Skip to content

Conversation

@kkartunov
Copy link
Contributor

Up npm modules for security.

@kkartunov kkartunov requested a review from vas3a October 27, 2025 08:36
peerDependencies:
class-transformer: '*'
class-validator: '*'
class-transformer: '>=0.4.1'

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[⚠️ correctness]
The change in the version constraint for class-transformer from * to >=0.4.1 is a good practice for ensuring compatibility. However, ensure that the minimum version specified (0.4.1) is compatible with all other dependencies and does not introduce any breaking changes.

class-transformer: '*'
class-validator: '*'
class-transformer: '>=0.4.1'
class-validator: '>=0.13.2'

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[⚠️ correctness]
The update of the class-validator version constraint from * to >=0.13.2 is a positive change for maintaining compatibility. Verify that the minimum version 0.13.2 is compatible with the rest of the codebase and does not introduce any breaking changes.

'@prisma/client@6.6.0':
resolution: {integrity: sha512-vfp73YT/BHsWWOAuthKQ/1lBgESSqYqAWZEYyTdGXyFAHpmewwWL2Iz6ErIzkj4aHbuc6/cGSsE6ZY+pBO04Cg==}
'@prisma/client@6.18.0':
resolution: {integrity: sha512-jnL2I9gDnPnw4A+4h5SuNn8Gc+1mL1Z79U/3I9eE2gbxJG1oSA+62ByPW4xkeDgwE0fqMzzpAZ7IHxYnLZ4iQA==}
engines: {node: '>=18.18'}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The updated @prisma/client@6.18.0 package now requires Node.js version >=18.18. Ensure that the deployment environment supports this version to avoid runtime issues.


'@types/express-serve-static-core@5.0.6':
resolution: {integrity: sha512-3xhRnjJPkULekpSzgtoNYYcTWgEZkp4myc+Saevii5JPnHNvHMRlBSHDbs7Bh1iPPoVTERHEZXyhyLbMEsExsA==}
'@types/express-serve-static-core@4.19.7':

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The upgrade from @types/express-serve-static-core@4.19.7 to @types/express-serve-static-core@5.1.0 indicates a major version change. Ensure that the codebase is compatible with the breaking changes introduced in version 5.x, as this could impact the correctness of the application.


'@types/graceful-fs@4.1.9':
resolution: {integrity: sha512-olP3sd1qOEe5dXTSaFvQG+02VdRXcdytWLAZsAq1PecU8uqQAhkrnbli7DagjtXKW/Bl7YJbUsa8MPcuc8LHEQ==}
'@types/express@5.0.4':

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The upgrade from @types/express@4.17.24 to @types/express@5.0.4 involves a major version change. Verify that the application code is compatible with any breaking changes introduced in Express 5.x to prevent runtime errors.

'@typescript-eslint/scope-manager@8.30.1':
resolution: {integrity: sha512-+C0B6ChFXZkuaNDl73FJxRYT0G7ufVPOSQkqkpM/U198wUwUFOtgo1k/QzFh1KjpBitaK7R1tgjVz6o9HmsRPg==}
'@typescript-eslint/project-service@8.46.2':
resolution: {integrity: sha512-PULOLZ9iqwI7hXcmL4fVfIsBi6AN9YxRc0frbvmg8f+4hQAjQ5GYNKK0DIArNo+rOKmR/iBYwkpBmnIwin4wBg==}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[⚠️ maintainability]
The addition of @typescript-eslint/project-service@8.46.2 appears to be a new package. Ensure that this addition is intentional and that the package is necessary for your project. Unnecessary dependencies can increase maintenance overhead and potential security risks.

engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}

'@ungap/structured-clone@1.3.0':

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[⚠️ maintainability]
The addition of @ungap/structured-clone@1.3.0 is a new package. Verify that this package is required for your project and that it does not introduce any unnecessary complexity or security vulnerabilities.

'@ungap/structured-clone@1.3.0':
resolution: {integrity: sha512-WmoN8qaIAo7WTYWbAZuG8PYEhn5fkz7dZrqTBZ7dtt//lL2Gwms1IcnQ5yHqjDfX8Ft5j4YzDM23f87zBfDe9g==}

'@unrs/resolver-binding-android-arm-eabi@1.11.1':

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[⚠️ design]
The addition of multiple @unrs/resolver-binding-* packages suggests a significant change in the project's dependency structure. Ensure that these packages are necessary and that their inclusion does not introduce platform-specific issues or increase the complexity of the build process.

engines: {node: ^14.14.0 || >=16.0.0}
'@xhmikosr/archive-type@7.1.0':
resolution: {integrity: sha512-xZEpnGplg1sNPyEgFh0zbHxqlw5dtYg6viplmWSxUj12+QjU9SKu3U/2G73a15pEjLaOqTefNSZ1fOPUOT4Xgg==}
engines: {node: '>=18'}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The change in the engines field from node: ^14.14.0 || >=16.0.0 to node: '>=18' could potentially break compatibility for environments still using Node.js versions below 18. Ensure that all environments where this package is deployed are compatible with Node.js 18 or higher.

engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
babel-jest@30.2.0:
resolution: {integrity: sha512-0YiBEOxWqKkSQWL9nNGGEgndoeL0ZpWrbLMNL5u/Kaxrli3Eaxlt3ZtIDktEvXt4L/R9r3ODr2zKwGM/2BjxVw==}
engines: {node: ^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The updated engines field for babel-jest now requires Node.js versions ^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0. Ensure that the deployment environment supports these Node.js versions to prevent runtime issues.

engines: {node: '>=8'}
babel-plugin-istanbul@7.0.1:
resolution: {integrity: sha512-D8Z6Qm8jCvVXtIRkBnqNHX0zJ37rQcFJ9u8WOS6tkYOsRdHBzypCstaxWiu5ZIlqQtviRYbgnRLSoCEvjqcqbA==}
engines: {node: '>=12'}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[⚠️ correctness]
The engines field for babel-plugin-istanbul now requires Node.js version >=12. Verify that this aligns with the project's minimum Node.js version requirement to avoid compatibility issues.

engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
babel-plugin-jest-hoist@30.2.0:
resolution: {integrity: sha512-ftzhzSGMUnOzcCXd6WHdBGMyuwy15Wnn0iyyWGKgBDLxf9/s5ABuraCSpBX2uG0jUg4rqJnxsLc5+oYBqoxVaA==}
engines: {node: ^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The updated engines field for babel-plugin-jest-hoist now requires Node.js versions ^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0. Ensure compatibility with the project's Node.js version to prevent potential issues.

engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
babel-preset-jest@30.2.0:
resolution: {integrity: sha512-US4Z3NOieAQumwFnYdUWKvUKh8+YSnS/gB3t6YBiz0bskpu7Pine8pPCheNxlPEW4wnUkma2a94YuW2q3guvCQ==}
engines: {node: ^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The engines field for babel-preset-jest now requires Node.js versions ^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0. Confirm that the project's environment supports these versions to avoid runtime errors.

color-name@1.1.3:
resolution: {integrity: sha512-72fSenhMw2HZMTVHeCA9KCmpEIbzWiQsjN+BHcBbS9vr1mtt+vJjPdksIBNUmKAW8TFUDPJK5SUU3QhE9NEXDw==}
color-convert@3.1.2:
resolution: {integrity: sha512-UNqkvCDXstVck3kdowtOTWROIJQwafjOfXSmddoDrXo4cewMKmusCeF22Q24zvjR8nwWib/3S/dfyzPItPEiJg==}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The upgrade to color-convert@3.1.2 requires Node.js version >=14.6. Ensure that the deployment environment meets this requirement to avoid runtime issues.


color-name@1.1.4:
resolution: {integrity: sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==}

color-string@1.9.1:
resolution: {integrity: sha512-shrVawQFojnZv6xM40anx4CkoDP+fZsw/ZerEMsW/pyzsRbElpsL/DBVW7q3ExxwusdNXI3lXpuhEZkzs8p5Eg==}
color-name@2.0.2:

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The upgrade to color-name@2.0.2 requires Node.js version >=12.20. Verify that the deployment environment is compatible with this version to prevent compatibility issues.

color@3.2.1:
resolution: {integrity: sha512-aBl7dZI9ENN6fUGC7mWpMTPNHmWUSNan9tuWN6ahh5ZLNk9baLJOnSMlrQkHcrfFgz2/RigjUVAjdx36VcemKA==}
color-string@2.1.2:
resolution: {integrity: sha512-RxmjYxbWemV9gKu4zPgiZagUxbH3RQpEIO77XoSSX0ivgABDZ+h8Zuash/EMFLTI4N9QgFPOJ6JQpPZKFxa+dA==}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The upgrade to color-string@2.1.2 requires Node.js version >=18. Confirm that the deployment environment supports this version to ensure compatibility.


colorspace@1.1.4:
resolution: {integrity: sha512-BgvKJiuVu1igBUF2kEjRCZXol6wiiGbY5ipL/oVPwm0BL9sIpMIzM8IK7vwuxIIzOXMV3Ey5w+vxhm0rR/TN8w==}
color@5.0.2:

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The upgrade to color@5.0.2 requires Node.js version >=18. Make sure the deployment environment is updated to this version to avoid potential issues.

engines: {'0': node >= 0.8}
concat-stream@2.0.0:
resolution: {integrity: sha512-MWufYdFw53ccGjCA+Ol7XJYpAlW6/prSMzuPOTRnJGcGzuhLn4Scrz7qf6o8bROZ514ltazcIFJZevcfbo0x7A==}
engines: {'0': node >= 6.0}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[⚠️ maintainability]
The engines field for concat-stream has been updated to require Node.js version >= 6.0. Ensure that this version is compatible with the environments where this package will be deployed, as it may affect compatibility with older Node.js versions.

defaults@3.0.0:
resolution: {integrity: sha512-RsqXDEAALjfRTro+IFNKpcPCt0/Cy2FqHSIlnomiJp9YGadpQnrtbRpSgN2+np21qHcIKiva4fiOQGjS9/qR/A==}
engines: {node: '>=18'}
defaults@2.0.2:

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ security]
Downgrading defaults from version 3.0.0 to 2.0.2 reduces the minimum Node.js version requirement from >=18 to >=16. Ensure that this downgrade does not reintroduce any security vulnerabilities or remove necessary features that were present in version 3.0.0.

resolution: {integrity: sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow==}
engines: {node: '>=12'}

dotenv@17.2.3:

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[⚠️ maintainability]
The addition of dotenv@17.2.3 alongside dotenv@16.6.1 might lead to potential conflicts or unexpected behavior due to multiple versions of the same package being used. Consider consolidating to a single version unless both are explicitly required.

engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
expect@30.2.0:
resolution: {integrity: sha512-u/feCi0GPsI+988gU2FLcsHyAHTU0MX1Wg68NhAnN7z/+C5wqG+CY8J53N9ioe8RXgaoz0nBR/TYMf3AycUuPw==}
engines: {node: ^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The updated expect package now requires Node.js versions ^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0. Ensure that the deployment environment supports these Node.js versions to avoid runtime issues.

resolution: {integrity: sha512-w1cEuf3S+DrLCQL7ET6kz+gmlJdbq9J7yXCSjK/OZCPA+qEN1WyF4ZAf0YYJa4/shHJra2t/d/r8SV4Ji+x+8Q==}
file-type@21.0.0:
resolution: {integrity: sha512-ek5xNX2YBYlXhiUXui3D/BXa3LdqPmoLJ7rqEx2bKJ7EAUEfmXgW0Das7Dc6Nr9MvqaOnIqiPV0mZk/r/UpNAg==}
engines: {node: '>=20'}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The upgrade of file-type to version 21.0.0 requires Node.js version >=20. Ensure that the deployment environment supports this Node.js version, as it may affect compatibility and could lead to runtime errors if not addressed.

resolution: {integrity: sha512-Jqc1btCy3QzRbJaICGwKcBfGWuLADRerLzDqi2NwSt/UkXLsHJw2TVResiaoBufHVHy9aSgClOHCeJsSsFLTbg==}
formidable@3.5.4:
resolution: {integrity: sha512-YikH+7CUTOtP44ZTnUhR7Ic2UASBPOqmaRkRKxRbywPTe5VxF7RRCck4af9wutiZ/QKM5nME9Bie2fFaPz5Gug==}
engines: {node: '>=14.0.0'}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The formidable package now requires Node.js version >=14.0.0. Ensure that the deployment environment is compatible with this version requirement to avoid runtime issues.

@@ -2322,25 +2408,25 @@ packages:
glob-to-regexp@0.4.1:
resolution: {integrity: sha512-lkX1HJXwyMcprw/5YUZc2s7DrpAiHB21/V+E1rHUrVNokkvB6bqMzT0VfV6/86ZNabt1k14YOIaT7nDvOX3Iiw==}

glob@11.0.1:
resolution: {integrity: sha512-zrQDm8XPnYEKawJScsnM0QzobJxlT/kHOOlRTio8IH/GrmxRE5fjllkzdaHclIuNjUQTJYH2xHNIGfdpJkDJUw==}
glob@10.4.5:

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ security]
The downgrade from glob@11.0.1 to glob@10.4.5 might reintroduce previously fixed issues or vulnerabilities. Ensure this change is intentional and verify that the older version does not have known security vulnerabilities.

globals@11.12.0:
resolution: {integrity: sha512-WOBp/EEGUiIsJSp7wcv/y6MO+lV9UoncWqxuFfm8eBwzWNgyfBd6Gz+IeKQ9jCmyhoH99g15M3T+QaVHFjizVA==}
engines: {node: '>=4'}

globals@14.0.0:
resolution: {integrity: sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==}
engines: {node: '>=18'}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The upgrade of globals from version 11.12.0 to 14.0.0 and 16.4.0 changes the required Node.js engine version from >=4 to >=18. Ensure that the deployment environment supports Node.js version 18 or higher, as this is a significant change that could impact compatibility.

@@ -2357,14 +2443,15 @@ packages:
graphemer@1.4.0:
resolution: {integrity: sha512-EtKwoO6kxCL9WO5xipiHTZlSzBm7WLT627TqC/uVRd0HKmq8NXyebnNYxDoBi7wt8eTWrUrKXCOVaFq9x1kgag==}

handlebars@4.7.8:
resolution: {integrity: sha512-vafaFqs8MZkRrSX7sFVUdo3ap/eNiLnb4IakshzvP56X5Nr1iGKAIqdX6tMlm6HcNRIkr6AxO5jFEoJzzpT8aQ==}
engines: {node: '>=0.4.7'}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[⚠️ maintainability]
The handlebars@4.7.8 package specifies engines: {node: '>=0.4.7'}. This is an extremely old version of Node.js and may not be compatible with modern environments. Consider verifying compatibility with the current Node.js version used in your project.

resolution: {integrity: sha512-9DDdhb5j6cpeitCbvLO7n7J4IxnbM6hoF6O1g4HQ5TfhvvKN8ywDM7668ZhMHRqVmxqhps/F6syWK2KcPxYlkw==}
engines: {node: 20 || >=22}
jackspeak@3.4.3:
resolution: {integrity: sha512-OGlZQpz2yfahA/Rd1Y8Cd9SIEsqvXkLVoSw/cgwhnhFMDbsQFeZYoJJ7bIZBS9BcamUW96asq/npPWugM+RQBw==}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The version of jackspeak has been downgraded from 4.1.0 to 3.4.3. This could potentially introduce compatibility or functionality issues if the newer version was required for specific features or bug fixes. Please verify that this downgrade is intentional and does not affect the application's functionality.

@@ -2824,8 +2890,11 @@ packages:
resolution: {integrity: sha512-ozCC6gdQ+glXOQsveKD0YsDy8DSQFjDTz4zyzEHNV5+JP5D62LmfDZ6o1cycFx9ouG940M5dE8C8CTewdj2YWQ==}
engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}

lru-cache@11.1.0:
resolution: {integrity: sha512-QIXZUBJUx+2zHUdQujWejBkcD9+cs94tLn0+YL8UrCh+D5sCXZ4c7LaEH48pNwRY3MLDgqUFyhlCyjJPf1WP0A==}
lru-cache@10.4.3:

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The downgrade from lru-cache@11.1.0 to lru-cache@10.4.3 might introduce compatibility or performance issues, especially if the newer version was addressing specific bugs or performance improvements. Ensure that this downgrade is intentional and that any potential impacts are understood.

engines: {node: '>= 6.0.0'}
multer@2.0.2:
resolution: {integrity: sha512-u7f2xaZ/UG8oLXHvtF/oWTRvT44p9ecwBBqTwgJVq0+4BW1g8OW01TyMEGWBHbyMOYVHXslaut7qEQ1meATXgw==}
engines: {node: '>= 10.16.0'}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The upgrade of multer from version 1.4.5-lts.2 to 2.0.2 changes the required Node.js engine from >= 6.0.0 to >= 10.16.0. Ensure that the deployment environment supports this Node.js version to prevent runtime issues.

engines: {node: ^18 || >=20}
hasBin: true

napi-postinstall@0.3.4:
resolution: {integrity: sha512-PHI5f1O0EP5xJ9gQmFGMS6IZcrVvTjpXjz7Na41gTE7eE2hK11lg04CECCYEEjdc17EV4DO+fkGEtt7TpTaTiQ==}
engines: {node: ^12.20.0 || ^14.18.0 || >=16.0.0}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The addition of napi-postinstall@0.3.4 introduces a new dependency with specific Node.js engine requirements (^12.20.0 || ^14.18.0 || >=16.0.0). Verify that these requirements are compatible with the current deployment environment to avoid compatibility issues.

resolution: {integrity: sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==}
path-scurry@1.11.1:
resolution: {integrity: sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==}
engines: {node: '>=16 || 14 >=14.18'}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The engines field for path-scurry@1.11.1 specifies node: '>=16 || 14 >=14.18', which seems incorrect. The expression 14 >=14.18 is not a valid version range and may cause issues with package resolution. Please verify and correct this version specification.

engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
pretty-format@30.2.0:
resolution: {integrity: sha512-9uBdv/B4EefsuAL+pWqueZyZS2Ba+LxfFeQ9DN14HU4bN8bhaxKdkpjpB6fs9+pSjIBu+FXQHImEg8j/Lw0+vA==}
engines: {node: ^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The updated pretty-format package now requires Node.js version ^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0. Ensure that the deployment environment supports these Node.js versions to prevent runtime issues.

prisma@6.6.0:
resolution: {integrity: sha512-SYCUykz+1cnl6Ugd8VUvtTQq5+j1Q7C0CtzKPjQ8JyA2ALh0EEJkMCS+KgdnvKW1lrxjtjCyJSHOOT236mENYg==}
prisma@6.18.0:
resolution: {integrity: sha512-bXWy3vTk8mnRmT+SLyZBQoC2vtV9Z8u7OHvEu+aULYxwiop/CPiFZ+F56KsNRNf35jw+8wcu8pmLsjxpBxAO9g==}
engines: {node: '>=18.18'}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The updated prisma package now requires Node.js version >=18.18. Verify that the deployment environment is compatible with this requirement to avoid compatibility issues.

strtok3@10.2.2:
resolution: {integrity: sha512-Xt18+h4s7Z8xyZ0tmBoRmzxcop97R4BAh+dXouUDCYn+Em+1P3qpkUfI5ueWLT8ynC5hZ+q4iPEmGG1urvQGBg==}
strtok3@10.3.4:
resolution: {integrity: sha512-KIy5nylvC5le1OdaaoCJ07L+8iQzJHGH6pWDuzS+d07Cu7n1MZ2x26P8ZKIWfbK02+XIL8Mp4RkWeqdUCrDMfg==}
engines: {node: '>=18'}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The strtok3 package has been updated to require Node.js version >=18. Ensure that your deployment environment supports this Node.js version to avoid runtime issues.

type-fest@4.40.0:
resolution: {integrity: sha512-ABHZ2/tS2JkvH1PEjxFDTUWC8dB5OsIGZP4IFLhR293GqT5Y5qB1WwL2kMPYhQW9DVgVD8Hd7I8gjwPIf5GFkw==}
type-fest@4.41.0:
resolution: {integrity: sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA==}
engines: {node: '>=16'}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The type-fest package now requires Node.js version >=16. Ensure that the deployment environment supports this version to prevent runtime issues.

engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
write-file-atomic@5.0.1:
resolution: {integrity: sha512-+QU2zd6OTD8XWIJCbffaiQeH9U73qIqafo1x6V1snCWYGJf6cVE0cDR4D8xRzcEnfI21IFrUPzPGtcPf8AC+Rw==}
engines: {node: ^14.17.0 || ^16.13.0 || >=18.0.0}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The upgrade of write-file-atomic from version 4.0.2 to 5.0.1 changes the Node.js engine requirements. Ensure that the deployment environment supports Node.js version ^14.17.0 || ^16.13.0 || >=18.0.0 to avoid runtime issues.

@kkartunov kkartunov changed the title Upgrades NPM Upgrades Oct 27, 2025
ci-info: 3.9.0
exit: 0.1.2
ci-info: 4.3.1
exit-x: 0.2.2

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The package exit has been replaced with exit-x. Ensure that exit-x is a suitable replacement and does not introduce any unexpected behavior changes, as this could affect the application's exit handling logic.

exit: 0.1.2
glob: 7.2.3
collect-v8-coverage: 1.0.3
exit-x: 0.2.2

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The package exit has been replaced with exit-x. Verify that exit-x is compatible with the existing codebase and does not introduce breaking changes, especially if the application relies on specific exit handling behavior.

@@ -6237,11 +6435,20 @@ snapshots:

glob-to-regexp@0.4.1: {}

glob@11.0.1:
glob@10.4.5:

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ security]
The downgrade from glob@11.0.1 to glob@10.4.5 could potentially reintroduce previously fixed issues or vulnerabilities. Verify that this downgrade is intentional and does not compromise security or functionality.

jackspeak: 4.1.0
minimatch: 10.0.1
jackspeak: 4.1.1
minimatch: 10.0.3
minipass: 7.1.2
package-json-from-dist: 1.0.1
path-scurry: 2.0.0

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The upgrade of path-scurry from 1.11.1 to 2.0.0 could introduce breaking changes due to the major version bump. Ensure that the new version is compatible with the existing codebase and does not introduce any regressions.

dependencies:
html-escaper: 2.0.2
istanbul-lib-report: 3.0.1

iterare@1.2.1: {}

jackspeak@4.1.0:
jackspeak@3.4.3:

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The version of jackspeak has been downgraded from 4.1.0 to 3.4.3. Ensure this downgrade is intentional, as it might introduce compatibility issues or lack of features present in the newer version.


jake@10.9.2:
jackspeak@4.1.1:

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The version of jackspeak is updated again to 4.1.1 after being downgraded to 3.4.3. This seems inconsistent. Verify the intended version to avoid potential dependency conflicts.

chalk: 4.1.2
create-jest: 29.7.0(@types/node@22.14.1)(ts-node@10.9.2(@swc/core@1.11.21)(@types/node@22.14.1)(typescript@5.8.3))
exit: 0.1.2
exit-x: 0.2.2

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[⚠️ correctness]
The dependency exit has been replaced with exit-x. Ensure that exit-x is a suitable replacement and does not introduce any breaking changes or unexpected behavior.

jest-haste-map: 30.2.0
jest-pnp-resolver: 1.2.3(jest-resolve@30.2.0)
jest-util: 30.2.0
jest-validate: 30.2.0
slash: 3.0.0

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[⚠️ maintainability]
The addition of unrs-resolver as a dependency should be verified for necessity and compatibility with the existing codebase.

@@ -6903,7 +7130,9 @@ snapshots:

lowercase-keys@3.0.0: {}

lru-cache@11.1.0: {}
lru-cache@10.4.3: {}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ security]
The downgrade from lru-cache@11.1.0 to lru-cache@10.4.3 could potentially reintroduce bugs or security vulnerabilities that were fixed in the later version. Ensure that this downgrade is intentional and verify that the older version does not have known issues.

fast-fifo: 1.3.2
text-decoder: 1.2.3
optionalDependencies:
bare-events: 2.5.4
transitivePeerDependencies:

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The change from optionalDependencies to transitivePeerDependencies for bare-abort-controller and react-native-b4a could impact how these dependencies are resolved and included in the project. Ensure that this change is intentional and that it won't lead to unexpected behavior in environments where these dependencies are not explicitly installed.

@kkartunov kkartunov requested a review from jmgasper October 27, 2025 08:45
@kkartunov kkartunov merged commit 27a3c10 into dev Oct 27, 2025
7 checks passed
@kkartunov kkartunov deleted the npm-module-updates branch October 28, 2025 15:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants