decentraland / transactions-server / 25742400568

70%

master: 70%

Build Type

Pull #138

github

Committed by cyaiox

Commit Message

fix: address PR review — Docker prod prune, TS to devDeps, ajv ReDoS fix

PR #138 review:

- Dockerfile: replace deprecated `npm ci --only=production` (ignored by
  npm 11 / Node 24) with `npm ci --omit=dev`, so the final image no
  longer silently ships every devDependency.
- package.json: move `typescript` from dependencies to devDependencies.
  It is only needed at compile time; combined with the Docker fix above
  it stops shipping to the production image.
- package.json: bump `ajv` from 8.12.0 to 8.20.0 to pull in the fix for
  GHSA-2g4f-4pwh-qvx6 (ReDoS via the `$data` option). This service
  validates user-supplied transaction payloads with ajv.

Pull Request Pull Request #138: chore: upgrade Node 24 / ESLint 9 / Prettier 3 toolchain and pin non-DCL deps

Coverage Stats

120 of 193 branches covered (62.18%)

Branch coverage included in aggregate %.

30 of 48 new or added lines in 19 files covered. (62.5%)

3 existing lines in 3 files now uncovered.

582 of 809 relevant lines covered (71.94%)

7.07 hits per line