fix(deps): upgrade mocha to 12.0.0-beta-9.2 (+ drop Node 18) - #146
Merged
Conversation
Chain-update that bumps mocha 11.7.5 → 12.0.0-beta-9.2 so its declared ranges allow the patched transitive dev-deps to resolve naturally. Mocha 12 requires "^20.19.0 || >=22.12.0", so Node 18 (EOL since Apr 2025) is dropped from the engines field and the CI matrix. Advisories fixed (all patched versions resolve inside the new declared ranges — no out-of-range resolutions needed): - GHSA-f886-m6hf-6m8v brace-expansion ReDoS / hang (moderate) mocha>minimatch>brace-expansion 2.0.2 → 5.0.5 (minimatch ^10) - GHSA-73rr-hh4g-fpgx diff (mocha) parsePatch DoS (low) mocha>diff 7.0.0 → 8.0.4 (mocha 12 declares diff ^8.0.3) - GHSA-5c6j-r48x-rmvq serialize-javascript RCE via RegExp.flags (high) mocha>serialize-javascript 6.0.2 → 7.0.5 (mocha 12 ^7.0.2) - GHSA-qj8w-gfj5-8c6v serialize-javascript CPU DoS (moderate) same upgrade covers this advisory The ts-node > diff advisory (also GHSA-73rr-hh4g-fpgx) is addressed in a separate PR via a scoped resolution. ts-mocha@11.1.0 now prints a peer-dep warning against mocha 12; the full test suite still passes — will clear once ts-mocha publishes mocha 12 compat. yarn audit: 4 of 5 advisories resolved (remaining ts-node/diff is handled in companion PR). 71 tests pass. https://claude.ai/code/session_01HNyci45nMAfRz3baECYtmV
buffcode
force-pushed
the
claude/fix-security-advisories-fuSVV
branch
from
April 21, 2026 07:43
49ce9bf to
88e258c
Compare
buffcode
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Chain-update PR that fixes 4 of the 5 open dev-dep advisories. Bumps
mocha 11.7.5 → 12.0.0-beta-9.2so the declared ranges allow yarn to pick the patched transitive dev-deps naturally — no out-of-range resolutions. The fifth advisory (ts-node > diff) is handled by companion PR #147.Mocha 12 declares
engines.node: "^20.19.0 || >=22.12.0", so this PR also drops Node 18 (EOL since April 2025) from both theenginesfield and the CI matrix.Advisories fixed
mocha > minimatch > brace-expansion(ReDoS / hang)mocha > diff(parsePatch DoS)mocha > serialize-javascript(RCE via RegExp.flags)mocha > serialize-javascript(CPU DoS)Range check
All patched versions resolve inside their parents' declared semver ranges:
brace-expansion 5.0.5^5.0.5diff 8.0.4^8.0.3serialize-javascript 7.0.5^7.0.2Breaking changes
engines.nodeis now^20.19.0 || >=22.12.0. CI matrix reduced to['20', '22']. Required by mocha 12's own engine constraint.Known caveat
ts-mocha@11.1.0now prints a peer-dep warning because its declaredmochapeer caps at^11.X.X. Advisory-only — the full test suite (71 specs) still passes on mocha 12-beta. Will clear oncets-mochapublishes mocha-12 compat.Test plan
yarn installsucceedsyarn audit→ 4 of 5 advisories fixed; remainingts-node>diffhandled by fix(deps): bump ts-node's diff to 4.0.4 (GHSA-73rr-hh4g-fpgx) #147yarn test→ 71 passing (local Node 22)https://claude.ai/code/session_01HNyci45nMAfRz3baECYtmV