Dependency security upgrades and modernization

[dividedmind]

This PR focuses on executing a comprehensive security audit of all package trees across the repository, resolving all active security vulnerabilities (ReDoS, SSRF, Command Injection, pax-size/path confusion, CPU exhaustion, etc.) in both the root workspace and the separate test/pnpm-compat subproject.

All upgraded packages have been thoroughly verified:

• TypeScript compilation is successful (yarn tsc -p tsconfig.build.json passes with 0 errors).
• All Jest unit and integration tests are fully green (38 test suites / 182 tests passed successfully).

---

🚀 Summary of Upgrades

1. Root Workspace - Transitive & Targeted Upgrades (Consolidated)

The following packages were recursively upgraded in the root yarn.lock to target and resolve specific CVEs:

• micromatch: Bumped recursively from 4.0.5 to 4.0.8 (resolves ReDoS).
• @octokit/* packages: Bumped recursively to secure releases (@octokit/plugin-paginate-rest@9.2.2, @octokit/request@8.4.1, @octokit/request-error@5.1.1) to resolve catastrophic backtracking ReDoS vulnerabilities.
• brace-expansion: Upgraded all tree instances (1.1.18, 2.1.4, and 5.0.9) to address process hang, memory exhaustion, and consecutive group DoS.
• diff: Upgraded recursively from 4.0.2 to 4.0.4 to fix low-severity ReDoS.
• ip-address & socks: Bumped recursively to ip-address@10.5.0 (resolves SSRF leading-zero octet decodes) and socks@2.8.9 (fixes package-lock deprecation/issues).
• js-yaml: Bumped all tree instances (3.15.1 and 4.3.1) to resolve quadratic-complexity CPU consumption/DoS.
• tar: Swapped resolution override in package.json from 7.5.11 to 7.5.22 to resolve multiple high/critical CVEs (pax size override file smuggling, numeric path type confusion process crash, negative size infinite loop).
• glob: Bumped recursively from 10.3.10 to 10.5.0 to resolve high-severity CLI Command Injection vulnerability.

2. Root Workspace - semantic-release Major Bump (Separate Commit)

Upgraded the semantic-release suite and its associated plugins to modern major versions:

• semantic-release: ^22.0.5 ➡️ ^25.0.9
• @semantic-release/changelog: ^6.0.3 ➡️ ^7.0.0
• @semantic-release/git: ^10.0.1 ➡️ ^11.0.1

Why this was necessary:
Older versions of semantic-release depended on older releases of @semantic-release/npm and libnpmpublish, which pulled in sigstore <= 4.1.0 (vulnerable to certificate OID verification silently dropping and bypassing constraints). Upgrading semantic-release to v25 recursively upgraded the sub-dependency tree to a secure release of sigstore (>= 4.1.1) and completely resolved multiple deprecated packages like @npmcli/disparity-colors.

3. test/pnpm-compat Subproject (Fixed separately)

The separate package tree in test/pnpm-compat has been upgraded to be 100% clean of vulnerabilities:

• Upgraded postcss from 8.5.14 to 8.5.26
• Upgraded nanoid from 3.3.11 to 3.3.18
• Upgraded tar from 7.5.12 to 7.5.22
• Upgraded ip-address from 10.2.0 to 10.5.0
• Upgraded brace-expansion from 5.0.6 to 5.0.9
• Upgraded vitest to major version 3

---

🔒 Security Audit Results

Running yarn npm audit -R now reports 0 active security vulnerabilities remaining across all packages:

• Root Workspace: Only general deprecation/unsupported notices for older utility packages (like npmlog, rimraf@3, are-we-there-yet) remain.
• test/pnpm-compat: Reports No audit suggestions (100% clean).

---

🛠️ Verification and Build Status

• Build Output: yarn tsc -p tsconfig.build.json compiles with zero warnings or errors.
• Test Runner Results:

  Test Suites: 2 skipped, 38 passed, 38 of 40 total
  Tests:       2 skipped, 182 passed, 184 total
  Snapshots:   58 passed, 58 total
  Time:        28.739 s
  

[Copilot]

Pull request overview

This PR updates dependency versions to address security audit findings and modernize the release/test toolchain across the root workspace and the test/pnpm-compat subproject.

Changes:

• Upgraded semantic-release to ^25.0.9 and updated related plugins (@semantic-release/changelog, @semantic-release/git) in the root workspace.
• Updated the root tar override to 7.5.22 via resolutions.
• Upgraded test/pnpm-compat to vitest@^3.2.6 and refreshed its yarn.lock to the new dependency tree.

Reviewed changes

Copilot reviewed 2 out of 4 changed files in this pull request and generated no comments.

File	Description
package.json	Bumps semantic-release + plugins and updates tar resolution override.
test/pnpm-compat/package.json	Updates vitest major version used by the pnpm compatibility test project.
test/pnpm-compat/yarn.lock	Lockfile refresh reflecting vitest/vite and related transitive upgrades.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/appmap-node@227 -D

commit: 2ed4613

[Copilot]

Pull request overview

Copilot reviewed 4 out of 6 changed files in this pull request and generated no new comments.

Suppressed comments (2)

.github/workflows/ci.yml:21

• This pkg-pr-new publish --commentWithDev step will still run on push runs (including main), where it likely lacks PR metadata to post a comment/associate the preview build. Guard it so it only runs for PR-triggered runs.

          name: appmap-node-${{ env.SHORT_SHA }}
          path: appmap-node-${{ env.SHORT_SHA }}.tgz
      - run: yarn pkg-pr-new publish --commentWithDev --yarn
      - run: yarn lint

.github/workflows/ci.yml:3

• pkg-pr-new publish --commentWithDev is PR-oriented, but this workflow is currently configured to run only on push. That means the preview publish/comment step will run on non-PR pushes (including main) where no PR context exists, and can fail (also preventing downstream test since it now needs: build-and-lint). Consider enabling pull_request events so this can run in PR context.

This issue also appears on line 18 of the same file.

on: push

jobs:
  build-and-lint:

[appmap-releasebot]

🎉 This PR is included in version 2.26.2 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀