🚨 [security] Update ava 6.3.0 → 8.0.1 (major)#325
Conversation
|
Skipping PR review because a bot author is detected. If you want to trigger CodeAnt AI, comment |
Vulnerable Libraries (1)
More info on how to fix Vulnerable Libraries in JavaScript. 👉 Go to the dashboard for detailed results. 📥 Happy? Share your feedback with us. |
![llamapreview[bot]](https://avatars.githubusercontent.com/in/1023541?s=60&v=4){kind=small}
There was a problem hiding this comment.
AI Code Review by LlamaPReview
🎯 TL;DR & Recommendation
Recommendation: Request Changes.
This security update fixes known vulnerabilities but introduces a critical breaking change: ava 8.x removed the t.plan() API, causing multiple test files to fail. CI is already broken, blocking merge until tests are migrated.
🌟 Strengths
- Addresses security advisories for
debugandtar.
🚨 Critical Issues (P0)
- package.json: The ava 8.0.1 upgrade removes
t.plan(), causing test suite failures; CI pipelines will remain blocked until allt.plan()calls are removed or replaced.
📈 Risk Diagram
This diagram illustrates the breaking change introduced by ava 8.0.1 and its impact on CI.
sequenceDiagram
participant TR as Test Runner (ava 8.0.1)
participant TF as Test File (*.test.js)
participant CI as CI Pipeline
TR->>TF: Execute test
TF->>TR: Call t.plan(2)
note over TR: R1(P0): t.plan removed, <br/>assertion count mismatch
TR-->>CI: Test failure (exit code 1)
note over CI: CI pipeline blocked
💡 Have feedback? We'd love to hear it in our GitHub Discussions.
✨ This review was generated by LlamaPReview Advanced, which is free for all open-source projects. Learn more.
| ], | ||
| "devDependencies": { | ||
| "ava": "^6.3.0", | ||
| "ava": "^8.0.1", | ||
| "c8": "^10.1.3" | ||
| } |
There was a problem hiding this comment.
P0 | Confidence: High
The version upgrade from ava 6.x to 8.x introduces a major breaking change in ava 7.0.0: the removal of the t.plan() API. The related context reveals that multiple test files (test/ap.test.js, test/of.test.js, test/map.test.js, test/scan.test.js, test/chain.test.js) rely on t.plan() to define the expected number of assertions. The CI test suite is already failing (check run tests and Codecov marked as failure), confirming the incompatibility. Until these test files are refactored to remove or replace t.plan() calls, the entire test pipeline will remain broken, blocking CI and preventing safe merging of this security update.
🚨 Your current dependencies have known security vulnerabilities 🚨
This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!
Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.
What changed?
✳️ ava (6.3.0 → 8.0.1) · Repo
Release Notes
8.0.1
8.0.0
7.0.0
6.4.1
6.4.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
2.0.3
2.0.2
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
5.3.0 (from changelog)
5.2.0 (from changelog)
Does any of this look wrong? Please let us know.
Sorry, we couldn't find anything useful about this release.
Release Notes
Too many releases to show here. View the full release notes.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Sorry, we couldn't find anything useful about this release.
Release Notes
6.2.2
6.2.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
6.2.3
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
5.6.2
5.6.0
5.5.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
4.4.0
4.3.1
4.3.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
6.0.0
5.2.0
5.1.1
5.1.0
5.0.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Security Advisories 🚨
🚨 debug@4.4.2 contains malware after npm account takeover
Release Notes
4.4.3
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
2.0.0
1.2.1
1.2.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
1.20.1
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
16.2.0
16.1.1
16.1.0
16.0.0
15.0.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
4.2.0
4.1.0
4.0.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
5.1.0
5.0.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
6.0.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
11.0.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
7.0.4
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
6.0.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
9.3.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
9.0.0
8.0.0
7.1.2
7.1.0
7.0.0
6.0.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
7.2.0
7.1.2
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Security Advisories 🚨
🚨 node-tar Symlink Path Traversal via Drive-Relative Linkpath
🚨 tar has Hardlink Path Traversal via Drive-Relative Linkpath
🚨 Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction
🚨 node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal
🚨 Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS
🚨 node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
🚨 node-tar has a race condition leading to uninitialized memory exposure
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
7.0.1
7.0.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
🆕 @cto.af/wtf8 (added, 0.0.5)
🆕 cbor2 (added, 2.3.0)
🆕 is-path-inside (added, 4.0.0)
🆕 string-width (added, 8.2.1)
🆕 balanced-match (added, 4.0.4)
🆕 brace-expansion (added, 5.0.6)
🆕 cliui (added, 9.0.1)
🆕 wrap-ansi (added, 9.0.2)
🆕 glob (added, 13.0.6)
🆕 lru-cache (added, 11.5.0)
🆕 picomatch (added, 2.3.2)
🆕 picomatch (added, 4.0.4)
🆕 minimatch (added, 10.2.5)
🆕 path-scurry (added, 2.0.2)
🆕 yargs (added, 18.0.0)
🆕 yargs-parser (added, 22.0.0)
🗑️ cbor (removed)
🗑️ imurmurhash (removed)
🗑️ mkdirp (removed)
🗑️ nofilter (removed)
🗑️ path-type (removed)
🗑️ picomatch (removed)
🗑️ picomatch (removed)
Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with
@depfu rebase.All Depfu comment commands