the previous run), packaging 8/8, release notes 12/12.yarn run testpasses end to end, which exercises the new frozen examples install.examplesinstalls clean under--frozen-lockfile.The demo suite itself cannot run:
examples/**/*.wasmis gitignored and blanc++ is not available, sorun-p test:*has no contracts to load. Type checkingexamplesreports the same twelve duplicate-package errors on this branch and onmain, verified side by side in a worktree, so that red is pre-existing and carried as found.yarn run build-webfails with the same nineteen node-builtin resolution errors before and after; CI never runs it.