Repository navigation
chore(deps): resolve npm audit findings - #463
Merged
Merged
Conversation
- Bump `jest`, `jest-environment-jsdom`, `@types/jest` and `@jest/types` from 29 to 30 - Bump `jsdom` from 22 to 26 to match `jest-environment-jsdom` - Bump `@typescript-eslint/parser` and `@typescript-eslint/eslint-plugin` from 6 to 8 - Bump `eslint` to 8.57 and `eslint-config-airbnb-typescript` to 18 - Re-enable the base ESLint formatting rules that `@typescript-eslint` 8 removed, with the options `eslint-config-airbnb-typescript` used - Replace `chokidar-cli` with `chokidar` 4 driven by `watch.ts` in the `develop-watch` script - Add `@types/node` 20, required by the `chokidar` 4 typings - Override `js-yaml` under `@istanbuljs/load-nyc-config` to 4, which drops the `argparse` 1 chain - Add `.npmrc` with `legacy-peer-deps`, as `eslint-config-airbnb-typescript` still declares `@typescript-eslint` 7 peers - Drop the unused catch binding in `call.ts` flagged by `no-unused-vars` in `@typescript-eslint` 8 Signed-off-by: penge <ppenge@gmail.com>
- Remove `eslint-config-airbnb-typescript`, last released in 2024 and peer-locked to `@typescript-eslint` 7 - Inline the TypeScript-aware rule swaps, import resolver settings and `.ts`/`.tsx` overrides it provided directly in `.eslintrc` - Remove `.npmrc`, as the `legacy-peer-deps` workaround is no longer needed Signed-off-by: penge <ppenge@gmail.com>
- Bump `typescript` from `5.2.2` to `5.9.3` - Type the `downloadBlob` parameter as `Uint8Array<ArrayBuffer>`, since `Uint8Array` became generic in TypeScript 5.7 and the broader default is no longer accepted as a `BlobPart` Signed-off-by: penge <ppenge@gmail.com>
This was referenced Oct 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolve all
npm auditfindings. Two of them (braces,sprintf-js) have nopatched release, so they are removed from the dependency tree instead:
jest,jest-environment-jsdom,@types/jest,@jest/typesto 30 andjsdomto 26@typescript-eslint/*to 8 andeslintto 8.57eslint-config-airbnb-typescript(unmaintained, peer-locked to typescript-eslint 7) and inline the rules it provided in.eslintrcchokidar-cliwithchokidar4 and awatch.tsscript fordevelop-watch@types/node20 (needed bychokidar4 typings)js-yamlunder@istanbuljs/load-nyc-configto 4call.tsflagged byno-unused-varstypescriptfrom 5.2.2 to 5.9.3 and type thedownloadBlobparameter asUint8Array<ArrayBuffer>Test plan
npm auditreports 0 vulnerabilitiesnpm ci,npm run lint,npm run test,npm run buildpass locallydevelop-watchrebuilds onsrcchanges and copiespublicchanges