Skip to content

Dep vulnerabilities - #259

Merged
tmoody merged 4 commits into
mainfrom
dep-vulnerabilities
Jul 21, 2026
Merged

Dep vulnerabilities#259
tmoody merged 4 commits into
mainfrom
dep-vulnerabilities

Conversation

@YuryShkoda

@YuryShkoda YuryShkoda commented Jul 21, 2026

Copy link
Copy Markdown
Member

Issue

npm audit reported 12 vulnerabilities (6 high, 3 moderate, 3 low) in transitive dev dependencies pulled in by the jest/webpack toolchain (ajv, brace-expansion, js-yaml, minimatch, picomatch, serialize-javascript, terser-webpack-plugin, webpack, @babel/core, @babel/helpers, diff).

Intent

Bring npm audit back to a clean state without touching any production dependency behavior, and pick up the current @sasjs/core release for dev/test tooling while in the neighborhood.

Implementation

  • Ran npm audit fix to update transitive dev dependencies to patched versions — resolves all 12 findings (0 vulnerabilities remaining). Only package-lock.json changed; no direct dependency ranges in package.json needed to move.
  • Bumped @sasjs/core (dev dependency) from 4.59.9 to 4.68.1 in package.json/package-lock.json.
  • Fixed a pre-existing Prettier formatting issue in src/types/targetValidators.ts surfaced by npm run lint.

Verification: tsc --noEmit clean, full Jest suite passes (37 suites / 419 tests), npm run lint passes, npm audit reports 0 vulnerabilities.

Checks

  • Code is formatted correctly (npm run lint:fix).
  • All unit tests are passing (npm test).
  • All sasjs-cli unit tests are passing (npm test).
  • Reviewer is assigned.

Reviewer checks

  • Any new code is documented.

Updates transitive dev dependencies (jest/webpack toolchain) to patched
versions, bringing npm audit from 12 findings (6 high) down to 0.
Drops the reviewer-lottery GitHub Action and its config, deprecating
automatic reviewer assignment on PR open.
@tmoody
tmoody merged commit 9b86b82 into main Jul 21, 2026
4 checks passed
@tmoody
tmoody deleted the dep-vulnerabilities branch July 21, 2026 10:15
@sasjs-gha

sasjs-gha Bot commented Jul 21, 2026

Copy link
Copy Markdown

🎉 This PR is included in version 3.5.9 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

@sasjs-gha sasjs-gha Bot added the released label Jul 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants