qlik-oss / enigma.js / 31159718657

95%

push

github

fix(security): upgrade scriptappy toolchain to @scriptappy/* packages (#1067)

Replaces the abandoned scriptappy-from-jsdoc@0.7.0 / scriptappy-tools
chain (last published 2019, no upstream fix available for its bundled
jsdoc@3.6.11, taffydb, old markdown-it/linkify-it, old fast-glob/
micromatch/braces, and fast-json-patch -- the remaining high-severity
alerts explicitly left unresolved in #1066) with the actively
maintained @scriptappy/cli + @scriptappy/from-jsdoc, matching the
versions nebula.js already runs (@scriptappy/cli@0.10.6,
@scriptappy/from-jsdoc@0.19.6). `npm audit` now reports 0
vulnerabilities.

The new tool depends on our existing jsdoc@4.0.5 directly and modern
fast-glob@^3/chokidar@5/fast-json-patch@3.1.1 -- no more legacy chain.

Config changes:
- `scriptappy` script now runs `sy from-jsdoc -c ./spec.config.js`
  instead of piping `jsdoc -X` into the old CLI.
- spec.config.js nests the existing options under a `fromJsdoc` key,
  which the new CLI expects (the old flat shape still works but logs
  a deprecation warning).

Two real incompatibilities surfaced while regenerating docs/api-spec.json,
both fixed at the source-comment level rather than by patching the tool:

- `{*}` ("any" type) crashes @scriptappy/from-jsdoc@0.19.6: its
  catharsis-node deconstruction never handles the `AllLiteral` node,
  so parsing throws deep in a code path with no undefined-guard.
  Switched the 7 affected @param/@returns tags (api-cache.js,
  key-value-cache.js, schema.js) to the equivalent `{any}`, which
  parses via the NameExpression path and isn't affected.
- `@typedef {Object} SenseConfiguration` (sense-utilities.js) silently
  lost all of its @property documentation: augmentObject() only
  expands properties when the parsed type is the lowercase literal
  'object', so the capitalized `{Object}` convention we'd used fell
  through to a bare alias with no fields. Changed to `{object}` --
  confirmed via diff against the previous spec that every prop... (continued)

384 of 410 branches covered (93.66%)

Branch coverage included in aggregate %.

596 of 620 relevant lines covered (96.13%)

155.86 hits per line