Repository navigation
Bump the security group across 1 directory with 2 updates #8133
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -16,7 +16,7 @@ | |
| "@infisical/cli": "^0.43.72", | ||
| "@tanstack/eslint-plugin-query": "^5.99.0", | ||
| "braces": "3.0.3", | ||
| "decode-uri-component": "0.5.0", | ||
|
Contributor
There was a problem hiding this comment. 🟡 Plus-sign decoding breaks regression check For Learn moreThe regression check asserts that plus signs decode like spaces. Version 0.5.0 preserves plus signs, a change introduced in version 0.3.0. The test therefore fails even when imported successfully. The expectation appears at the decoder regression check. Example: Recommended fix: Decide whether the repository needs form-style decoding. If yes, explicitly normalize plus signs before calling this package and test the wrapper. If no, update the regression check to match the new contract and audit any dependent callers. Was this helpful? React with 👍 or 👎 to provide feedback. |
||
| "dprint": "^0.51.1", | ||
| "eslint": "^9.39.4", | ||
| "extract-zip": "2.0.1", | ||
|
|
@@ -25,7 +25,7 @@ | |
| "oxfmt": "^0.45.0", | ||
| "oxlint": "^1.60.0", | ||
| "oxlint-tsgolint": "^0.21.1", | ||
| "sprintf-js": "1.1.3", | ||
| "supabase": "^2.89.1", | ||
| "turbo": "2.9.14", | ||
| "typescript-eslint": "^8.58.1" | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🟡 CommonJS decoder call fails in CI
With
decode-uri-componentat 0.5.0, the regression check calls itsrequire()result as a function. The ESM package returns a module namespace instead, so that test fails.Learn more
The repository's security dependency regression test runs a separate Node process that loads the URI decoder with
require()and calls the result directly. Version 0.5.0 is ESM, so Node's CommonJS interoperability produces a namespace rather than the callable default export. The test process exits unsuccessfully, making the required CI test command fail. See the regression check.Example: With Node 22 supporting
require(esm),const d = require('decode-uri-component'); d('%FF')invokes a namespace object and throws instead of returning%FF.Recommended fix: Update the regression check to use the package's default export through
import()in the spawned process; keep checking the malformed-input behavior. If CommonJS compatibility is required elsewhere, retain a compatible version or supply a CommonJS adapter.Was this helpful? React with 👍 or 👎 to provide feedback.