Skip to content

fix(deps): remove autochecker, update mocha, add CI#55

Merged
atomantic merged 2 commits intomasterfrom
fix/security-alerts-ci-2
Mar 8, 2026
Merged

fix(deps): remove autochecker, update mocha, add CI#55
atomantic merged 2 commits intomasterfrom
fix/security-alerts-ci-2

Conversation

@atomantic
Copy link
Owner

Summary

  • Remove unmaintained autochecker devDependency — source of 6 Dependabot alerts (tar-fs ×3, minimist ×1, shelljs ×2, lodash ×1)
  • Update mocha from ^9 to ^11 (already installed at 11.7.5, pinning was stale)
  • Fix test script to use mocha from PATH instead of hardcoded ./node_modules/ path
  • Add GitHub Actions CI workflow testing on Node 18, 20, 22

Alert Resolution

Alert Package Resolution
#16 (critical) minimist Removed with autochecker
#21, #22, #25 (high) tar-fs Removed with autochecker
#4, #5 (high/med) shelljs Removed with autochecker
#30 (medium) lodash Removed with autochecker
#35 (high) serialize-javascript Upstream mocha issue, no fix available yet
#36 (medium) serialize-javascript Upstream mocha issue
#39 (high) minimatch Upstream mocha issue
#27 (medium) js-yaml Already at patched version 4.1.1
#13 (high) ansi-regex Already at patched version 5.0.1

8 of 12 alerts resolved directly. Remaining 3 are transitive mocha deps with no upstream fix, and 1 should auto-dismiss (already patched).

- Remove unmaintained autochecker devDependency (source of 6 Dependabot
  alerts: tar-fs, minimist, shelljs, lodash)
- Update mocha from ^9 to ^11 and fix test script path
- Replace nodeversions script with test:ci
- Add GitHub Actions CI workflow (Node 18/20/22)
@atomantic atomantic merged commit 89b6768 into master Mar 8, 2026
2 of 4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant