Pin yarn resolutions to close 67 of 75 Critical/High Dependabot alerts

[JerryS22]

GitHub Issue	Closes https://github.com/TodayTix/ttg/issues/15195. Parent epic: https://github.com/TodayTix/ttg/issues/15135.
Problem	tt-react-calendar is a top-10 hotspot in TodayTix's GitHub Security Overview, with 22 Critical and 53 High open Dependabot alerts. Reducing this to 0 is required to hit the Mythos GA pre-launch security bar. The 75 alerts span 33 packages, almost entirely transitives in the webpack 2 / babel 6 build toolchain (yarn.lock-only, dev-scope), with one runtime dep (moment) carrying 3 Highs. Separately: circle.yml commits a Coveralls repo token in plain text — discovered during this investigation.
Impact	Until these close, tt-react-calendar materially inflates the org's public Critical+High count and remains an obvious target for any agentic security tool sweeping public TodayTix repos. The library ships pre-built dist/ to consumers, so transitive vulnerabilities here don't reach downstream apps — but the open alerts still count against the org-wide tally that #15135 is racing to zero.
Outcome	Repo's Dependabot dashboard goes from 22 C + 53 H → 2 C + 6 H (closes 67 of 75). The 8 residual alerts are toolchain-blocked and documented as "Known exceptions" — they need either a separate webpack 2 → 5 / babel 6 → 7 modernization ticket or dismissal-with-justification. Note for legacy UMD consumers (including platform): dist/index.js bytes change due to lodash 4.17.4 → 4.18.1 internals; API-compatible bug fixes only, no behavior change. dist-modules/ (modern bundlers) is byte-identical. The dead Coveralls integration (and the leaked token committed alongside it) is removed.

Approach

Three commits, three concerns:

1. Pin yarn resolutions to close 67 of 75 Critical/High Dependabot alerts — mirrors the inventory_fe pattern from sibling https://github.com/TodayTix/ttg/issues/15156. One sweep through package.json#resolutions pinning every reachable fix version + yarn install to regenerate the lockfile. No source code changes.
2. Remove deprecated CircleCI 1.0 config containing a leaked Coveralls token — circle.yml is from 2017, pins Node 6.9.4, references a CircleCI YAML schema deprecated in 2018. The repo has no .circleci/config.yml or .github/workflows/, so this file cannot have been running CI. Deleting it removes both the dead infra and the leaked credential.
3. Remove dead Coveralls integration — investigation confirmed the Coveralls integration has been dead for years (coveralls.io/github/TodayTix/tt-react-calendar returns 404; no Actions secret, no workflow). Removed the dead coveralls / nyc / babel-plugin-istanbul / tap-xunit devDeps, dead scripts, the nyc config block, the test:coverage env in .babelrc (referenced the istanbul plugin), and the broken README badges.

The full set of fix versions in commit 1 was bisected against yarn test and yarn dist:all to identify resolutions the legacy webpack 2 / babel 6 toolchain cannot accept. Three Critical and four High alerts fall in that bucket and are documented as known exceptions rather than silently left open.

Resolutions added

Closes 20 of 22 Critical and 47 of 53 High alerts (67 of 75 total). The remaining 2 Critical and 6 High are toolchain-blocked and documented in "Known exceptions" below u2014 they require a separate webpack 2 u2192 5 / babel 6 u2192 7 modernization ticket, or dismissal-with-justification. Bumped runtime moment constraint from >= 2.10.7 < 3 to >= 2.29.4 < 3 to close 3 runtime Highs (CVE-2017-18214, CVE-2022-31129, CVE-2022-24785).

Package	Pin	Severity	Scope
handlebars	^4.7.9	C×4 + H×7	dev
pbkdf2	^3.1.3	C	dev
url-parse	^1.5.10	C×2	runtime+dev
sha.js	^2.4.12	C	dev
cipher-base	^1.0.5	C	dev
form-data	^2.5.4	C	dev
elliptic	^6.6.1	C + H	dev
fsevents	^1.2.13	C	dev
minimist	^1.2.6	C×2	runtime+dev
json-schema	^0.4.0	C	dev
thenify	^3.3.1	C	dev
eventsource	^1.1.1	C	dev
lodash	^4.17.21	C + H×3	dev
deep-extend	^0.5.1	C	dev
macaddress	^0.2.9	C	dev
node-forge	^1.4.0	H×6	dev
node-fetch	^2.6.7	H	runtime
async	^2.6.4	H	dev
tar	^7.5.11	H×8	dev
minimatch	^3.1.3	H	dev
braces	^3.0.3	H	dev
webpack-dev-middleware	^5.3.4	H	dev
browserify-sign	^4.2.2	H	dev
qs	^6.4.1	H	dev
shelljs	^0.8.5	H	dev
dns-packet	^1.3.2	H	dev
dot-prop	^4.2.1	H	dev
querystringify	^2.0.0	H	runtime
js-yaml	^3.13.1	H	dev
lodash.merge	^4.6.2	H×2	dev
http-proxy	^1.18.1	H	dev
hoek	^4.2.1	H (1 of 2)	dev

Plus runtime moment direct bump: >= 2.10.7 < 3 → >= 2.29.4 < 3 (closes 3 Highs).

Known exceptions (will be dismissed-with-justification post-merge)

These fixes require the next major-version bump of webpack/babel — out of scope for a security PR; will be picked up if/when this library moves off webpack 2.

Alert	Package	Why blocked
C #109	loader-utils 1.4.1	API change; babel-loader@6 calls parseQuery() with a non-?-prefixed string — fails build
C #153	babel-traverse	Advisory has fixed_in: null; root patch is in babel 7 (this lib uses babel 6)
H #115	json5 1.0.2	babel-core@6 writes its babel-options cache via the older json5 dialect; 1.0.2 emits a syntax error
H #19	webpack-dev-server 3.1.11	Resolution is overridden by devDependencies: webpack-dev-server: ^2.5.0; webpack-dev-server 3 needs webpack 4+
H #156	ip	Advisory fixed_in: null — no patched version published
H #155	lodash.template	Advisory fixed_in: null for one entry; the second (#235) closes via the lodash bump
H #145	lodash.pick	Advisory fixed_in: null
H #146	hoek (runtime)	One of 2 hoek entries has fixed_in: null; the other (#6) closes via the hoek 4.2.1 pin

Coveralls token — investigation summary

The leaked token (hNalmUHJN5pol8yfYF5plY5wFcFNL0DNw, removed at HEAD~1) is harmless without an active target:

Check	Result
https://coveralls.io/github/TodayTix/tt-react-calendar	404 — no Coveralls project exists
COVERALLS_REPO_TOKEN GitHub Actions secret in any TTG repo	None
Modern coverallsapp/github-action workflow anywhere in org	Zero
Live coveralls references org-wide	Only dead config + 1 dead coveralls-next devDep in web-monorepo (no workflow invokes it)

No upstream rotation step required — there's no Coveralls account/project to rotate against. The token still lives in git history but cannot be used to publish coverage anywhere.

Decisions

• Single sweep over batched PRs. All alerts share one lockfile and one resolutions block; splitting into per-package PRs would multiply review surface for zero functional benefit. Mirrors the inventory_fe approach (sibling https://github.com/TodayTix/ttg/issues/15156).
• lodash resolution at ^4.17.21 (yarn currently resolves this to lodash 4.18.1). During the bisect, lodash@4.18.0 shipped a buggy babel-options cache (extra comma in babelrc: false,,) that crashed ava@0.19. lodash patched it in 4.18.1, which is what yarn picks today and what the test suite verifies green against. The 4.17.21 floor closes all in-scope Critical/High alerts (CVE-2019-10744, CVE-2018-16487, CVE-2020-8203, CVE-2021-23337); the caret is intentional so future 4.x patches flow without manual edits.
• tar bumped to 7.x even though it's a major. Verified via yarn test / yarn dist:all — no caller in this lib invokes tar programmatically; it's pulled in by node-pre-gyp/fsevents toolchain transitives only.
• No top-level devDep bumps in the security commit. Only package.json#resolutions and the runtime moment constraint moved. webpack 2 / babel 6 / ava 0.19 stay on their current majors — that's the toolchain modernization conversation, separate from security.
• Delete circle.yml rather than just removing the token line. Leaving the file with a missing/empty COVERALLS_REPO_TOKEN would leave broken-but-credential-bearing dead config. CircleCI 1.0 was deprecated in 2018; the repo has no other CI config files.
• Full Coveralls cleanup, not just the token line. The whole integration is dead (404 dashboard, no Actions secret, no workflow). Leaving the devDeps, scripts, .babelrc env, and README badges in place would be confusing breadcrumbs to a working integration that doesn't exist.

Verified

Check	Result
yarn install (clean, Node 18.20.8)	✅
yarn run test	✅ 21/21 pass
yarn run lint	✅
yarn run dist:all	✅ webpack 2 build, output 70.2 kB
A. dist-modules/ byte-diff vs master	✅ identical (per-file babel output that modern bundlers consume via module field)
A2. dist/styles.css byte-diff vs master	✅ identical
A3. dist/index.js byte-diff vs master	⚠️ NOT identical — webpack module IDs reshuffle and lodash internals upgrade 4.17.4 → 4.18.1. Diff is API-compatible bug fixes only (no behavior change to the calendar's public API); Verification B exercises this. Affects legacy UMD consumers (script tag / main field — including platform's asset pipeline).
B. yarn pack + scratch consumer renders <Calendar />	✅ React 15 + moment 2.29.4 consumer surface intact (re-run after the Coveralls cleanup)
C. Org-wide consumer scan	Only 1 consumer: TodayTix/platform pins tt-react-calendar: 1.5.8 and already has resolutions on tt-react-calendar/moment and tt-react-calendar/react/fbjs/isomorphic-fetch/node-fetch (pre-existing workaround that this PR makes redundant; platform-side cleanup is platform's call).
D. yarn audit before/after	master: 5H / PR: 0H (yarn audit uses npm advisory DB; Dependabot post-merge is the source of truth)

Out of scope (separate work)

• Modernize webpack 2 → 5 / babel 6 → 7 / ava 0.19 → latest. Would unblock the 4 toolchain-pinned alerts above. Noisy upgrade; deserves its own ticket.
• Version skew between this repo's package.json (1.5.6) and the npm-published version platform pins (1.5.8). Suggests a manual publish workflow that drifted from the source. Not blocking, but worth tidying.

Version bump

This PR does not bump package.json#version. Whoever publishes after merge should bump and tag (master is at 1.5.6, npm latest is 1.5.8 — pick the next minor or patch).

Reviewer FAQ — questions raised during prep

Q: How was this verified beyond yarn test?
4-axis verification, all green: (A) dist-modules/ byte-diff vs master ✅ identical (modern bundler artifact unchanged); (B) yarn pack + scratch consumer renders <Calendar /> against the new tarball with React 15 + moment 2.29.4 ✅; (C) only known consumer is TodayTix/platform (vendors prebuilt UMD bundle, has its own pre-existing resolutions on tt-react-calendar/moment and tt-react-calendar/react/.../node-fetch); (D) yarn audit master 5H → PR 0H. See "Verified" table above.

Q: Does this hit 0 Critical / 0 High like ticket #15195's AC says?
No — closes 67 of 75 alerts (22C+53H → 2C+6H). The 8 residual are documented as "Known exceptions" — toolchain-blocked (loader-utils, babel-traverse, json5, webpack-dev-server) or have no published fix (ip, lodash.template, lodash.pick, hoek runtime). Closing the last 8 requires either webpack 2 → 5 / babel 6 → 7 modernization (noisy, separate ticket) or dismissal-with-justification post-merge.

Q: Are we sure this doesn't affect users at all?
Modern bundler users (module field): zero change — dist-modules/ is byte-identical. Legacy UMD users (main field, including platform's asset pipeline): dist/index.js bytes change because lodash internals upgrade 4.17.4 → 4.18.1. The diff is API-compatible bug fixes only — Verification B exercised this path against React 15 and the calendar rendered correctly. Risk is low but non-zero, hence the disclosure in the Outcome line.

Q: Will merging this PR affect any user today?
No. Merging only updates this repo's master. User impact requires a 5-step manual chain: merge → bump package.json#version → npm publish → consumer bumps → consumer deploys. None of steps 2-5 are automated. Last published version (1.5.8) shipped September 2017; nothing has been published in 9 years. Possible this PR's bytes never reach a single user.

Q: Does platform need an update to avoid vulnerability from this?
No. Platform has 0 npm-side Critical/High Dependabot alerts — all 51 of its open alerts live in settings.gradle (Java/Gradle). Platform consumes the prebuilt dist/index.js from npm 1.5.8 (2017), which contains lodash 4.17.4 internals — none of the dev-only transitives this PR closes ever made it into the runtime artifact platform ships. Platform additionally has pre-existing resolutions on tt-react-calendar/moment and tt-react-calendar/react/.../node-fetch that already pin the only runtime-relevant deps. The user-visible risk picture for platform is unchanged whether this PR merges or not.

Q: Do we need to set up CircleCI 2.0 so this can be tested in CI?
No — but the repo currently has zero automated yarn test / yarn lint / yarn dist:all signal. The legacy circle.yml (CircleCI 1.0, deprecated 2018) was almost certainly not running. Right fix is a small GitHub Actions workflow; out of scope for this PR, filed as a follow-up ticket on TodayTix/ttg.

Q: What's the value of this PR if it doesn't reach users?
Drives the GitHub Security Overview count for tt-react-calendar from 75 → 8 (with 8 documentable exceptions), contributing to parent epic https://github.com/TodayTix/ttg/issues/15135's org-wide attack-surface reduction ahead of Mythos GA. The value is shrinking the public-org Critical/High tally agentic security tools can enumerate, not removing runtime vulnerabilities from production code (they were never in the runtime artifact).

---

🤖 This was posted by Claude

Workflow progress

• Ticket loaded, readiness gate passed
• Failing tests written (TDD red)
• Implementation complete (TDD green)
• Draft PR raised
• AI bot comments addressed (Step 7)
• Zero-outstanding-comments gate passed (Step 7a)
• Marked ready for review
• Reviewers requested

[gemini-code-assist]

Code Review

This pull request updates the moment dependency and introduces a comprehensive resolutions block in package.json to manage transitive dependency versions, which is reflected in significant updates to yarn.lock. Feedback was provided regarding the lodash resolution; although the intent was to avoid version 4.18.x, the use of a caret range (^4.17.21) allowed it to resolve to 4.18.1. It is recommended to use an exact version or a tilde range to strictly enforce the desired version.

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!