fix: update dependencies to address security issue in @babel/runtime < 7.26.10 #375

jdalrymple · 2025-09-30T18:13:17Z

What:

Modernized project dependencies and resolved deprecated packages, peer dependency warnings, and security vulnerabilities.

Why:

The codecov package was deprecated with a migration plan in place
Multiple peer dependency warnings were causing noise during installation
Security audit identified 2 low-severity vulnerabilities in transitive dependencies
node-fetch dependency was unnecessary given Node.js 22's native fetch support
ES module compatibility issues were causing test failures after package updates

How:

Dependency Updates:

Removed deprecated codecov package and updated CircleCI config to use official codecov orb
Removed unnecessary node-fetch dependency, now using Node.js 22's native fetch
Removed typescript dev dependency (not needed for pure JS project)
Added pnpm override for tmp@>=0.2.4 to resolve security vulnerability

Configuration Changes:

Updated Jest config to support ES modules with --experimental-vm-modules flag
Added transformIgnorePatterns for prettier compatibility
Modified test script to use NODE_OPTIONS environment variable

Code Updates:

Fixed inquirer v12 compatibility by using require('inquirer').default
Fixed lint errors (curly braces, logical assignment warnings)
Updated test snapshots to reflect prettier formatting changes
Fixed conditional logic in test files to avoid ESLint warnings

Infrastructure Updates:

Updated CircleCI to use Node.js 22.14 (from 16.17.0) to match engine requirements
Migrated CI from yarn to pnpm to match project package manager
Added pnpm installation step to CircleCI workflow
Removed obsolete .yvmrc file (Yarn version specification no longer needed)

Checklist:

Documentation
Tests
Ready to be merged
Added myself to contributors table

jdalrymple · 2025-10-26T17:00:25Z

I know this was a huge overhaul, but would love to get the cli tool up to date 🙏

jdalrymple · 2026-01-18T20:16:05Z

Bump 🙏

lwasser · 2026-01-23T02:13:24Z

.circleci/config.yml

    steps:
      - prep_env
-      - run: yarn install
+      - run: pnpm install


cool - i didn't know about pnpm!!

we moved from yarn --> npm for the documentation i wonder if we should use this over in that repo too?

Although I personally love pnpm and use it in all my projects (template: create-typescript-app), switching this CLI from a previous package manager to pnpm is a big change. If we want to do that (+1 from me) it should be in a separate PR than a smaller "update dependencies" one.

lwasser · 2026-01-23T02:17:05Z

@all-contributors please add @jdalrymple for security, bug

allcontributors · 2026-01-23T02:17:15Z

@lwasser

I've put up a pull request to add @jdalrymple! 🎉

lwasser · 2026-01-23T02:24:12Z

hey @jdalrymple thank you for this - this is a BIG PR!!

We have been working on reviving this project and I do have merge permissions but i'm trying to use them carefully as we all get up to speed on this project. Do you have the capacity to split this out into small pieces?

I am doing updates such as dependabot etc as well. if you are willing to work with us, implementing this in several smaller pr's would be greatly appreciated!

lwasser · 2026-01-23T02:25:23Z

.circleci/config.yml

@@ -1,15 +1,23 @@
 version: 2.1

+orbs:


i don't think i have access to circle ci so let me dig into that first. if this could be it's own pr we can merge it quickly as is

lwasser · 2026-01-23T02:26:44Z

maybe one pr for circle ci
one pr for linting
one pr for deps.

i am still trying to figure out how deployment is setup here. And where tests run.

lemme know how that sounds. I appreciate your help!!

JoshuaKGoldberg

🙌 I appreciate the initiative! There are quite a few unrelated changes in this PR ranging from stylistic tweaks in other files to a full swap of the package manager. +1 to lwasser's suggestion to have one PR per thing. That makes things much more reviewable. And if one item is blocked, that doesn't block the other items. Thanks!

JoshuaKGoldberg · 2026-01-23T15:42:32Z

.circleci/config.yml

    steps:
      - prep_env
-      - run: yarn install
+      - run: pnpm install


Although I personally love pnpm and use it in all my projects (template: create-typescript-app), switching this CLI from a previous package manager to pnpm is a big change. If we want to do that (+1 from me) it should be in a separate PR than a smaller "update dependencies" one.

JoshuaKGoldberg · 2026-01-23T15:43:26Z

src/repo/github.js

@@ -1,5 +1,4 @@
 const url = require('url')
-const fetch = require('node-fetch')


Moving from node-fetch to the global fetch is also a bigger change than just bumping @babel/runtime. node-fetch isn't quite a drop-in replacement for fetch. fetch is more spec/standards-compliant.

JoshuaKGoldberg · 2026-01-23T15:43:47Z

src/util/git.js

-    if (commitConvention.lowercase)
+    if (commitConvention.lowercase) {
      commitMessage = commitConvention.transform(commitMessage)
+    }


[Style] Unrelated change - this isn't a problem on its own, but with all the other unrelated changes makes this PR harder to review.

marcelpanse and others added 9 commits April 30, 2025 20:13

updated packages

7685c19

add dist

ad6e6be

remove dist

20f6f57

upgraded inquirer package

00fcdd9

Updating node lts

e199d57

Another dep update

d14ab08

Overhaul

6f89a2b

Clean up

c039b3d

pnpm through corepack

5a4237d

jdalrymple mentioned this pull request Sep 30, 2025

fix: update dependencies to address security issue in @babel/runtime < 7.26.10 #372

Closed

Use orb

8df7603

Updating minor deps

9a16463

lwasser reviewed Jan 23, 2026

View reviewed changes

allcontributors bot mentioned this pull request Jan 23, 2026

docs: add jdalrymple as a contributor for security, and bug #381

Merged

Merge branch 'main' into master

2043cac

lwasser reviewed Jan 23, 2026

View reviewed changes

lwasser mentioned this pull request Jan 23, 2026

CircleCI build broken: can't clone // permissions #385

Open

JoshuaKGoldberg requested changes Jan 23, 2026

View reviewed changes

		@@ -1,5 +1,4 @@
		const url = require('url')
		const fetch = require('node-fetch')

fix: update dependencies to address security issue in @babel/runtime < 7.26.10 #375

Are you sure you want to change the base?

fix: update dependencies to address security issue in @babel/runtime < 7.26.10 #375

Uh oh!

Conversation

jdalrymple commented Sep 30, 2025 • edited by lwasser Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What:

Why:

How:

Uh oh!

jdalrymple commented Oct 26, 2025

Uh oh!

jdalrymple commented Jan 18, 2026

Uh oh!

lwasser Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

lwasser Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

JoshuaKGoldberg Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

lwasser commented Jan 23, 2026

Uh oh!

allcontributors bot commented Jan 23, 2026

Uh oh!

lwasser commented Jan 23, 2026

Uh oh!

lwasser Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

lwasser commented Jan 23, 2026

Uh oh!

JoshuaKGoldberg left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

JoshuaKGoldberg Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

JoshuaKGoldberg Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

JoshuaKGoldberg Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

jdalrymple commented Sep 30, 2025 •

edited by lwasser

Loading

JoshuaKGoldberg left a comment •

edited

Loading