thomaspoignant / scim-patch / 34057483533

100%

push

github

build(deps): remove unused coveralls and clear npm audit vulnerabilities (#1170)

npm audit reported 9 vulnerabilities (2 critical, 1 high, 5 moderate,
1 low). All were dev-only: `npm audit --omit=dev` reported 0, so no
published version of scim-patch was ever affected.

Five of them, including both criticals, came from the `coveralls` npm
package pulling in the deprecated `request` (form-data, qs,
tough-cookie, uuid). That package was never invoked: CI uploads
coverage with the coverallsapp/github-action@v2 action, fed by
`npm run coverage`. Removing the devDependency drops the whole subtree.

The remaining three were stale transitive pins, all resolved in-range
by `npm audit fix`:

- semver 6.3.0 -> 6.3.1 (ReDoS, GHSA-c2qf-rxjj-qqgw) via nyc -> make-dir
- diff 4.0.2 -> 4.0.4 (GHSA-73rr-hh4g-fpgx) via ts-node
- istanbul-lib-processinfo 3.0.0 -> 3.0.1, which dropped uuid entirely

No direct dependency version changed and CI needs no edit.
`npm audit` now reports 0 vulnerabilities.

124 of 125 branches covered (99.2%)

Branch coverage included in aggregate %.

249 of 249 relevant lines covered (100.0%)

30.67 hits per line