[CSR-0] chore: Bump release-it from 19.2.4 to 21.0.2 - #398
Conversation
AssigneesThe following users could not be added as assignees: Please fix the above issues or remove invalid values from |
dependabot
Bot
added
dependencies
Bumps [release-it](https://github.com/release-it/release-it) from 19.2.4 to 21.0.2. - [Release notes](https://github.com/release-it/release-it/releases) - [Changelog](https://github.com/release-it/release-it/blob/main/CHANGELOG.md) - [Commits](release-it/release-it@19.2.4...21.0.2) --- updated-dependencies: - dependency-name: release-it dependency-version: 21.0.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
4664b2a to
c86c657
Compare
Security triage: Tier B — needs a decision (major bump; moves
|
| package | from → to | severity | via |
|---|---|---|---|
release-it |
19.2.4 → 21.0.2 | high | direct devDependencies (root + 3 workspaces) |
undici |
6.23.0 → 7.29.0 | high | release-it (exact pin) |
basic-ftp |
5.2.2 → 5.3.1 | high | get-uri ← release-it |
No Vanta finding covers any of these — in the lockfile, not in Vanta. Vanta's current integrationId=github worklist for this repo is js-yaml (alerts 175, 176) and nanoid (178) only; none of the three above appears at any deadline. So there is no SLA clock here, and equally no compliance visibility.
Advisories closed, from npm audit on the base lockfile:
release-it18.0.0-next.0 - 19.2.4— high, carried entirely viaundici.undici<=6.27.0— a chain of 12 advisories: GHSA-f269-vfmq-vjvj (high, WebSocket 64-bit length overflow crashes the client), GHSA-vrm6-8vpv-qv8q (high, unbounded memory in WebSocketpermessage-deflatedecompression), GHSA-vxpw-j846-p89q (high, WebSocket DoS via fragment-count bypass), GHSA-v9p9-hfj2-hcw8 (high, unhandled exception on invalidserver_max_window_bits), GHSA-2mjp-6q6p-2qxm (moderate, request/response smuggling), plus GHSA-4992-7rv2-5pvq, GHSA-p88m-4jfj-68fv, GHSA-8xcm-r25x-g524, GHSA-m8rv-5g2x-5cg5, GHSA-v3r7-h72x-cjcm, GHSA-g8m3-5g58-fq7m, GHSA-35p6-xmwp-9g52.basic-ftp<=5.3.0— GHSA-rp42-5vxx-qpwr and GHSA-rpmf-866q-6p89, both high (unbounded memory inClient.list(); malicious FTP server causes client-side DoS).
Exposure
Development. release-it is a devDependencies entry in the root manifest and in packages/cmd, packages/jest, packages/node-test-reporter, and every stanza the diff moves is recorded dev: true in the lockfile. It runs at release time on a runner, not in @currents/cmd, @currents/jest or @currents/node-test-reporter as published. Nothing here reaches a shipped artifact.
That bounds the impact, but does not make it nil: release-it executes in publish.yaml with registry credentials in the environment, and the undici set includes request smuggling and response-queue poisoning against whatever that process talks to.
The fix
Mechanism is a manifest bump — the vulnerable package is a direct dependency, so its range moves in the four manifests that declare it, and the lockfile follows. That is the right choice rather than an overrides entry, and no overrides key was added.
Worth being explicit about undici, because a lockfile refresh alone could not have done it: release-it requests undici at exactly 6.23.0, so nothing short of moving release-it itself shifts that copy. Confirmed from the base lockfile — node_modules/release-it is the only requester of undici, and the constraint is an exact version, not a range.
Breaking-change check
This is a two-major jump, 19 → 21, and that is the substance of the decision. Release notes for 20.x and 21.x were not obtainable through this sandbox — that alone is a Tier B trigger under the rubric, independent of the major bump.
What the lockfile diff shows about the shape of the change, since the notes were unavailable: the dependency set is substantially rebuilt, not nudged. Removed wholesale — inquirer, rxjs, run-async, wrap-ansi, yoctocolors-cjs, citty, nypm, node-fetch-native. Added — quickjs-wasi, proxy-agent-negotiate, powershell-utils, is-in-ssh, fast-wrap-ansi, fast-string-width, fast-string-truncated-width. Net 485 added / 650 removed lines across package-lock.json. An interactive-prompt stack (inquirer/rxjs) being swapped out is the kind of change that alters non-interactive/CI behaviour, and release-it here runs non-interactively.
Verification
Not run locally this run. CI exercises npm ci + lint + unit tests + per-workspace type checks against this exact lockfile, which is the same ground a local pass would cover, and it is green — see below. No local claim is being made.
CI coverage
All check runs on head c86c657 (2026-08-25 15:15):
| check | conclusion |
|---|---|
| Unit Tests | success |
| lint | success |
| matrix | success |
cmd Types |
success |
jest Types |
success |
| typecheck-status | success |
| [code]smith | skipped |
One thing worth flagging as good here, because it is not the norm in this repo: the type checks genuinely ran. types-matrix.yml gates its types job on changed files matching packages/**, and because this PR edits three packages/*/package.json manifests, the matrix is non-empty and cmd Types / jest Types actually executed. On a lockfile-only diff in this repo that matrix comes out as [""], the job is skipped, and typecheck-status still exits 0 through its any_changed != 'true' branch — a green tick with no type checking behind it. Not the case here; this green is real.
Not triggered: publish.yaml and linear-release.yaml (workflow_dispatch / push to main). So the one thing CI does not exercise is release-it itself doing a release, which is precisely what this PR changes.
What a human should still check
- Do a
--dry-runrelease on this branch for at least one workspace. CI never runsrelease-it, so a two-major bump of the release tool is entirely unverified by the green ticks above. This is the one item that actually matters. - Confirm
release-it21 still reads the existing.release-itconfig and the@release-it/conventional-changelog@^12.0.0plugin — the plugin's range is unchanged by this PR, and a major of the host tool is where a plugin contract breaks. - Check non-interactive behaviour given the
inquirer/rxjsremoval noted above. - Sequencing. [CSR-0] chore: Bump @jest/reporters from 29.7.0 to 30.4.1 #397 and [CSR-0] chore: Bump jest and @types/jest #400 also rewrite
package-lock.json. All three will conflict pairwise; whichever merges first forces the others to rebase. Recommended order: this PR first (it is the only one of the three that closes advisories, and the only one currently green and not superseded), then [CSR-0] chore: Bump jest and @types/jest #400, then [CSR-0] chore: Bump @jest/reporters from 29.7.0 to 30.4.1 #397 once its type failures are fixed.
Needs release
No. Dev-only dependency; nothing to publish to close these.
On #401, #404 and #406 — recommend closing all three, unmerged. Each is a lone one-line manifest edit with no accompanying lockfile change:
- [CSR-0] chore: Bump release-it from 19.2.4 to 21.0.2 in /packages/cmd #401 →
packages/cmd/package.jsononly - [CSR-0] chore: Bump release-it from 19.2.4 to 21.0.2 in /packages/jest #404 →
packages/jest/package.jsononly - [CSR-0] chore: Bump release-it from 19.2.4 to 21.0.2 in /packages/node-test-reporter #406 →
packages/node-test-reporter/package.jsononly
Every workflow in this repo installs with npm ci (lint.yml, unit-test.yaml, types-matrix.yml, publish.yaml), which refuses a manifest/lockfile mismatch outright. That is not a prediction — #401's CI is red on exactly that: lint, Unit Tests, cmd Types and typecheck-status all failure. They are individually unmergeable and collectively redundant with this PR. I have not closed them; they are not mine to close.
Generated by Claude Code
2 participants
Bumps release-it from 19.2.4 to 21.0.2.
Release notes
Sourced from release-it's releases.
... (truncated)
Changelog
Sourced from release-it's changelog.
... (truncated)
Commits
aa8752dRelease 21.0.26c211f0Migrate to pnpm + update deps7ca61ccPrevent duplicate comments on resolved issues and PRs (#1324)2a1d141Release 21.0.1a8888b4Fix regression and support --no-hooks to skip all hooks5e9c193Release 21.0.02637e8aUpdate changelog for v21c381a2dVerify GitLab server certificates by defaultdf94838Raise Node 22 requirement to 22.21ba4326fMake GitLab CA tests platform-independent