Skip to content

Bump mocha to 11.8.0 to remove nanoid, add Node 24 to CI - #155

Open
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/multi-65b1dc075c
Open

Bump mocha to 11.8.0 to remove nanoid, add Node 24 to CI#155
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/multi-65b1dc075c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 3, 2026 •
edited by tudorpavel
Loading

Copy link
Copy Markdown
Contributor

New PR

Removes nanoid, which was pinned to the vulnerable 3.3.3 by mocha 10.2.0. Mocha dropped the dependency in 10.8.2, so bumping mocha is the fix.

Dependabot originally bumped mocha to 12.0.0 because package.json declared "mocha": "" (any version), so it moved the lockfile to the latest major. Mocha 12 requires Node ^20.19.0 || >=22.12.0 and is ESM internally, which failed the Node 18 job at npm install. We want to keep testing on Node 18 for now, so this PR instead pins "mocha": "^11" (11.8.0, supports Node ^18.18.0, also nanoid-free) and regenerates the lockfile on top of main. Every lockfile change is inside mocha's own dependency subtree. Node 24 is added to the test matrix to match release.yml, and AGENTS.md gains a note on keeping resolved URLs canonical when the lockfile is regenerated behind a registry proxy.

Verified locally on Node 18, 20, 22, 24 and the current latest (26): 249 tests passing via both mocha and nyc mocha, eslint clean. npm audit goes from 17 to 15 findings with nothing new. Cleared: all four nanoid advisories, mocha's minimatch copy, braces, brace-expansion 2.x and the serialize-javascript XSS advisory. The remaining serialize-javascript advisories need 7.x, which declares Node 20+, and only affect mocha's parallel mode, which this repo does not use.

No public release needed: mocha and nyc are devDependencies, the published package's runtime dependencies (retry, superagent, uri-templates) are unchanged, and package-lock.json is not shipped to consumers.

Old PR (commit f2c4dd9)

Removes nanoid. It's no longer used after updating ancestor dependency mocha. These dependencies need to be updated together.

Removes nanoid

Updates mocha from 10.2.0 to 12.0.0

Release notes

Sourced from mocha's releases.

v12.0.0

12.0.0 (2026-08-31)

🩹 Fixes

  • fixup parsing negative numbers and quoted strings (#6250) (2962875)
  • preserve FIFO descriptors when respawning (#6254) (3bb317d)

📚 Documentation

🧹 Chores

v12.0.0-rc.6

12.0.0-rc.6 (2026-08-09)

🩹 Fixes

  • deps: update dependency starlight-blog to ^0.28.0 (#6153) (6b79044)
  • docs: restore homepage logo (#6183) (06e81a8)
  • docs: restore spacing around footer links (#6185) (163d751)
  • use main instead of exports for the package entry point (#6193) (c32a696)

📚 Documentation

  • blog: add community contributions post (#6172) (5fcc0fe)
  • blog: update community-contributions to 2026-community-sponsorships (5462d84)
  • fix blog/2026-community-sponsorships description (#6177) (98c4746)
  • sync CLI docs with v12 options and defaults (#6140) (579fd15)

🧹 Chores

  • deps: update dependency @​playwright/test to v1.62.1 (#6197) (dcc539a)
  • deps: update dependency eslint to v10.8.0 (#6196) (deeeec6)
  • deps: update dependency globals to v17.9.0 (#6201) (c2c6d63)
  • deps: update dependency knip to v6.31.0 (#6166) (b7cd1bd)
  • deps: update dependency sinon to v22.1.0 (#6188) (284f0c2)
  • deps: update dependency webpack to v5.109.2 (#6194) (badf733)
  • extract stripLeadingDashes helper + cover CLI arg-parsing edge cases (#6171) (867e175)
  • fix esm-utils tests when run without coverage (#6160) (c54539f)

... (truncated)

Changelog

Sourced from mocha's changelog.

12.0.0 (2026-08-31)

🩹 Fixes

  • fixup parsing negative numbers and quoted strings (#6250) (2962875)
  • preserve FIFO descriptors when respawning (#6254) (3bb317d)

📚 Documentation

🧹 Chores

12.0.0-rc.6 (2026-08-09)

🩹 Fixes

  • deps: update dependency starlight-blog to ^0.28.0 (#6153) (6b79044)
  • docs: restore homepage logo (#6183) (06e81a8)
  • docs: restore spacing around footer links (#6185) (163d751)
  • use main instead of exports for the package entry point (#6193) (c32a696)

📚 Documentation

  • blog: add community contributions post (#6172) (5fcc0fe)
  • blog: update community-contributions to 2026-community-sponsorships (5462d84)
  • fix blog/2026-community-sponsorships description (#6177) (98c4746)
  • sync CLI docs with v12 options and defaults (#6140) (579fd15)

🧹 Chores

  • deps: update dependency @​playwright/test to v1.62.1 (#6197) (dcc539a)
  • deps: update dependency eslint to v10.8.0 (#6196) (deeeec6)
  • deps: update dependency globals to v17.9.0 (#6201) (c2c6d63)
  • deps: update dependency knip to v6.31.0 (#6166) (b7cd1bd)
  • deps: update dependency sinon to v22.1.0 (#6188) (284f0c2)
  • deps: update dependency webpack to v5.109.2 (#6194) (badf733)
  • extract stripLeadingDashes helper + cover CLI arg-parsing edge cases (#6171) (867e175)
  • fix esm-utils tests when run without coverage (#6160) (c54539f)
  • keep stderr out of the JSON parsed by the FIFO test (#6187) (ea6489e)
  • limit token perms in protect-manifest workflow (#6175) (8cf0030)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mocha since your current version.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 3, 2026
@socket-security

socket-security Bot commented Sep 3, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednpm/​mocha@​10.2.0 ⏵ 11.8.097 +110095 +197 +2100

View full report

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-65b1dc075c branch from f2c4dd9 to 5a0605e Compare September 3, 2026 11:41
@tudorpavel tudorpavel changed the title Bump nanoid and mocha Bump mocha to 11.8.0 to remove nanoid, add Node 24 to CI Sep 3, 2026
@tudorpavel
tudorpavel force-pushed the dependabot/npm_and_yarn/multi-65b1dc075c branch from 5a0605e to edcdc6e Compare September 3, 2026 13:33
@socket-security

socket-security Bot commented Sep 3, 2026 •
edited
Loading

Copy link
Copy Markdown

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

  • npm/yargs@17.7.3

View full report

@tudorpavel
tudorpavel force-pushed the dependabot/npm_and_yarn/multi-65b1dc075c branch from edcdc6e to 50a3125 Compare September 3, 2026 13:53
@tudorpavel

tudorpavel commented Sep 3, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm yargs is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package-lock.json → npm/mocha@11.8.0 → npm/yargs@17.7.3

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

_Mark the package as acceptable risk_. To ignore this alert only
in this pull request, reply with the comment
`@SocketSecurity ignore npm/yargs@17.7.3`. You can
also ignore all packages with `@SocketSecurity ignore-all`.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the [triage state of this alert](https://socket.dev/dashboard/org/chartmogul/diff-scan/59ea6118-b274-40a7-8b09-6f553592f35e/alert/Qmo56ROUEDr29epVtN63QTx0gkldyZj4kfUjmt1GfWas).

View full report

Socket's "obfuscated code" alert on yargs 17.7.3 is the terser-minified build/index.cjs that every yargs 17.x release ships (see rollup.config.cjs upstream). Platform already depends on yargs 17.7.2 with the same bundle. I verified 17.7.3 against 17.7.2: the npm publish commit matches the upstream v17.7.3 tag signed off by the maintainer, the file changes match PR yargs/yargs#2514 (new yargs.cjs entry point for Node 25.7+/26), and the bundle differs only by a tslib helper reference and minifier renames, with no new requires, network calls, or install scripts. Accepting as a false positive.

Since the same alert will fire for platform and for every future PR touching yargs 17.x, Claude says it is worth asking @polis80cy or who owns the Socket dashboard to triage yargs there rather than ignoring it PR by PR.

@tudorpavel

tudorpavel commented Sep 3, 2026

Copy link
Copy Markdown

@SocketSecurity ignore npm/yargs@17.7.3

@tudorpavel

tudorpavel commented Sep 3, 2026 •
edited
Loading

Copy link
Copy Markdown

I replaced Dependabot's commit rather than adding to it. Mocha 12 needs Node 20.19+ and broke the Node 18 job, which we still want to keep green for now, so I pinned mocha to ^11 (11.8.0) instead. That version already has no nanoid dependency, so the original security fix still lands. I also added Node 24 to the test matrix to match release.yml and documented how to keep lockfile resolved URLs canonical when regenerating it behind a registry proxy. Ran the suite locally on Node 18, 20, 22, 24 and 26: all green. Nothing here touches the published package, so no release needed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ya-petrov-evgeniy ya-petrov-evgeniy Awaiting requested review from ya-petrov-evgeniy

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@tudorpavel