Repository navigation
refactor: Bump npm from 11.18.0 to 11.21.1 - #438
Conversation
|
🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review. Tip
Note Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect. Caution Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code. |
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Update npm and bundled dependencies package-lock.json |
The lockfile updates npm and selected bundled package versions, adjusts declared dependency ranges, and removes Node 18 from the brace-expansion engine range. |
Priority:
Estimated code review effort: 2 (Simple) | ~10 minutes
Possibly related PRs
- parse-community/Parse-SDK-dotNET#425: Updates other locked
undicicopies in response toundicisecurity issues. - parse-community/Parse-SDK-dotNET#436: Updates
undiciin@actions/http-clientand the top-level dependency; this PR updates npm’s bundled copy.
Merge Risk: 
ac6c9
-
This change updates the npm version bundled in the release tooling lockfile and introduces no runtime behavior change to the shipped SDK. Two bundled packages still have newer fixes available, but the release path does not appear to supply the inputs needed to trigger them, so no merge-blocking risk remains.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title begins with the allowed prefix "refactor:" and uses a capitalized first letter in "Bump." It accurately describes the npm version update in the lockfile. Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Security Check The pull request changes only package-lock.jsonand updates the bundlednpmpackage from 11.18.0 to 11.21.1. The changed bundled versions are upgrades, not newly introduced application code or dow…Engage In Review Feedback No review feedback comments were returned, and the current review produced zero actionable findings. Therefore, there was no feedback for the user to ignore, resolve, implement, or discuss. Full details: Security Check
-
Explanation
The pull request changes only
package-lock.jsonand updates the bundlednpmpackage from 11.18.0 to 11.21.1. The changed bundled versions are upgrades, not newly introduced application code or downgraded dependencies. The lockfile marksnpmand all changed bundled packages as development dependencies. No changed code pattern introduces a security vulnerability.
-
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #438 +/- ##
=======================================
Coverage 46.54% 46.54%
=======================================
Files 106 106
Lines 6196 6196
Branches 950 950
=======================================
Hits 2884 2884
Misses 3004 3004
Partials 308 308 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Updates
npm, a dependency of@semantic-release/npm13.1.5 (range^11.6.2), from 11.18.0 to 11.21.1 inpackage-lock.json. This is a lock-file-only change to release tooling in development scope. npm ships its dependencies bundled inside its tarball, so the vulnerable copies listed below can only change through a newer npm release. 11.21.1 is the newest npm 11.x release.Security
Bundled packages that change, and the Dependabot alerts each one resolves:
ip-addresshttp-cache-semanticsundicibrace-expansiontarNote on
http-cache-semantics: GHSA-ch52-4w7c-c8xp lists the affected range as<= 4.2.0with no patched version, so alert 111 closes only because 4.3.0 is outside that range. 4.3.0 does not change themax-stalehandling that the advisory describes. The maintainer disputes the report (kornelski/http-cache-semantics#56, marked as not planned), and the advisory is under dispute (github/advisory-database#10139).Remaining alerts: npm 11.21.1 still bundles
undici6.29.0 andip-address10.7.2, so these alerts still apply after this change:undici>= 6.23.0, < 6.29.1undici>= 6.5.0, < 6.29.1ip-address<= 10.7.3They need an npm 11.x release that bundles patched copies. npm 12 is outside the
^11.6.2range of@semantic-release/npm.Changes
min-release-age-exclude(fix(pack): honor min-release-age-exclude npm/cli#9811)@npmcli/arborist9.9.1,libnpmdiff8.1.12,libnpmexec10.3.2,libnpmfund7.0.26,libnpmpack9.1.12undici6.28.0,ip-address10.5.0,brace-expansion5.0.9,tar7.5.22,libnpmpack9.1.13provenance-filetakes precedence over OIDC auto-generated provenance (fix: provenance-file takes precedence over OIDC auto-generated provenance npm/cli#9947)allow-scripts(fix(config): avoid exporting persistent allow-scripts npm/cli#9937)allowScriptskeys for local paths (fix(arborist): match allowScripts keys for local paths npm/cli#9929)nodedirin the node integration, workflow template and PR title updates (chore(pack): select workspace through config npm/cli#10010, chore: pass nodedir to node-gyp via npm_package_config env in node integration npm/cli#9932, chore: updatenode-integrationworkflow template to latest actions npm/cli#9931, chore: recognize prefixed Node.js PR titles npm/cli#9925)@npmcli/arborist9.9.2,@npmcli/config10.13.0,libnpmdiff8.1.13,libnpmexec10.3.3,libnpmfund7.0.27,libnpmpack9.1.14,libnpmpublish11.2.1npm stagedocs update (docs: update npm stage docs to reflect that it can create new packages npm/cli#10050)@npmcli/config10.14.0allowScriptskeys underinstall-strategy=linked(fix: write registry allowScripts keys under install-strategy=linked npm/cli#10059)http-cache-semantics4.3.0,undici6.29.0,postcss-selector-parser7.1.6,ip-address10.7.2,brace-expansion5.0.12,@npmcli/arborist9.9.3,libnpmdiff8.1.14,libnpmexec10.3.4,libnpmfund7.0.28,libnpmpack9.1.15The lock diff is limited to
npmand these bundled entries:@npmcli/arborist9.9.0 → 9.9.3,@npmcli/config10.12.0 → 10.14.0,brace-expansion5.0.7 → 5.0.12,http-cache-semantics4.2.0 → 4.3.0,ip-address10.2.0 → 10.7.2,libnpmdiff8.1.11 → 8.1.14,libnpmexec10.3.1 → 10.3.4,libnpmfund7.0.25 → 7.0.28,libnpmpack9.1.11 → 9.1.15,libnpmpublish11.2.0 → 11.2.1,postcss-selector-parser7.1.4 → 7.1.6,tar7.5.19 → 7.5.22,undici6.27.0 → 6.29.0.Impact
npm ls npm --omit=devis empty. The dependency path issemantic-release25.0.3 →@semantic-release/npm13.1.5 →npm.enginesis unchanged (^20.17.0 || >=22.9.0), and the release workflow uses Node 22.brace-expansion5.0.12 narrows itsenginesfrom18 || 20 || >=22to20 || >=22. This has no effect: npm itself already requires^20.17.0 || >=22.9.0, the repository has noengines.node, and the release workflow runs Node 22.release.config.jssets@semantic-release/npmtonpmPublish: false, so the bundled npm CLI runs only asnpm version <version> --userconfig <npmrc> --no-git-tag-version --allow-same-versionin the release prepare step. That call produced byte-identicalpackage.jsonandpackage-lock.jsonwith npm 11.18.0 and 11.21.1 on this repository.lib/commands/version.jsandlibnpmversionare unchanged between the two versions.make-fetch-happen,socks,node-gyp,minimatch,tar), whichnpm versiondoes not use.ciworkflow does not install npm dependencies. The lock is installed byrelease-automated(npm ci) after merge.npm ci --ignore-scriptswith this lock succeeds locally, and the installed bundled versions match the lock.Breaking Changes
None
Code Changes Required
None. The upgrade is a drop-in replacement.
Summary by CodeRabbit