fix(deps): npm audit fixes for job 30257651403 - #195
Closed
vnsamy-code wants to merge 4 commits into
Closed
Conversation
npm ci was failing on every CI job with "Missing: @emnapi/runtime@1.11.3 from lock file". My local npm (11.6.2) resolves the napi-rs optional peer deps differently than CI's bundled npm 10.9.8, so the lockfile looked consistent locally but wasn't portable to the Linux runner.
…ions npm's own tooling (install, update, dedupe, audit fix, audit fix --force) consistently refuses to touch @storybook/test-runner's bundled nyc/rimraf/ test-exclude chain, and the jest-reporters glob chain, regardless of any override applied in package.json - scoped or not. audit fix --force does trigger a resolution, but it ignores overrides entirely and instead proposes an unrelated 25-finding cascade (even suggesting a jest downgrade to a 2019-era 25.0.0), so it isn't a usable path. Hand-edited package-lock.json instead: replaced the four stale glob@7.2.3/ 10.5.0 entries (under nyc, rimraf, test-exclude, and the jest-reporters chain) with glob@13.0.6, which depends on minimatch@^10.2.2 (already overridden to a patched brace-expansion) instead of the old vulnerable minimatch@3.x/9.x lines. Added the two new leaf deps glob@13 needs (path-scurry@2.0.2, lru-cache@11.5.2) and removed now-orphaned entries. Also bumped the separately-stuck node_modules/js-yaml (nyc's @istanbuljs/load-nyc-config chain) from 4.2.0 to 4.3.0 the same way. Verified npm ci and npm audit are clean under both the local npm and npm 10.9.8 (matching CI). Full build, typecheck, lint, and test suite pass with zero new failures - the only failures are the same pre-existing environment-specific ones (missing rubocop/golangci-lint binaries and reporter toolchains locally), confirmed identical before and after this change by diffing failure signatures. npm audit: 2 -> 0 vulnerabilities.
…hed versions" This reverts commit 4b4886f.
Owner
|
Thanks for helping me with resolving the audit issues while I'm on vacation @vnsamy-code. The audit issues are now resolved upstream and main has no audit issues. I will be closing this one now. Thanks again! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes npm audit findings in job: https://github.com/nizos/tdd-guard/actions/runs/30257651403/job/89949895940#step:5:1