🚨 [security] Update ava 6.3.0 → 8.0.0 (major)#324
Conversation
|
Skipping PR review because a bot author is detected. If you want to trigger CodeAnt AI, comment |
![llamapreview[bot]](https://avatars.githubusercontent.com/in/1023541?s=60&v=4){kind=small}
There was a problem hiding this comment.
AI Code Review by LlamaPReview
🎯 TL;DR & Recommendation
Recommendation: Approve with suggestions
This PR bumps ava from 6.3.0 to 8.0.0 to address security vulnerabilities, but the major version jump introduces breaking changes causing CI test failures. The test suite must be migrated to match ava 8's API before merging.
🌟 Strengths
- Updates resolve known security vulnerabilities in dependencies.
💡 Suggestions (P2)
- package.json: The ava major version upgrade from 6 to 8 introduces breaking changes; CI test failures confirm the test suite needs migration to align with ava 8's API (e.g., updated imports, assertions).
💡 Have feedback? We'd love to hear it in our GitHub Discussions.
✨ This review was generated by LlamaPReview Advanced, which is free for all open-source projects. Learn more.
| "devDependencies": { | ||
| "ava": "^6.3.0", | ||
| "ava": "^8.0.0", |
There was a problem hiding this comment.
P2 | Confidence: High
The PR updates ava from 6.3.0 to 8.0.0, skipping two major releases. This is a significant API-breaking change. The CI results confirm a test failure (tests check run → conclusion: failure; also codecov and workflow failures). The project’s test suite (e.g., test/helpers/ava-patched.js, test/ap.test.js, test/of.test.js, test/cps.test.js) uses ava’s test function and assertions. The major version jump likely introduces incompatible changes (e.g., removed APIs, changed assertion behavior, new module system requirements) that cause the test suite to break. Without corresponding test code migration, merging this PR will result in an immediate build and test failure. The PR must be accompanied by necessary updates to the test files to align with ava 7 and 8 APIs.
🚨 Your current dependencies have known security vulnerabilities 🚨
This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!
Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.
What changed?
✳️ ava (6.3.0 → 8.0.0) · Repo
Release Notes
8.0.0
7.0.0
6.4.1
6.4.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
2.0.3
2.0.2
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
5.3.0 (from changelog)
5.2.0 (from changelog)
Does any of this look wrong? Please let us know.
Sorry, we couldn't find anything useful about this release.
Release Notes
Too many releases to show here. View the full release notes.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Sorry, we couldn't find anything useful about this release.
Release Notes
6.2.2
6.2.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
6.2.3
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
10.0.12
10.0.11
10.0.10
10.0.9
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
5.6.2
5.6.0
5.5.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
4.4.0
4.3.1
4.3.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
6.0.0
5.2.0
5.1.1
5.1.0
5.0.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Security Advisories 🚨
🚨 debug@4.4.2 contains malware after npm account takeover
Release Notes
4.4.3
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
2.0.0
1.2.1
1.2.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
1.20.1
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
16.2.0
16.1.1
16.1.0
16.0.0
15.0.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
4.2.0
4.1.0
4.0.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
5.1.0
5.0.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
6.0.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
11.0.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
7.0.4
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
6.0.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
9.3.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
9.0.0
8.0.0
7.1.2
7.1.0
7.0.0
6.0.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
7.2.0
7.1.2
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Security Advisories 🚨
🚨 node-tar Symlink Path Traversal via Drive-Relative Linkpath
🚨 tar has Hardlink Path Traversal via Drive-Relative Linkpath
🚨 Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction
🚨 node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal
🚨 Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS
🚨 node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
🚨 node-tar has a race condition leading to uninitialized memory exposure
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
7.0.1
7.0.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
🆕 is-path-inside (added, 4.0.0)
🆕 string-width (added, 8.2.1)
🆕 balanced-match (added, 4.0.4)
🆕 brace-expansion (added, 5.0.5)
🆕 cliui (added, 9.0.1)
🆕 wrap-ansi (added, 9.0.2)
🆕 glob (added, 13.0.6)
🆕 lru-cache (added, 11.3.6)
🆕 picomatch (added, 2.3.2)
🆕 picomatch (added, 4.0.4)
🆕 minimatch (added, 10.2.5)
🆕 path-scurry (added, 2.0.2)
🆕 yargs (added, 18.0.0)
🆕 yargs-parser (added, 22.0.0)
🗑️ imurmurhash (removed)
🗑️ mkdirp (removed)
🗑️ path-type (removed)
🗑️ picomatch (removed)
🗑️ picomatch (removed)
Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with
@depfu rebase.All Depfu comment commands