Clear OSV-Scanner HIGH/MED/LOW findings via dep bumps + overrides

[vikrantpuppala]

Summary

Bumps deps + adds package.json overrides to clear all OSV-Scanner HIGH and MED findings on databricks/databricks-sql-nodejs. Companion to #388 (the security workflow PR).

Top-level bumps

Type	Package	From	To	Why
runtime	thrift	0.16.0	0.23.0	clears GHSA-r67j-r569-jrwp (HIGH) + GHSA-526f-jxpj-jmg2
runtime	uuid	^9.0.0	^11.1.1	clears GHSA-w5hq-g745-h8pq (HIGH 7.5, buffer-bounds in v3/v5/v6)
dev	mocha	10.2.0	10.8.2	transitive CVE cleanup
dev	eslint	8.22.0	8.57.1	transitive CVE cleanup
dev	eslint-plugin-import	2.26.0	2.32.0	transitive CVE cleanup
dev	@types/node-fetch	2.6.4	2.6.13	type-only
dev	typescript	^4.9.3	5.5.4 (exact pin)	uuid@11's .d.ts uses export type * (TS 5+). Pinned <5.6 to avoid TS 5.6+'s @types/node Buffer-generic emit changing our published .d.ts.

overrides for deep transitives

Each entry pinned to the lowest version that clears its CVEs:

"overrides": {
  "basic-ftp": "^5.3.1",
  "@75lb/deep-merge": "^1.1.2",
  "braces": "^3.0.3",
  "picomatch": "^2.3.2",
  "flatted": "^3.4.2",
  "minimatch": "^3.1.3",
  "ws": "^8.18.0",
  "cross-spawn": "^7.0.6",
  "serialize-javascript": "^7.0.5",
  "follow-redirects": "^1.16.0",
  "brace-expansion": "^1.1.13",
  "@babel/helpers": "^7.26.10",
  "@babel/runtime": "^7.26.10",
  "@babel/runtime-corejs3": "^7.26.10",
  "ip-address": "^10.1.1",
  "js-yaml": "^4.1.1",
  "micromatch": "^4.0.8",
  "uuid": "^11.1.1"
}

The uuid override forces thrift@0.23.0's transitive uuid (it declares ^13.0.0) back to v11. uuid@13 is ESM-only, which breaks require() chains in older Node versions.

Net OSV-Scanner result

HIGH:  22 -> 0
MED:   15 -> 0
LOW:    5 -> 0

All findings cleared. Local OSV-Scanner v2.3.8 against the regenerated lockfile reports No issues found.

Engine + matrix changes

• package.json engines.node: >=14.0.0 → >=16.0.0
• Workflow unit-test matrix: [14, 16, 18, 20] → [16, 18, 20, 22, 24]
• Workflow e2e-test: single Node 20 job → matrix [16, 18, 20, 22, 24] to catch Node-version-sensitive behaviors (TLS, native fetch, lz4 ABI, OAuth crypto) that mocked unit tests can't surface

Why drop Node 14: The npm ecosystem now ships ES2021 syntax (||=) in widely-used transitive deps that Node 14's V8 cannot parse. Specifically, @dabh/diagnostics@2.0.7+ (transitive of winston@3.x) switched its colorspace dep to @so-ric/colorspace, which uses ||= in its CJS bundle:

SyntaxError: Unexpected token '||='
  at node_modules/@so-ric/colorspace/dist/index.cjs.js:1976

This pattern is recurring — future dep regenerations will keep pulling in newer transitives that target newer Node. Node 14 has been EOL upstream since April 2023 (3+ years ago). Aligning with EOL rather than playing whack-a-mole.

Test-file changes for Node 22+ ESM compatibility

Node 22+'s module auto-detection loads .ts specs through the ESM loader, where CJS globals like __dirname and require aren't defined. Three test files needed updates:

• thrift-field-id-validation.test.ts: resolve THRIFT_DIR from process.cwd().
• ArrowResultConverter.test.ts: resolve arrow stub paths from process.cwd().
• lz4.test.ts: skip the suite when typeof require === 'undefined'. The suite specifically tests CJS-only primitives (Module._load, require.cache) — the production lz4 loader works on Node 22+ ESM contexts; only this test's mechanism is CJS-bound.

CI infrastructure fix (one-time)

setup-jfrog composite action now rewrites package-lock.json resolved: URLs from public-npm (registry.npmjs.org) and the internal dev-proxy (npm-proxy.dev.databricks.com) to the JFrog mirror. Protected runners cannot reach either upstream directly, so without this rewrite npm hangs ~8 minutes on any package not already in ~/.npm cache before dying with "Exit handler never called", which silently skips bin-linking and breaks downstream prettier/nyc calls. The committed lockfile stays in standard form so contributors can npm ci locally without JFrog auth.

Test stub follow-ups required by the bumps

• tests/unit/.stubs/OAuth.ts: added [Symbol.asyncDispose]() stub on OAuthCallbackServerStub — @types/node ≥ 18.19 added it to http.Server.
• OAuthManager.test.ts: added FAPI2Client to the issuer stub — openid-client ≥ 5.5 widened the Issuer interface.
• AuthorizationCode.test.ts: cast the sinon.spy assignment to as any for the private-field write.
• FederationProvider.ts: cast controller.signal through any — TS 5 caught a benign incompatibility between node-fetch's AbortSignal shim and the native AbortSignal that TS 4 missed.

Customer-facing impact

Surface	Change	Impact
Published runtime (dist/*.js)	TS 5 cosmetic emit changes (enum init pattern, export hoisting, comments preserved)	None. Behavior identical.
Published declarations (dist/*.d.ts)	TS 5 dropped obsolete /// <reference types="node" /> directives in 12 files. Preserved one inline comment in DBSQLParameter.d.ts. No Buffer<ArrayBufferLike> leak (TS 5.5 uses the @types/node ts5.6/ fallback shim).	None for any consumer's TS version.
dependencies.uuid	^9.0.0 → ^11.1.1	uuid@11 is dual-published ESM+CJS; works on Node 16+ which we still support.
engines.node	>=14 → >=16	Consumers on Node 14 (EOL since Apr 2023) get an npm warning on install. Hard error only if they opted into engine-strict=true.

Test plan

• npm run build clean on Node 16/18/20/22/24
• npm test passes on Node 16/18/20 (904 passing); Node 22/24 (898 passing + 6 pending — the lz4 CJS-only suite)
• OSV-Scanner v2.3.8 reports zero findings against the regenerated lockfile
• CI green on [16, 18, 20] matrix as of 01128d0
• CI green on extended [16, 18, 20, 22, 24] matrix (this PR's latest commit a440860)
• e2e-test green across the matrix

This pull request was AI-assisted by Isaac.

[github-actions]

Thanks for your contribution! To satisfy the DCO policy in our contributing guide every commit message must include a sign-off message. One or more of your commits is missing this message. You can reword previous commit messages with an interactive rebase (git rebase -i main).