fix: update dependencies to address security issue in @babel/runtime < 7.26.10 #375

jdalrymple · 2025-09-30T18:13:17Z

What:

Modernized project dependencies and resolved deprecated packages, peer dependency warnings, and security vulnerabilities.

Why:

The codecov package was deprecated with a migration plan in place
Multiple peer dependency warnings were causing noise during installation
Security audit identified 2 low-severity vulnerabilities in transitive dependencies
node-fetch dependency was unnecessary given Node.js 22's native fetch support
ES module compatibility issues were causing test failures after package updates

How:

Dependency Updates:

Removed deprecated codecov package and updated CircleCI config to use official codecov orb
Removed unnecessary node-fetch dependency, now using Node.js 22's native fetch
Removed typescript dev dependency (not needed for pure JS project)
Added pnpm override for tmp@>=0.2.4 to resolve security vulnerability

Configuration Changes:

Updated Jest config to support ES modules with --experimental-vm-modules flag
Added transformIgnorePatterns for prettier compatibility
Modified test script to use NODE_OPTIONS environment variable

Code Updates:

Fixed inquirer v12 compatibility by using require('inquirer').default
Fixed lint errors (curly braces, logical assignment warnings)
Updated test snapshots to reflect prettier formatting changes
Fixed conditional logic in test files to avoid ESLint warnings

Infrastructure Updates:

Updated CircleCI to use Node.js 22.14 (from 16.17.0) to match engine requirements
Migrated CI from yarn to pnpm to match project package manager
Added pnpm installation step to CircleCI workflow
Removed obsolete .yvmrc file (Yarn version specification no longer needed)

Checklist:

Documentation
Tests
Ready to be merged
Added myself to contributors table

jdalrymple · 2025-10-26T17:00:25Z

I know this was a huge overhaul, but would love to get the cli tool up to date 🙏

jdalrymple · 2026-01-18T20:16:05Z

Bump 🙏

lwasser · 2026-01-23T02:13:24Z

.circleci/config.yml

    steps:
      - prep_env
-      - run: yarn install
+      - run: pnpm install


cool - i didn't know about pnpm!!

we moved from yarn --> npm for the documentation i wonder if we should use this over in that repo too?

Although I personally love pnpm and use it in all my projects (template: create-typescript-app), switching this CLI from a previous package manager to pnpm is a big change. If we want to do that (+1 from me) it should be in a separate PR than a smaller "update dependencies" one.

Makes sense!

lwasser · 2026-01-23T02:17:05Z

@all-contributors please add @jdalrymple for security, bug

allcontributors · 2026-01-23T02:17:15Z

@lwasser

I've put up a pull request to add @jdalrymple! 🎉

lwasser · 2026-01-23T02:24:12Z

hey @jdalrymple thank you for this - this is a BIG PR!!

We have been working on reviving this project and I do have merge permissions but i'm trying to use them carefully as we all get up to speed on this project. Do you have the capacity to split this out into small pieces?

I am doing updates such as dependabot etc as well. if you are willing to work with us, implementing this in several smaller pr's would be greatly appreciated!

lwasser · 2026-01-23T02:25:23Z

.circleci/config.yml

@@ -1,15 +1,23 @@
 version: 2.1

+orbs:


i don't think i have access to circle ci so let me dig into that first. if this could be it's own pr we can merge it quickly as is

lwasser · 2026-01-23T02:26:44Z

maybe one pr for circle ci
one pr for linting
one pr for deps.

i am still trying to figure out how deployment is setup here. And where tests run.

lemme know how that sounds. I appreciate your help!!

JoshuaKGoldberg

🙌 I appreciate the initiative! There are quite a few unrelated changes in this PR ranging from stylistic tweaks in other files to a full swap of the package manager. +1 to lwasser's suggestion to have one PR per thing. That makes things much more reviewable. And if one item is blocked, that doesn't block the other items. Thanks!

JoshuaKGoldberg · 2026-01-23T15:42:32Z

.circleci/config.yml

    steps:
      - prep_env
-      - run: yarn install
+      - run: pnpm install


Although I personally love pnpm and use it in all my projects (template: create-typescript-app), switching this CLI from a previous package manager to pnpm is a big change. If we want to do that (+1 from me) it should be in a separate PR than a smaller "update dependencies" one.

JoshuaKGoldberg · 2026-01-23T15:43:26Z

src/repo/github.js

@@ -1,5 +1,4 @@
 const url = require('url')
-const fetch = require('node-fetch')


Moving from node-fetch to the global fetch is also a bigger change than just bumping @babel/runtime. node-fetch isn't quite a drop-in replacement for fetch. fetch is more spec/standards-compliant.

JoshuaKGoldberg · 2026-01-23T15:43:47Z

src/util/git.js

-    if (commitConvention.lowercase)
+    if (commitConvention.lowercase) {
      commitMessage = commitConvention.transform(commitMessage)
+    }


[Style] Unrelated change - this isn't a problem on its own, but with all the other unrelated changes makes this PR harder to review.

jdalrymple · 2026-01-23T18:00:07Z

Hey folks - I know this is a gigantor PR haha, i think in the process of updating the dep, I got ahead of myself cleaning up things i saw along the way.

I can split it into multiple PRs for sure. Ill start with the CI updates and pick the next piece after that. Ill keep this PR open for now just to keep a reference of the direction we were trying to go in.

Thanks for following up on everything 🙏 !!

lwasser · 2026-01-23T20:38:51Z

Thank you so much for breaking it up. We really appreciate it. It is taking us some time to get up to speed as this is a large project and we are still gaining access to accounts! Happy to review pr's as they come in. I did merge one dependabot update so you may need to rebase. We can expect ci to fail for now - i'm going to migrate us over to github actions soon.

…

Message ID: ***@***.***>

jdalrymple · 2026-01-24T18:59:19Z

src/init/__tests__/add-contributors-list.js

      expect(data).toStrictEqual(file)
      return unlink(file, err => {
-        if (err) throw err
+        expect(err).toBeNull()


Applied this here: #396

marcelpanse and others added 9 commits April 30, 2025 20:13

updated packages

7685c19

add dist

ad6e6be

remove dist

20f6f57

upgraded inquirer package

00fcdd9

Updating node lts

e199d57

Another dep update

d14ab08

Overhaul

6f89a2b

Clean up

c039b3d

pnpm through corepack

5a4237d

jdalrymple mentioned this pull request Sep 30, 2025

fix: update dependencies to address security issue in @babel/runtime < 7.26.10 #372

Closed

Use orb

8df7603

Updating minor deps

9a16463

lwasser reviewed Jan 23, 2026

View reviewed changes

allcontributors bot mentioned this pull request Jan 23, 2026

docs: add jdalrymple as a contributor for security, and bug #381

Merged

Merge branch 'main' into master

2043cac

lwasser reviewed Jan 23, 2026

View reviewed changes

lwasser mentioned this pull request Jan 23, 2026

CircleCI build broken: can't clone // permissions #385

Open

JoshuaKGoldberg requested changes Jan 23, 2026

View reviewed changes

This was referenced Jan 23, 2026

chore(ci): Update Codecov pipeline to use circle CI orb #386

Merged

Updating yargs from ^15.0.1" to "^18.0.0" #387

Closed

jdalrymple marked this pull request as draft January 23, 2026 18:21

jdalrymple mentioned this pull request Jan 23, 2026

chore(ci): fixing semantic release node requirement #388

Merged

4 tasks

jdalrymple mentioned this pull request Jan 24, 2026

test(add-contributors-list): Improve the clarity of the add-contributors-list tests #396

Merged

4 tasks

jdalrymple commented Jan 24, 2026

View reviewed changes

jdalrymple mentioned this pull request Jan 26, 2026

refactor: Update calls to prettier functions to account for latest async API #403

Merged

4 tasks

		@@ -1,5 +1,4 @@
		const url = require('url')
		const fetch = require('node-fetch')

fix: update dependencies to address security issue in @babel/runtime < 7.26.10 #375

Are you sure you want to change the base?

fix: update dependencies to address security issue in @babel/runtime < 7.26.10 #375

Conversation

jdalrymple commented Sep 30, 2025 • edited by lwasser Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What:

Why:

How:

Uh oh!

jdalrymple commented Oct 26, 2025

Uh oh!

jdalrymple commented Jan 18, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lwasser commented Jan 23, 2026

Uh oh!

allcontributors bot commented Jan 23, 2026

Uh oh!

lwasser commented Jan 23, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lwasser commented Jan 23, 2026

Uh oh!

JoshuaKGoldberg left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jdalrymple commented Jan 23, 2026

Uh oh!

lwasser commented Jan 23, 2026 via email

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

jdalrymple commented Sep 30, 2025 •

edited by lwasser

Loading

JoshuaKGoldberg left a comment •

edited

Loading