Skip to content

[Snyk] Upgrade ava from 3.15.0 to 6.4.1#4

Open
Dustin4444 wants to merge 1 commit intomasterfrom
snyk-upgrade-c64d10da4eb3847cb899d34c7d137af6
Open

[Snyk] Upgrade ava from 3.15.0 to 6.4.1#4
Dustin4444 wants to merge 1 commit intomasterfrom
snyk-upgrade-c64d10da4eb3847cb899d34c7d137af6

Conversation

@Dustin4444
Copy link
Owner

@Dustin4444 Dustin4444 commented Oct 15, 2025

snyk-top-banner

Snyk has created this PR to upgrade ava from 3.15.0 to 6.4.1.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

  • The recommended version is 28 versions ahead of your current version.

  • The recommended version was released 3 months ago.

⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 482 Proof of Concept
high severity Prototype Pollution
SNYK-JS-JSONSCHEMA-1920922		 482 No Known Exploit
high severity Code Injection
SNYK-JS-LODASH-1040724		 482 Proof of Concept
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-AXIOS-1579269		 482 Proof of Concept
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-NORMALIZEURL-1296539		 482 No Known Exploit
high severity Excessive Platform Resource Consumption within a Loop
SNYK-JS-BRACES-6838727		 482 Proof of Concept
high severity Prototype Poisoning
SNYK-JS-QS-3153490		 482 Proof of Concept
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795		 482 Proof of Concept
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795		 482 Proof of Concept
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795		 482 Proof of Concept
high severity Information Exposure
SNYK-JS-SIMPLEGET-2361683		 482 Proof of Concept
high severity Improper Verification of Cryptographic Signature
SNYK-JS-ELLIPTIC-8172694		 482 No Known Exploit
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-ETHERS-1586048		 482 Proof of Concept
high severity Improper Handling of Extra Parameters
SNYK-JS-FOLLOWREDIRECTS-6141137		 482 Proof of Concept
high severity Prototype Pollution
SNYK-JS-INI-1048974		 482 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905		 482 Proof of Concept
medium severity Inefficient Regular Expression Complexity
SNYK-JS-MICROMATCH-6838728		 482 No Known Exploit
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-BABELRUNTIMECOREJS3-9397696		 482 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-MINIMATCH-3050818		 482 No Known Exploit
medium severity Denial of Service (DoS)
SNYK-JS-NWSAPI-2841516		 482 No Known Exploit
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-PATHPARSE-1077067		 482 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-PROMPTS-1729737		 482 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-TRIMOFFNEWLINES-1296850		 482 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-WS-1296835		 482 Proof of Concept
medium severity Information Exposure
SNYK-JS-FOLLOWREDIRECTS-2332181		 482 Proof of Concept
medium severity Information Exposure
SNYK-JS-FOLLOWREDIRECTS-6444610		 482 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-GLOBPARENT-1016905		 482 Proof of Concept
medium severity Open Redirect
SNYK-JS-GOT-2932019		 482 No Known Exploit
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-HOSTEDGITINFO-1088355		 482 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-HTTPCACHESEMANTICS-3248783		 482 Proof of Concept
low severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-BRACEEXPANSION-9789073		 482 Proof of Concept
low severity Prototype Pollution
SNYK-JS-MINIMIST-2429795		 482 Proof of Concept
critical severity Improper Verification of Cryptographic Signature
SNYK-JS-ELLIPTIC-7577916		 482 Proof of Concept
critical severity Improper Verification of Cryptographic Signature
SNYK-JS-ELLIPTIC-7577917		 482 Proof of Concept
critical severity Improper Verification of Cryptographic Signature
SNYK-JS-ELLIPTIC-7577918		 482 Proof of Concept
medium severity Uncontrolled Resource Consumption ('Resource Exhaustion')
SNYK-JS-TAR-6476909		 482 Proof of Concept
low severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-WORDWRAP-3149973		 482 Proof of Concept
critical severity Information Exposure
SNYK-JS-ELLIPTIC-8720086		 482 Proof of Concept
low severity Information Exposure
SNYK-JS-FOLLOWREDIRECTS-2396346		 482 No Known Exploit
Release notes
Package name: ava
  • 6.4.1 - 2025-07-12

    What's Changed

    • Keep test worker alive until explicitly freed by @ matz3 in #3391

    New Contributors

    Full Changelog: v6.4.0...v6.4.1

  • 6.4.0 - 2025-06-07

    What's Changed

    Interactive watch mode filters

    @ mmulet did fantastic work to spearhead interactive watch mode filters. You can now filter test files by glob patterns, and tests by matching their titles. It's just like you already could from the CLI itself, but now without exiting AVA 🚀 #3372

    As part of this work we've removed the "sticky" .only() behavior #3381

    Examples

    We've been remiss in merging #3335 which updates the examples to use AVA 6. It's done now, examples are up to date and it's all due to @ tommy-mitchell 👏

    New Contributors

    Full Changelog: v6.3.0...v6.4.0

  • 6.3.0 - 2025-05-02

    What's Changed

    • Update dependencies, addressing npm audit warnings by @ novemberborn in #3377
    • Do not count writes to stdout/stderr as non-idling activity for timeouts by @ mdouglass in #3374

    New Contributors

    Full Changelog: v6.2.0...v6.3.0

  • 6.2.0 - 2024-10-27

    What's Changed

    • Add filterNodeArgumentsForWorkerThreads option in #3336
    • Add Node.js 23 to supported engines (and test matrix) in #3346

    New Contributors

    Full Changelog: v6.1.3...v6.2.0

  • 6.1.3 - 2024-05-05

    What's Changed

    New Contributors

    Full Changelog: v6.1.2...v6.1.3

  • 6.1.2 - 2024-02-28

    What's Changed

    • Fix throws assertions rejecting falsy values when any: true by @ gibson042 in #3313

    Full Changelog: v6.1.1...v6.1.2

  • 6.1.1 - 2024-01-29

    What's Changed

    Full Changelog: v6.1.0...v6.1.1

  • 6.1.0 - 2024-01-21

    What's Changed

    • Implement registerCompletionHandler() by @ novemberborn in #3283

      AVA 6 expects test code to clean up gracefully when the tests are complete, allowing the test environment (worker thread or child process) to exit. If this does not happen, AVA will report a timeout. You can use registerCompletionHandler() to perform any other clean up (or indeed exit the process) after AVA has completed the test execution. See the description here.

    • Fix potential bug with watch mode when no failed test files are written by @ novemberborn in #3287

    • Fix ava/internal ESM type module by @ codetheweb in #3292

    Full Changelog: v6.0.1...v6.1.0

  • 6.0.1 - 2023-12-06

    What's Changed

    Full Changelog: v6.0.0...v6.0.1

  • 6.0.0 - 2023-12-04

    Breaking Changes

    • AVA now requires Node.js versions 18.18, 20.8 or 21. Versions 14 and 16 are no longer supported. #3251 #3216

    • When tests finish, worker threads or child processes are no longer exited through proces.exit(). If your test file does not exit on its own, the test run will time out. #3260

    • Changes to watch mode #3218:

      • Watch mode can no longer be started via the ava.config.* or package.json configuration.
      • The ignoredByWatcher configuration has moved to the watchMode object, under the ignoreChanges key.
      • Watch mode now uses the built-in fs.watch() in recursive mode. This is supported on Linux in Node.js 20 or newer, and MacOS and Windows in Node.js 18 as well. There are caveats to keep in mind.

    • Failed assertions now throw, meaning that any subsequent code is not executed. This also impacts the type definitions. #3246

    • Only native errors are now considered errors by the t.throws() and t.throwsAsync() assertions. Object.create(Error.prototype) is not a native error. #3229

    • Changes to modules loaded through the require configuration #3184:

      • If such modules export a default function, this function is now invoked.
      • Local files are loaded through @ ava/typescript if necessary.

    Improvements

    Rewritten watcher

    The watcher has been rewritten. It’s now built on fs.watch() in recursive mode.

    @ vercel/nft is used to perform static dependency analysis, supporting ESM and CJS imports for JavaScript & TypeScript source files. This is a huge improvement over the previous runtime tracking of CJS imports, which did not support ESM.

    Integration with @ ava/typescript has been improved. The watcher can now detect a change to a TypeScript source file, then wait for the corresponding build output to change before re-running tests.

    The ignoredByWatcher configuration has moved to the watchMode object, under the ignoreChanges key.

    See #3218 and #3257.

    Failed assertions now throw

    Assertions now throw a TestFailure error when they fail. This error is not exported or documented and should not be used or thrown manually. You cannot catch this error in order to recover from a failure, use t.try() instead.

    All assertions except for t.throws() and t.throwsAsync() now return true when they pass. This is useful for some of the assertions in TypeScript where they can be used as a type guard.

    Committing a failed t.try() result now also throws.

    See #3246.

    t.throws() and t.throwsAsync() can now expect any error

    By default, the thrown error (or rejection reason) must be a native error. You can change the assertion to expect any kind of error by setting any: true in the expectation object:

    t.throws(() => { throw 'error' }, {any: true})

    See #3245 by @ adiSuper94.

    The require configuration is now more powerful

    It now loads ES modules.

    Local files are loaded through @ ava/typescript if necessary, so you can also write these in TypeScript.

    If there is a default export function, it is invoked after loading. The function is awaited so it can do asynchronous setup before further modules are loaded. Arguments from the configuration can be passed to the function (as a [structured clone](https://developer.mozilla.org/en-US/docs/Web/API/structuredClone)).

    See #3184 by @ sculpt0r.

    Other changes worth noting

    • Internal events can now be observed (experimentally). See #3247 by @ codetheweb. It’s experimental and undocumented.
    • You can now use t.timeout.clear() to restore a previous t.timeout(). #3221
    • Code coverage is flushed to disk at opportune moments. #3220

    New Contributors

    Full Changelog: v5.3.1...v6.0.0

  • 5.3.1 - 2023-06-16
  • 5.3.0 - 2023-05-25
  • 5.2.0 - 2023-02-06
  • 5.1.1 - 2023-01-15
  • 5.1.0 - 2022-11-14
  • 5.0.1 - 2022-09-25
  • 5.0.0 - 2022-09-04
  • 4.3.3 - 2022-08-25
  • 4.3.2 - 2022-08-25
  • 4.3.1 - 2022-07-10
  • 4.3.0 - 2022-06-02
  • 4.2.0 - 2022-04-10
  • 4.1.0 - 2022-03-06
  • 4.0.1 - 2022-01-08
  • 4.0.0 - 2022-01-03
  • 4.0.0-rc.1 - 2021-11-01
  • 4.0.0-alpha.2 - 2021-04-06
  • 4.0.0-alpha.1 - 2021-03-21
  • 3.15.0 - 2021-01-01
from ava GitHub release notes

Important

  • Warning: This PR contains a major version upgrade, and may be a breaking change.
  • Check the changes in this PR to ensure they won't cause issues with your project.
  • This PR was automatically created by Snyk using the credentials of a real user.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

@snyk-bot
feat: upgrade ava from 3.15.0 to 6.4.1
241f3e4 
Snyk has created this PR to upgrade ava from 3.15.0 to 6.4.1.

See this package in npm:
ava

See this project in Snyk:
https://app.snyk.io/org/dustin4444/project/35fbc727-b7bf-4ca2-87a4-c1bcb92fdf05?utm_source=github&utm_medium=referral&page=upgrade-pr
@gemini-code-assist
Copy link

gemini-code-assist bot commented Oct 15, 2025

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

@coderabbitai
Copy link

coderabbitai bot commented Oct 15, 2025

Important

Review skipped

Ignore keyword(s) in the title.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch snyk-upgrade-c64d10da4eb3847cb899d34c7d137af6

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Dustin4444 @snyk-bot