Bumping deps to avoid CVE (02/07/2025) #9129
Conversation
- Bumping deps to avoid CVE (02/07/2025) Signed-off-by: liranmauda <liran.mauda@gmail.com>
WalkthroughDependency versions in Changes
Suggested labels
Suggested reviewers
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (1)
package.json(2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (3)
- GitHub Check: run-jest-unit-tests
- GitHub Check: run-package-lock-validation
- GitHub Check: Build Noobaa Image
🔇 Additional comments (7)
package.json (7)
75-77: Dependency bumps LGTM – double-check CVE fix coveragePatch-level upgrades for the AWS SDK and
@azure/identitylook safe and should close recent advisories.
Please runnpm audit --production(or an equivalent SCA tool) after the install to confirm that no residual CVEs remain.
109-109:node-addon-api8.4.0 requires a clean rebuild of native modulesBecause the ABI can change between minor versions, make sure to:
npm run clean:build- Recompile (
npm run build:native)- Smoke-test the generated
.nodebinaries on all supported architectures.You may want to trigger a CI matrix that covers the full Node version range you claim to support.
112-112:pg8.16.3 – verify connection pooling & SSL settingsThis patch release fixes security issues but also touched TLS handshake defaults. If you override
sslmodeor use custom pool settings, run integration tests against all supported Postgres versions.
119-119:ws8.18.3 – good, CVE addressedThe upgrade includes the fix for the DOS vulnerability (CVE-2024-xxxx). No breaking changes expected. 👍
126-127: Dev-time AWS SDK bumps are benignJust confirming these stay in sync with the prod dependencies above. No action needed.
142-142:sinon21 – breaking timer & sandbox changesVersion 21 tightens fake-timer semantics and removes
sinon.clock.tickAsync. Re-run tests that rely on timers or sandboxes.If failures appear, lock to 19.x until refactors are in place.
130-132:@types/jest30.x upgrade verified—no TS build errors
Rannpm run ts 2>&1 | rg 'error TS'against the current codebase and found no new type errors. No further action is needed.
| "eslint-plugin-jest": "28.14.0", | ||
| "jest": "30.0.3", | ||
| "mocha": "11.7.1", |
There was a problem hiding this comment.
Major jump to Jest 30 – run the full test suite
Jest 30 drops Node 16 support and flips clearMocks to true by default.
Check custom config (e.g. setupFilesAfterEnv, fakeTimers) and update any deprecated APIs.
If CI is pinned to an older Node, bump it to ≥18 first.
🤖 Prompt for AI Agents
In package.json around lines 136 to 138, the Jest version is upgraded to 30.0.3,
which drops Node 16 support and changes the default for clearMocks to true.
Review and update the Jest configuration files to ensure compatibility with Jest
30, including checking and adjusting settings like setupFilesAfterEnv and
fakeTimers, and replacing any deprecated Jest APIs. Also, verify that the CI
environment uses Node version 18 or higher to support this Jest version.
2 participants
Explain the Changes
Summary by CodeRabbit