Repository navigation
[SCF-2416] [Part 9] Force and refresh remaining vulnerable dependencies - #24
Open
Gaurav0 wants to merge 13 commits into
Conversation
14 dev-tree packages still depend on ember-cli-babel@^7, and every release up to 8.3.1 pins @babel/runtime 7.12.18 (CVE-2025-27789). A resolution collapses them onto the single 7.29.10 copy that ember-cli-babel 8.3.2 already uses (it asks for ^7.29.7). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
mocha 8 pins serialize-javascript 5.0.1 exactly (one high and one moderate advisory, fixed in >=7.0.5). A resolution scoped to mocha moves it to 7.1.4. mocha only requires it in parallel mode (lib/nodejs/buffered-worker-pool.js), and 7.x is still CommonJS with the same API. The node tests pass both serially and with --parallel. serialize-javascript 7 requires Node >= 20, which this repo already requires. It's a devDependency only, so consumers aren't affected. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
morgan 1.10.0 (three moderate advisories, fixed in 1.12.1) -> 1.12.1, within ember-cli's ^1.10.0 range. It also dedupes on-headers onto 1.1.0. Lockfile refresh only. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
qs 6.14.0 (four moderate advisories, fixed in 6.16.1) -> 6.17.1, within tiny-lr's ^6.4.0 range (ember-cli). The ~6.16.0 copy used by express and body-parser is already 6.16.2. Lockfile refresh only. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
follow-redirects 1.15.9 (moderate, fixed in 1.16.0) -> 1.16.2, within http-proxy's ^1.0.0 range (ember-cli, testem). Lockfile refresh only. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
yaml 1.10.2 (moderate, fixed in 1.10.3) -> 1.10.3, within cosmiconfig's ^1.10.0 range (husky, lint-staged). Lockfile refresh only. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
ajv 6.12.6 (moderate, fixed in 6.14.0) -> 6.15.0, within the ^6.12 ranges of eslint, @eslint/eslintrc and schema-utils 2/3. ajv 8.17.1 (moderate, fixed in 8.18.0) merges with the 8.20.0 copy already in the tree (schema-utils 4, ajv-formats, stylelint's table). Lockfile refresh only. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
postcss-selector-parser 7.1.0 (moderate, fixed in 7.1.6) -> 7.1.7, within the ^7.0.0 ranges of postcss-modules-local-by-default and postcss-modules-scope (css-loader, through ember-auto-import). Lockfile refresh only. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
browserstack-local 1.5.7 (moderate, fixed in 1.5.9) -> 1.5.16, within ember-cli-browserstack's ^1.4.2 range. Newer releases swap ps-tree and temp-fs for tree-kill, which removes event-stream and related packages from the tree. Lockfile refresh only. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
node-notifier 10 (ember-cli > testem) asks for uuid ^8.3.2. The moderate
advisory is fixed only in 11.1.1, so a resolution scoped to node-notifier
moves it there. node-notifier only does `const { v4 } = require('uuid')`
in its Windows toaster notifier, and uuid 11 still exports CommonJS
(exports.node.require), so that keeps working.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…8.6) ember-try-config 4 (the latest, used by ember-try 3 and 4) asks for package-json ^6.5.0, which pins got ^9.6.0 (moderate advisory, fixed in 11.8.5). Forcing got alone would break package-json 6, which passes got 9's `json: true` option. package-json 7.0.0 is still CommonJS, has the same API, and depends on got ^11.8.2, so the resolution targets it instead. got resolves to 11.8.6. Checked by calling ember-try-config's fetch-ember-versions, which still lists every ember-source release from the registry. (ember-try only loads it for versionCompatibility autogeneration, and our ember-try config sets explicit scenarios.) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…i-component gone) broccoli 3.5.2 (ember-cli 5.4 asks for ^3.5.2) depends on sane ^4.0.0, which pulls in micromatch 3.1.10 (moderate, fixed in 4.0.8) and, through snapdragon/source-map-resolve, decode-uri-component 0.2.2 (moderate, fixed in 0.5.0). Forcing broccoli's sane to ^5.0.1 merges it with the sane 5.0.1 that ember-cli already uses directly (and that broccoli 4 depends on). It has the same API, on micromatch 4 and anymatch 3. This drops micromatch 3, anymatch 2, snapdragon and decode-uri-component from the tree. Checked with `ember serve`: a change to tests/dummy/app/app.js is picked up and rebuilds. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
d78c21e added them to dependencies to declare patched version floors, but the addon never imports them. A direct dependency doesn't change which copies other packages in a consuming app resolve, so consumers just installed three unused packages. That is up to the app's own resolutions/overrides, or to upgrading the packages that depend on them. The lodash resolution stays for this repo's own tree, and yarn.lock keeps the same versions. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Nov 5, 2026
[SCF-2416] [Part 2] Upgrade test and lint tooling (ESLint 8, Prettier 3, ember-try 3, stylelint)
#17
Open
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Clears the remaining audit advisories in the dev tree with resolutions and lockfile refreshes, and drops three unused dependencies.
Resolutions, each scoped as narrowly as possible:
@babel/runtime^7.29.7. 14 dev-tree packages still use ember-cli-babel 7, which pins 7.12.18 (CVE-2025-27789).serialize-javascript→ ^7.1.4. Only used in mocha's parallel mode. The node tests pass serially and with--parallel.uuid→ 11.1.1. It only usesv4through CommonJS, which 11 still exports.package-json→ 7.0.0, sogotresolves to 11.8.6. Forcinggotalone would break package-json 6.sane→ ^5.0.1. This drops micromatch 3, snapdragon anddecode-uri-component. Checked withember servethat rebuilds still fire.Lockfile refreshes within existing ranges: morgan 1.12.1, qs 6.17.1, follow-redirects 1.16.2, yaml 1.10.3, ajv 6.15.0/8.20.0, postcss-selector-parser 7.1.7 and browserstack-local 1.5.16.
Removed
handlebars,lodashandpostcssfromdependencies. d78c21e added them to declare patched version floors, but the addon never imports them, and a direct dependency doesn't change which copies other packages resolve. Thelodashresolution stays for this repo's own tree.package.json: +6/−4.yarn.lock: +158/−800.Overlaps with PR #5
PR #5 (
joeu/feat/scf-2416-upgrade-babel-runtime) adds the same@babel/runtime ^7.29.7resolution as this part's first commit. Either close #5 in favor of this part, or merge #5 and drop that commit from here.Stack
Part of the SCF-2416 work (ember-bootstrap 5.0.0), split from
scf-2416-reworkfor easier review. This is part 9 of 9. Stacked on Part 8: its base isgaurav/chore/SCF-2416-part-8-ember-cli-update-5-4, so the diff only shows this part. Merge in order.Review notes
Each commit is one advisory, and its message names the advisory, the dependency path and why the forced version is compatible. All of these are devDependencies except the removed
handlebars/lodash/postcss, so consumers only see those three removals.Testing
Run on this branch with Node 20.19.6:
yarn install --frozen-lockfilepasses,yarn lintreports 0 errors (the same 150 warnings asscf_master), andember test(Ember 4.8, the default) has 535 passed, 9 skipped and 0 failed. No new tests. The tree is identical toscf-2416-rework. CI covers the ember-try matrix.🤖 Generated with Claude Code