Repository navigation
chore(deps): patch toolchain advisories and record the upstream-blocked ones - #64
Merged
Merged
Conversation
…ed ones Takes the grouped dev bump from #63 (with @n8n/node-cli at 0.50.3 instead of 0.49.1, and n8n-workflow on the 2.41.1 stable line rather than the 2.42.1 beta), then runs a non-forced `npm audit fix`. Clears undici, fast-uri and brace-expansion: npm audit goes from 17 to 14, production tree still 0. The remaining 14 (axios, qs, uuid, stream-json and the n8n packages that contain them) are exact pins inside n8n's own toolchain. npm overrides would clear them but `n8n-node lint` bans them (no-overrides-field), so they are recorded in gotchas §20 instead. node-cli 0.50 stops applying no-restricted-imports to test files, so the per-file eslint-disable headers became unused-directive warnings; removed.
github-actions
Bot
added
documentation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replaces #63: the same grouped dev bump, but with
@n8n/node-cliat 0.50.3 (not 0.49.1) andn8n-workflowon the 2.41.1 stable line (not the 2.42.1 beta that^would pick), plus a non-forcednpm audit fix.npm audit(all)npm audit --omit=devFixed: undici 7.29.0 → 7.30.0, fast-uri → patched, brace-expansion → 1.1.21 / 2.1.7 / 5.0.12.
Still open (upstream-blocked, recorded in gotchas §20): axios 1.18.0 and qs 6.15.2 are exact pins inside
@n8n/backend-network/n8n-workflow, and uuid 10.0.0 / stream-json 1.9.1 sit inside the same@n8n/ai-node-sdktree. These include both open Dependabot alerts (#6 uuid, #36 stream-json). npmoverrideswould clear all of them (verified: audit 0, tests green), butn8n-node lintrejects them (@n8n/community-nodes/no-overrides-field), so that route would break CI and verification.Also removes the per-file
eslint-disable no-restricted-importsheaders fromtest/core/*.test.tsandvitest.config.ts: node-cli 0.50 no longer applies that rule to tests, so they had become unused-directive warnings.Test plan
npm run lint: 0 errors, 0 warningsnpm test: 21 files / 102 tests passnpm run buildsucceedsnpm pack --dry-run: LICENSE + README + dist + package.json only (105 files)npm audit --omit=dev: 0./scripts/harness-up.sh up && run) against the new n8n-workflow dev copy (optional: types only, nothing shipped changes)