deps: resolve 36 of 37 open Dependabot alerts - #10
Open
nitinpunn-attention wants to merge 2 commits into
Open
Conversation
Runtime dependencies: @actions/core ^1.10.1 -> ^2.0.3 @actions/github ^6.0.0 -> ^8.0.1 These majors are required to leave the undici 5.x line, which is inside the vulnerable range of every open undici advisory. They drop the uuid dependency and move the octokit chain past its advisories: undici 5.28.3 -> 6.28.0 uuid 8.3.2 -> removed @octokit/request 8.2.0 -> 10.0.13 @octokit/request-error 5.0.1 -> 7.1.1 @octokit/plugin-paginate-rest 9.2.1 -> 14.0.0 Development dependencies updated in place within existing ranges: js-yaml, minimatch, brace-expansion, picomatch, flatted, @babel/core, @babel/plugin-transform-modules-systemjs, plus braces, micromatch, cross-spawn, ajv, @babel/runtime and @babel/helpers, which npm audit flagged at baseline but Dependabot did not raise. Adds a narrow override for minimatch under @typescript-eslint/typescript-estree, which pins minimatch 9.0.3 exactly. Remove it once eslint-plugin-github moves off @typescript-eslint 7.1.0. The octokit packages are now ESM only, so babel.config.js and a jest transformIgnorePatterns entry let the existing CommonJS tests load them. Test count, assertions and 100 percent coverage are unchanged. Workflow: super-linter/super-linter/slim@v6 -> @v8 for GHSA-r79c-pqj3-577x. dist/ regenerated with npm run package.
nitinpunn-attention
changed the title
nitinpunn-attention
marked this pull request as ready for review
August 17, 2026 19:26
The super-linter v6 -> v8 bump in this PR enabled three linters that had never run against this repo, and changed ESLint's default config filename. All four resulting failures are pre-existing code/config newly flagged by newer tooling, not regressions from the dependency work. Verified by running the same linters against the base commit (f3b419f): zizmor exits 14 there too, and eslint reports the identical no-unused-vars error at the same file:line. JAVASCRIPT_ES: super-linter v8 changed JAVASCRIPT_ES_CONFIG_FILE to eslint.config.mjs, so .github/linters/.eslintrc.yml (which sets no-unused-vars: off) is no longer read and super-linter's bundled default config applied instead. Rather than suppress the rule, drop the genuinely unused debugMock binding. The jest.spyOn call is kept so core.debug stays stubbed and test behavior is unchanged. BIOME_FORMAT / BIOME_LINT: Biome is new in super-linter v8 and duplicates the JavaScript toolchain this repo already uses. Its defaults (double quotes, semicolons, tabs) are the exact inverse of .prettierrc.json, so Biome and Prettier cannot both be satisfied. super-linter emits a warning naming this conflict and its upgrade guide recommends keeping only one of each conflicting pair, so Biome is disabled. Prettier and ESLint still run, both here and via npm run format:check / npm run lint in ci.yml, so no JavaScript coverage is lost. This also stops Biome linting the generated dist/ bundle, which produced most of its 112 errors. GITHUB_ACTIONS_ZIZMOR: zizmor is new in super-linter v8. The findings are fixed in the workflows rather than suppressed: persist-credentials: false on every checkout (artipacked), step-level env instead of inline template expansion in ci.yml (template-injection), and a 7 day Dependabot cooldown (dependabot-cooldown). Per GitHub's documentation cooldown applies only to version updates and never to security updates, so vulnerability patches are still delivered immediately. For unpinned-uses, .github/linters/zizmor.yaml allows symbolic tag refs for exactly the three first-party owners this repo consumes (actions, github, super-linter), which restores zizmor's own pre-v1.20.0 default. Any other owner still falls back to zizmor's implicit "*": hash-pin rule, so a new third-party action must be SHA-pinned or the audit fails. This deliberately leaves super-linter on @v8 so Dependabot alert 22 (needs >= 8.3.1, and @v8 resolves to v8.7.0) stays unambiguously resolved. Also drops JAVASCRIPT_DEFAULT_STYLE, which v8 ignores and warns may become a fatal error. Dependabot coverage is unchanged: 36 of 36 npm alerts resolved against this tree, plus alert 22, with zero package.json or package-lock.json churn. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves 36 of 37 open Dependabot alerts in this repository.
Not resolved
The one alert still listed is
super-linter/super-linter/slim. This PR moves it@v6to@v8, and thev8tag currently resolves to the same commit asv8.7.0, which is above the 8.3.1 fix floor. It is a mutable tag, so GitHub may be slow to close the alert.Verification
How coverage was verified: every open alert was re-evaluated against the versions actually resolved
in this branch's manifests and lockfiles (not against manifest text), parsing each
vulnerable_version_rangeclause-by-clause. GitHub's ranges (for example">= 1.0.0, < 2.3.1") are notvalid npm semver, and
semver.satisfies()silently returns false on them.Dependabot will keep listing these as open until this merges; it only re-evaluates the default branch.