Bump dependencies to fix security vulnerabilities

.github/workflows/tests.yaml

@@ -7,13 +7,15 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node: [ '14', '16', '18' ]
+        node: [ '20', '22' ]
 
-    container:
-      image: node:${{ matrix.node }}-alpine
+    name: Node ${{ matrix.node }}
 
     steps:
-    - uses: actions/checkout@v2
-    - run: yarn install --frozen-lockfile
-    - run: yarn lint
-    - run: yarn test
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+      - run: yarn install --frozen-lockfile
+      - run: yarn lint
+      - run: yarn test

bin/github-changelog-generator.js

@@ -1,2 +1,2 @@
 #! /usr/bin/env node
-require('../src');
+import '../src/index.js';

jest.config.js

@@ -0,0 +1,10 @@
+export default {
+  clearMocks: true,
+  collectCoverage: true,
+  collectCoverageFrom: ['src/**/*.js', '!src/index.js'],
+  modulePaths: ['<rootDir>'],
+  restoreMocks: true,
+  setupFilesAfterEnv: ['<rootDir>/test/setup.js'],
+  testEnvironment: 'node',
+  transform: {}
+};

package.json

@@ -5,47 +5,33 @@
   "license": "MIT",
   "author": "Ricardo Lopes",
   "main": "src/index.js",
+  "type": "module",
   "bin": {
     "github-changelog-generator": "./bin/github-changelog-generator.js"
   },
   "repository": "uphold/github-changelog-generator",
   "scripts": {
     "lint": "eslint --cache src test",
     "release": "./bin/release.sh",
-    "test": "jest"
+    "test": "NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules\" jest"
   },
   "dependencies": {
-    "@octokit/graphql": "^4.8.0",
+    "@octokit/graphql": "^8.2.1",
     "commander": "^8.3.0",
     "ini": "^2.0.0",
     "look-it-up": "^2.1.0",
     "moment": "^2.29.1"
   },
   "devDependencies": {
+    "@fastify/pre-commit": "^2.2.0",
     "eslint": "^8.30.0",
-    "eslint-config-uphold": "^4.1.0",
+    "eslint-config-uphold": "^6.0.0",
     "jest": "^29.3.1",
-    "nock": "^13.2.9",
-    "pre-commit": "^1.2.2",
+    "nock": "^14.0.1",
     "prettier": "^2.8.1"
   },
   "engines": {
-    "node": ">=14"
-  },
-  "jest": {
-    "collectCoverage": true,
-    "collectCoverageFrom": [
-      "src/**/*.js",
-      "!src/index.js"
-    ],
-    "modulePaths": [
-      "<rootDir>"
-    ],
-    "restoreMocks": true,
-    "setupFilesAfterEnv": [
-      "./test/setup.js"
-    ],
-    "testEnvironment": "node"
+    "node": ">=20"
   },
   "pre-commit": {
     "run": [

src/changelog-fetcher.js

@@ -1,11 +1,9 @@
-'use strict';
-
 /**
  * Module dependencies.
  */
 
-const { graphql } = require('@octokit/graphql');
-const moment = require('moment');
+import { graphql } from '@octokit/graphql';
+import moment from 'moment';
 
 /**
  * `ChangelogFetcher` class.
@@ -23,9 +21,9 @@ class ChangelogFetcher {
     futureReleaseTag,
     labels,
     owner,
+    releaseTagPrefix,
     repo,
-    token,
-    releaseTagPrefix
+    token
   }) {
     this.base = base;
     this.changedFilesPrefix = changedFilesPrefix;
@@ -35,7 +33,10 @@ class ChangelogFetcher {
     this.labels = labels || [];
     this.owner = owner;
     this.repo = repo;
-    this.client = graphql.defaults({ headers: { authorization: `token ${token}` } });
+    this.client = graphql.defaults({
+      baseUrl: 'https://api.github.com',
+      headers: { authorization: `token ${token}` }
+    });
   }
 
   /**
@@ -156,7 +157,7 @@ class ChangelogFetcher {
     let matchingRelease;
 
     do {
-      ({ releases, cursor, hasMoreResults } = await this.getReleasesQuery(cursor));
+      ({ cursor, hasMoreResults, releases } = await this.getReleasesQuery(cursor));
 
       matchingRelease = releases[0];
     } while (!matchingRelease && hasMoreResults);
@@ -338,7 +339,7 @@ class ChangelogFetcher {
     let releases = [];
 
     do {
-      ({ releases, cursor, hasMoreResults } = await this.getReleasesQuery(cursor));
+      ({ cursor, hasMoreResults, releases } = await this.getReleasesQuery(cursor));
 
       result.push(
         ...releases.map(({ name, tagCommit, url }) => ({
@@ -375,4 +376,4 @@ class ChangelogFetcher {
  * Export `ChangelogFetcher`.
  */
 
-module.exports = ChangelogFetcher;
+export default ChangelogFetcher;

src/changelog-formatter.js

@@ -4,7 +4,7 @@
  * Export `formatChangelog`.
  */
 
-module.exports.formatChangelog = releases => {
+export const formatChangelog = releases => {
   const changelog = ['# Changelog\n'];
 
   for (const release of releases) {

src/index.js

@@ -1,16 +1,14 @@
-'use strict';
-
 /**
  * Module dependencies.
  */
 
-const { Command } = require('commander');
-const { formatChangelog } = require('./changelog-formatter');
-const { lookItUpSync } = require('look-it-up');
-const { readFileSync } = require('fs');
-const ChangelogFetcher = require('./changelog-fetcher');
-const ini = require('ini');
-const path = require('path');
+import { Command } from 'commander';
+import { formatChangelog } from './changelog-formatter.js';
+import { lookItUpSync } from 'look-it-up';
+import { readFileSync } from 'node:fs';
+import ChangelogFetcher from './changelog-fetcher.js';
+import ini from 'ini';
+import path from 'node:path';
 
 /**
  * Instances.
@@ -52,7 +50,7 @@ const options = program.opts();
 const gitDir = lookItUpSync('.git');
 const { baseBranch = 'master', futureRelease, futureReleaseTag, labels, rebuild, releaseTagPrefix } = options;
 const token = process.env.GITHUB_TOKEN;
-let { owner, repo, changedFilesPrefix } = options;
+let { changedFilesPrefix, owner, repo } = options;
 
 /**
  * Infer owner and repo from git config if not provided.

test/changelog-fetcher.test.js

@@ -1,12 +1,11 @@
-'use strict';
-
 /**
  * Module dependencies.
  */
 
-const ChangelogFetcher = require('../src/changelog-fetcher');
-const moment = require('moment');
-const nock = require('nock');
+import { jest } from '@jest/globals';
+import ChangelogFetcher from '../src/changelog-fetcher.js';
+import moment from 'moment';
+import nock from 'nock';
 
 /**
  * Test `ChangelogFetcher`.

test/changelog-formatter.test.js

@@ -1,11 +1,9 @@
-'use strict';
-
 /**
  * Module dependencies.
  */
 
-const { formatChangelog } = require('../src/changelog-formatter');
-const moment = require('moment');
+import { formatChangelog } from '../src/changelog-formatter.js';
+import moment from 'moment';
 
 /**
  * Test `ChangelogFormatter`.

test/setup.js

@@ -1,10 +1,8 @@
-'use strict';
-
 /**
  * Module dependencies.
  */
 
-const nock = require('nock');
+import nock from 'nock';
 
 /**
  * Disable any type of net connection.