[replicated-software-factory]

Summary

Unattended dependency maintenance for replicated-lib, continuing the cadence from #140. This round absorbs the two green-but-unreviewed Dependabot majors that have been stuck open since earlier this cycle, plus a routine in-range lockfile refresh.

Changes

Major bumps (absorbed from Dependabot PRs that were stuck at REVIEW_REQUIRED with passing CI):

• pako 2.2.0 → 3.0.2 (Dependabot chore(deps): bump pako and @types/pako #137) — ships its own TypeScript types now; the deprecated @types/pako 2.x stub is removed. The only usage (import { gzip } from "pako" in src/releases.ts) is a named import and works unchanged against pako 3's CommonJS export.
• get-port 6.1.2 → 7.2.0 (Dependabot chore(deps-dev): bump get-port from 6.1.2 to 7.2.0 #129) — ESM-only; not imported anywhere in src/ (only referenced from jest.config.ts, which maps it to the physical file, and as a mockttp transitive that already resolved v7). jest 30.5.2 dedupes it cleanly.

In-range refresh (npm update, lockfile only):

• babel-plugin-istanbul 8.0.2 → 8.0.0 (rolls back within ^8.0.0 to current registry state)
• browserslist data: browserslist 4.29.3 → 4.29.4, baseline-browser-mapping 2.11.29 → 2.11.30, caniuse-lite 1.0.30001816 → 1.0.30001817, electron-to-chromium 1.5.459 → 1.5.461
• napi-postinstall 0.3.4 → 0.3.5
• mockttp-scoped semver 7.8.4 → 7.8.5

Not taken (intentional)

• typescript 7.0.2 is latest but held at 5.9.3: ts-jest 29.4.15 peer range is typescript >=4.3 <7, so a TS major would break the test toolchain (no forward fix available yet).
• Dependabot chore(deps-dev): bump jest from 30.3.0 to 30.4.2 #123 (jest 30.3.0 → 30.4.2), chore(deps-dev): bump jest-util from 30.3.0 to 30.4.1 #118 (jest-util 30.3.0 → 30.4.1), chore(deps-dev): bump fs-extra from 11.3.4 to 11.3.6 #124 (fs-extra 11.3.4 → 11.3.6) are obsolete: current lockfile already resolves jest 30.5.2, jest-util 30.5.1, and fs-extra 11.4.0 under the existing ranges. They should be closed as superseded.
• Audit findings: production tree (npm audit --omit=dev) is clean at 0 vulnerabilities. The 20 moderate findings remain the known dev-only jest-25-era cluster documented in [deps] Dependency update: replicated-lib #139/[deps] Dependency update: replicated-lib #140 (sprintf-js has no fixed release; npm's suggested fixAvailable requires downgrades that reintroduce critical/high advisories).

Verification

• make test (clean → deps → build → jest): 105/105 tests passed, 8/8 suites (includes the 9 new scheduling-status tests from fix(clusters): report scheduling status when waiting for a cluster #141/fix(vms): report scheduling status when waiting for a VM #142)
• make prettier-check: clean
• npm audit --omit=dev: 0 vulnerabilities
• One transient failure observed during a first make test run was port contention (EADDRINUSE :::8080) from an overlapping earlier run of the same suite; a clean re-run passes fully. Not related to these changes.

Follow-up (2026-10-22, commit 49e56ed)

Rebased onto latest main (absorbs #141/#142 scheduling-status fixes) and refreshed the lockfile again; package.json is unchanged this round.

Lockfile-only transitive refresh (npm update):

• body-parser 2.3.0 → 2.4.0, on-finished 2.4.1 → 2.4.2 (dev, mockttp chain)
• napi-postinstall 0.3.5 → 0.3.7, node-releases 2.0.59 → 2.0.60, caniuse-lite 1.0.30001817 → 1.0.30001819, electron-to-chromium 1.5.461 → 1.5.463 (dev)

Rejected again: a parallel npm audit fix run briefly downgraded jest to ^25.0.0 (resolving 25.5.4), which breaks the ts-jest@29.4.15 peer range (jest ^29 || ^30, npm ERESOLVE-confirmed). It was reverted; the audit stance above is unchanged — prod tree has 0 vulnerabilities, the 20 moderates are the known dev-only jest-25-era cluster with no forward fix.

Verification (rerun on 49e56ed): make test 105/105 tests, 8/8 suites; make prettier-check clean; npm audit --omit=dev: 0 vulnerabilities. CI green on the new head. One first-run failure was the known EADDRINUSE :::8080 mockttp port-contention transient (documented above); a clean re-run passes fully.