qlik-oss / enigma.js / 30890132269

95%

push

github

fix(security): drop unused coveralls and rollup-plugin-filesize devDeps (#1066)

Both packages were dragging in the bulk of the remaining Dependabot
critical/high alerts through unmaintained transitive chains, and
neither is actually used for anything functional:

- coveralls (npm package, not the coverallsapp GitHub Action already
  used in CI) is never invoked anywhere -- its only script/CI/code
  reference is nonexistent. It pulled in the deprecated `request`
  library, source of the critical form-data vulnerability
  (GHSA-fjxv-7rqg-78g4) plus tough-cookie/qs advisories.
- rollup-plugin-filesize only prints a cosmetic bundle-size summary
  after `npm run build`. Every published version of it depends on
  `pacote` (npm's internal registry-fetch stack), which pulled in tar,
  sigstore, node-gyp, @npmcli/run-script, make-fetch-happen,
  npm-registry-fetch and tuf-js -- accounting for most of the
  remaining high-severity alerts.

Removing them takes npm audit from 35 vulnerabilities (3 critical, 23
high) down to 17 (0 critical, 12 high), with no change to build output
or test behavior.

Left unresolved, on purpose: the remaining high alerts (linkify-it,
markdown-it, braces, taffydb, fast-json-patch, cross-spawn/execa/
os-locale) all live inside scriptappy-from-jsdoc@0.7.0 / its
scriptappy-tools@0.5.0 dependency, both stuck at their latest (and
last-ever) published version with no upstream fix. That package is
actively used by `npm run scriptappy` in CI to generate the API spec,
so removing it outright is a behavior change, not a dependency bump --
out of scope here. Also left alone: webpack-dev-server ^2.9.3 in the
car-models example, whose fixed versions require a webpack 5 migration
(breaking, needs code changes to that example).

Lint could not be verified in this environment due to a pre-existing,
unrelated ESLint plugin-resolution clash between nested worktree
node_modules -- reproduces identically on an unmodified checkout.
Build (`npm run buil... (continued)

372 of 400 branches covered (93.0%)

Branch coverage included in aggregate %.

591 of 616 relevant lines covered (95.94%)

156.52 hits per line