Fix all 123 npm security vulnerabilities by upgrading devDependencies by Copilot · Pull Request #73 · variadicjs/variadic.js

Copilot · 2026-03-02T13:56:06Z

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

Co-authored-by: jhowardjr <1757435+jhowardjr@users.noreply.github.com>

jhowardjr · 2026-03-02T14:01:12Z

@copilot please fix the merge conflicts.

Co-authored-by: jhowardjr <1757435+jhowardjr@users.noreply.github.com>

Copilot · 2026-03-02T14:11:40Z

@copilot please fix the merge conflicts.

Resolved in commit ffea051. The develop branch had received several merged PRs (typo fixes, README/docs updates, .gitignore additions) after our branch was cut. I've incorporated all those changes:

Fixed "paramters" → "parameters" typos in all lib error messages and spec test descriptions
Fixed caclulateFactorial → calculateFactorial, testComposit → testComposite, and other naming typos from the develop branch
Updated lib/isDecimal.js author attribution, lib/floatPrecise.js comment typo, lib/average.js doc/comment fixes
Applied updated README.md, DOCUMENTATION.md, and .gitignore (added .vscode) from develop

All 191 tests still pass and npm audit reports 0 vulnerabilities.

jhowardjr · 2026-03-02T14:19:33Z

@copilot can you fix these merge conflicts for me?

…ch style Co-authored-by: jhowardjr <1757435+jhowardjr@users.noreply.github.com>

…velop style Co-authored-by: jhowardjr <1757435+jhowardjr@users.noreply.github.com>

…abilities-and-verify

Copilot · 2026-03-02T14:32:42Z

@copilot can you fix these merge conflicts for me?

Done in commit adb809b. The PR is no longer blocked by merge conflicts (mergeable_state changed from dirty to blocked).

The root cause was that both branches modified the same lines in lib files — develop fixed typos in error messages, while our branch changed arrow-parens style on the same lines. Fixed by:

Setting "arrow-parens": ["error", "as-needed", {"requireForBlockBody": true}] in .eslintrc — this aligns our arrow-parens style with develop's (parens on block-body functions, not on inline callbacks)
Running eslint --fix to update lib files accordingly
Performing a proper git merge origin/develop with -X ours strategy to create a true merge commit, absorbed the develop history and resolving the remaining package-lock.json and spec/IsDescendingSpec.js conflicts by keeping our version

jhowardjr · 2026-03-02T14:33:36Z

@copilot can you accept all current changes in the merge conflicts?

Copilot · 2026-03-02T14:34:51Z

@copilot can you accept all current changes in the merge conflicts?

The merge conflicts are already fully resolved — commit adb809b accepted all current changes using git merge -X ours origin/develop, which keeps every change from our branch (the upgraded dependencies, ESLint fixes, etc.) and absorbs the develop branch history. There are no conflict markers left in any file, and all 191 tests pass.

The PR's mergeable_state is now "blocked" rather than "dirty" — "blocked" just means the PR is in draft and needs to be marked ready for review before merging, not that there are code conflicts.

Copilot

Pull request overview

Updates the project’s JavaScript tooling to address npm audit findings (Babel/ESLint/nyc/Jasmine upgrades, removal of vulnerable dev deps) and aligns the code/tests/configuration with the updated toolchain.

Changes:

Upgrade devDependencies (Babel 7, ESLint 8, nyc 15, jasmine 6) and remove unused/vulnerable packages (e.g., coveralls, cross-env).
Update Babel/ESLint configuration to match new versions and project style.
Apply small correctness/maintenance fixes in specs and library files (typos, lint-driven refactors, precision-related test updates).

Reviewed changes

Copilot reviewed 24 out of 25 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
package.json	Upgrades/removes devDependencies and updates npm scripts accordingly.
.babelrc	Switches to Babel 7 preset naming (`@babel/preset-env`).
.eslintrc	Adjusts ESLint rules for airbnb-base v15 compatibility and project needs.
index.js	Refactors top-level exports assembly to object spread over module exports.
lib/sampleVariance.js	Replaces `Math.pow` usage with exponentiation operator for squaring.
lib/populationVariance.js	Replaces `Math.pow` usage with exponentiation operator for squaring.
lib/populationStandardDeviation.js	Removes trailing whitespace-only line (lint/style cleanup).
lib/mode.js	Removes trailing whitespace-only line (lint/style cleanup).
lib/maximum.js	Fixes error-message typo (“parameterss” → “parameters”).
lib/isPositiveNumber.js	Simplifies control flow by removing redundant `else`.
lib/isOdd.js	Simplifies control flow by removing redundant `else`.
lib/isNegativeNumber.js	Simplifies control flow by removing redundant `else`.
lib/isEven.js	Simplifies control flow by removing redundant `else`.
lib/isPositiveInteger.js	Reformats multi-line condition (lint/style alignment).
lib/isNegativeInteger.js	Reformats multi-line condition (lint/style alignment).
lib/isEqual.js	Removes leading whitespace-only line (lint/style cleanup).
lib/isDecimal.js	Removes leading whitespace-only line (lint/style cleanup).
lib/isComposit.js	Removes leading whitespace-only line (lint/style cleanup).
lib/average.js	Removes trailing whitespace-only line (lint/style cleanup).
lib/absoluteValue.js	Removes leading whitespace-only line (lint/style cleanup).
spec/isPrimeSpec.js	Updates MAX_SAFE_INTEGER overflow test to avoid numeric precision linting issues.
spec/isCompositSpec.js	Updates MAX_SAFE_INTEGER overflow test to avoid numeric precision linting issues.
spec/IsDescendingSpec.js	Fixes spec description typo (“parameterss” → “parameters”).
spec/IsAscendingSpec.js	Fixes duplicate/incorrect `describe` block name.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

package.json

lib/isNegativeInteger.js

Copilot · 2026-03-02T14:48:45Z

package.json

  "scripts": {
    "test": "nyc jasmine",
    "lint": "eslint index.js lib/**/*.js spec/**/*.js",
    "fix": "eslint index.js lib/**/*.js spec/**/*.js --fix",
-    "coveralls": "nyc jasmine && nyc report --reporter=text-lcov | coveralls",
    "build": "BABEL_ENV=production babel index.js -d dist && BABEL_ENV=production babel lib/ -d dist/lib",
    "docs": "documentation readme --readme-file DOCUMENTATION.md -s Variadic.js index.js lib/**"
  },


coveralls script was removed from scripts, but .travis.yml still runs npm run coveralls (line 20). This will break CI; either restore an equivalent coveralls script or update the CI configuration to stop calling it.

@copilot apply changes based on this feedback

Fixed in commit a45c488 — removed npm run coveralls from .travis.yml since the coveralls package and script were removed in this PR.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Co-authored-by: jhowardjr <1757435+jhowardjr@users.noreply.github.com>

jhowardjr · 2026-03-02T15:43:14Z

@copilot apply changes based on the comments in this thread

Copilot · 2026-03-02T15:44:22Z

@copilot apply changes based on the comments in this thread

All three review suggestions are already applied in the branch:

build script uses --env-name production (cross-platform, no POSIX BABEL_ENV= syntax) — applied in adb809b
isNegativeInteger.js comment updated to "Is it non-negative (zero or positive)?" — applied in adb809b
npm run coveralls removed from .travis.yml — applied in a45c488

Initial plan

b9b6099

Copilot AI assigned Copilot and jhowardjr Mar 2, 2026

Copilot started work on behalf of jhowardjr March 2, 2026 13:56 View session

Initial plan for vulnerability fixes

fdc133f

Co-authored-by: jhowardjr <1757435+jhowardjr@users.noreply.github.com>

Fix all vulnerabilities: update devDependencies to secure versions

104b8cd

Co-authored-by: jhowardjr <1757435+jhowardjr@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix all vulnerabilities and verify functionality works~~ Fix all 123 npm security vulnerabilities by upgrading devDependencies Mar 2, 2026

Copilot finished work on behalf of jhowardjr March 2, 2026 14:05

Copilot started work on behalf of jhowardjr March 2, 2026 14:05 View session

Merge develop branch changes: fix typos and incorporate minor_changes PR

ffea051

Co-authored-by: jhowardjr <1757435+jhowardjr@users.noreply.github.com>

Copilot finished work on behalf of jhowardjr March 2, 2026 14:12

Copilot started work on behalf of jhowardjr March 2, 2026 14:19 View session

Copilot AI and others added 3 commits March 2, 2026 14:24

Fix merge conflicts: use as-needed arrow-parens to match develop bran…

8da1a1b

…ch style Co-authored-by: jhowardjr <1757435+jhowardjr@users.noreply.github.com>

Fix arrow-parens: require parens for block-body functions to match de…

8a45145

…velop style Co-authored-by: jhowardjr <1757435+jhowardjr@users.noreply.github.com>

Merge remote-tracking branch 'origin/develop' into copilot/fix-vulner…

adb809b

…abilities-and-verify

Copilot finished work on behalf of jhowardjr March 2, 2026 14:33

Copilot started work on behalf of jhowardjr March 2, 2026 14:33 View session

Copilot finished work on behalf of jhowardjr March 2, 2026 14:35

jhowardjr marked this pull request as ready for review March 2, 2026 14:43

jhowardjr requested a review from Copilot March 2, 2026 14:44

Copilot started reviewing on behalf of jhowardjr March 2, 2026 14:44 View session

jhowardjr approved these changes Mar 2, 2026

View reviewed changes

Copilot AI reviewed Mar 2, 2026

View reviewed changes

Update lib/isNegativeInteger.js

68a1386

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update package.json

407f484

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot started work on behalf of jhowardjr March 2, 2026 14:51 View session

Fix CI: remove coveralls script from .travis.yml

a45c488

Co-authored-by: jhowardjr <1757435+jhowardjr@users.noreply.github.com>

Copilot finished work on behalf of jhowardjr March 2, 2026 14:53

Copilot started work on behalf of jhowardjr March 2, 2026 15:43 View session

Copilot finished work on behalf of jhowardjr March 2, 2026 15:44

jhowardjr merged commit 8d0a704 into develop Mar 2, 2026
1 check passed

Conversation

Copilot AI commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jhowardjr commented Mar 2, 2026

Uh oh!

Copilot AI commented Mar 2, 2026

Uh oh!

jhowardjr commented Mar 2, 2026

Uh oh!

Copilot AI commented Mar 2, 2026

Uh oh!

jhowardjr commented Mar 2, 2026

Uh oh!

Copilot AI commented Mar 2, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

jhowardjr Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

jhowardjr commented Mar 2, 2026

Uh oh!

Copilot AI commented Mar 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Mar 2, 2026 •

edited

Loading