chore(onda-12.1): bump jsdom 20 → 29 (fecha 3 vulns NPM)#205
Conversation
Fecha 3 vulnerabilidades low: - @tootallnate/once <3.0.1 (GHSA-vpq2-c234-7xj6) - http-proxy-agent 4.0.1-5.0.0 (via @TooTallNate) - jsdom <22 (via http-proxy-agent) jsdom@29 traz CSS selector engine novo (@asamuzakjp/dom-selector), undici v7, e exige Node 20.19+ ou 22.13+ (já preparado em Sub 12.0). Validação local (smokes): - tests/utils/price-freshness.test.ts: 9/9 passed - tests/components/CloudStatusBanner.test.tsx: 11/11 passed - tests/hooks/usePasswordBreachCheck.test.tsx: 5/5 passed (crypto.subtle + fetch) npm audit: 5 → 2 vulnerabilidades (apenas esbuild + vite moderate restam, serão fechadas em Sub 12.2 e 12.3).
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
WalkthroughAtualização simples da versão do jsdom no package.json de ^20.0.3 para ^29.1.1. Mudança isolada em uma única linha que afeta apenas a versão declarada da dependência. ChangesAtualização de dependência jsdom
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~5 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Pull request overview
Bumps jsdom from ^20.0.3 to ^29.1.1 to close 3 of 5 npm audit vulnerabilities (@tootallnate/once, http-proxy-agent, jsdom). The change is limited to package.json and package-lock.json; node engine and polyfills already satisfy the new requirements (Sub 12.0/PR #203).
Changes:
- Update
jsdomdirect dependency from^20.0.3to^29.1.1. - Refresh transitive dependency tree in
package-lock.json(new@asamuzakjp/*,@csstools/*,undici@7,whatwg-url@16,tough-cookie@6, etc.; removesnwsapi,abab,domexception,form-data,http-proxy-agent,https-proxy-agent,@tootallnate/once, etc.).
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| package.json | Bumps jsdom devDependency to ^29.1.1. |
| package-lock.json | Regenerated lockfile reflecting the jsdom 29 dependency tree and updated root engines field. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@package.json`:
- Line 142: The package.json engines.node range must be tightened to match
jsdom@29.1.1's minimum supported Node versions; update the engines.node semver
(the "engines.node" field) from ">=22.12.0" to ">=22.13.0 || ^20.19.0" (or the
equivalent ordered semver string "^20.19.0 || >=22.13.0") so the declared Node
requirement aligns with jsdom@^29.1.1 and prevents installs on unsupported Node
22.12.x.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: ae266d68-64be-43b4-b7ff-d8c961099c5d
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json,!**/package-lock.json
📒 Files selected for processing (1)
package.json
| "input-otp": "^1.2.4", | ||
| "jest-axe": "^10.0.0", | ||
| "jsdom": "^20.0.3", | ||
| "jsdom": "^29.1.1", |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Engine declarado no package.json:"
python - <<'PY'
import json
with open("package.json", "r", encoding="utf-8") as f:
pkg = json.load(f)
print(pkg.get("engines", {}).get("node"))
PY
echo
echo "Engine exigido por jsdom@29.1.1 (registry npm):"
python - <<'PY'
import json, urllib.request
with urllib.request.urlopen("https://registry.npmjs.org/jsdom/29.1.1", timeout=20) as r:
data = json.load(r)
print(data.get("engines", {}).get("node"))
PYRepository: adm01-debug/Promo_Gifts
Length of output: 2772
🌐 Web query:
jsdom 29.1.1 npm node version requirements engines
💡 Result:
jsdom 29.1.1 requires Node.js ^20.19.0 || ^22.13.0 || >=24.0.0, as specified in its package.json "engines" field.[1][2][3] This requirement was established starting from v27.0.1 via dependency updates, made explicit in subsequent releases including v29.0.0 which updated the minimum v22 to 22.13.0,[4][5][6] and remains the same for patch releases like 29.1.1. The project's README and multiple sources confirm to check the package.json engines field for exact Node.js compatibility.[1][7][8]
Citations:
- 1: https://npmx.dev/package/jsdom/v/%5E29.0.2
- 2: https://github.com/jsdom/jsdom/releases/tag/v27.0.1
- 3: jsdom/jsdom@v28.1.0...v29.0.1
- 4: https://github.com/jsdom/jsdom/releases/tag/v29.0.0
- 5: https://github.com/jsdom/jsdom/releases
- 6: jsdom/jsdom@00522ce
- 7: https://www.npmjs.com/package/jsdom
- 8: https://github.com/jsdom/jsdom
Alinhar engines.node ao requisito mínimo real do jsdom@29.1.1.
Com a mudança da Line 142 para jsdom@^29.1.1, o projeto passa a exigir Node ^20.19.0 || >=22.13.0, mas a Line 188 ainda permite >=22.12.0. Isso vai aceitar uma versão de Node que jsdom não suporta e quebrar install/test em CI ou localmente em Node 22.12.x.
🔧 Ajuste sugerido
"engines": {
- "node": "^20.19.0 || >=22.12.0",
+ "node": "^20.19.0 || >=22.13.0",
"npm": ">=10.0.0"
}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@package.json` at line 142, The package.json engines.node range must be
tightened to match jsdom@29.1.1's minimum supported Node versions; update the
engines.node semver (the "engines.node" field) from ">=22.12.0" to ">=22.13.0 ||
^20.19.0" (or the equivalent ordered semver string "^20.19.0 || >=22.13.0") so
the declared Node requirement aligns with jsdom@^29.1.1 and prevents installs on
unsupported Node 22.12.x.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 2 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="package.json">
<violation number="1" location="package.json:142">
P2: This jsdom upgrade introduces a Node engine mismatch: project engines allow Node 23.x, but jsdom 29 does not. Align the project Node range with jsdom’s supported range to avoid install/runtime incompatibility in Node 23 environments.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.
| "input-otp": "^1.2.4", | ||
| "jest-axe": "^10.0.0", | ||
| "jsdom": "^20.0.3", | ||
| "jsdom": "^29.1.1", |
There was a problem hiding this comment.
P2: This jsdom upgrade introduces a Node engine mismatch: project engines allow Node 23.x, but jsdom 29 does not. Align the project Node range with jsdom’s supported range to avoid install/runtime incompatibility in Node 23 environments.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At package.json, line 142:
<comment>This jsdom upgrade introduces a Node engine mismatch: project engines allow Node 23.x, but jsdom 29 does not. Align the project Node range with jsdom’s supported range to avoid install/runtime incompatibility in Node 23 environments.</comment>
<file context>
@@ -139,7 +139,7 @@
"input-otp": "^1.2.4",
"jest-axe": "^10.0.0",
- "jsdom": "^20.0.3",
+ "jsdom": "^29.1.1",
"jspdf": "4.2.1",
"jspdf-autotable": "5.0.7",
</file context>
📋 Subonda 12.1 do Plano de Hardening Pré-Prod (Onda 12)
Atualiza
jsdomde^20.0.3para^29.1.1, fechando 3 das 5 vulnerabilidades NPM detectadas em main.🔓 Vulnerabilidades fechadas
npm audit: 5 vulns → 2 vulns (-3)
🎯 Vulnerabilidades restantes (alvo das próximas subondas)
📦 Mudanças transitivas (50 pacotes alterados)
nwsapiremovido (CSS selector engine antigo)@asamuzakjp/dom-selectoradicionado (novo CSS selector engine)undiciv7 (modern fetch — substitui fetch jsdom-side)whatwg-urlv16 (era 11)parse5v8,lru-cachev11@asamuzakjp/css-color,@asamuzakjp/generational-cache✅ Pré-requisitos satisfeitos
jsdom@29exige Node^20.19 || >=22.13— já garantido pela Sub 12.0 (PR Hardening/onda 12 0 bump node engine #203)vitest@3aceitajsdom: '*'— peer dep OK@vitejs/plugin-react-swc@4aceitavite ^4..^8— sem upgrade necessáriotests/setup.tsjá tem polyfills defensivos (matchMedia, IntersectionObserver, ResizeObserver, scrollTo)fetch()agora é nativo do Node (undici v7), não mais jsdom-sideENOTFOUNDao invés de mockBoolean(URL && KEY)).env.localcom URL fake (https://x.supabase.co) causaria fetch errors — mas.env.localestá no.gitignoree não afeta CI🔍 Análise de risk surface
Pre-flight check identificou risk surface BAIXO:
📈 Próximas Subondas
vite@5 → 6vite@6 → 7npm auditzerado + docsDecisão arquitetural: pararemos em
vite@7. Ovite@8substitui Rollup por Rolldown (beta) e removerollupOptions, o que seria mudança maior.Branch:
hardening/onda-12-1-jsdom-29Base:
main(dc00e4635— Sub 12.0 mergeada)Diff: +363/-411 (package.json + package-lock.json apenas)
Summary by cubic
Upgrade
jsdomfrom^20.0.3to^29.1.1to close 3 NPM vulnerabilities and align with Node 20.19+/22.13+. npm audit drops from 5 to 2 remaining issues (esbuild,vite) queued for the next sub-ondas.Dependencies
@asamuzakjp/dom-selectorandcss-tree.undici@7; removedhttp-proxy-agentand@tootallnate/once.whatwg-url@16,parse5@8,lru-cache@11,tough-cookie@6.jsdom@29now requires Node^20.19 || ^22.13 || >=24(already satisfied).Migration
fetch()is now Node-native (Undici). Invalid or fake URLs may error with ENOTFOUND..env.localto avoid real DNS lookups.Written for commit c0ea36d. Summary will update on new commits.
Summary by CodeRabbit