chore: migrate to pnpm, bump Node matrix to 22/24/26, fix audit vulns - #238
Conversation
🦋 Changeset detectedLatest commit: 4402360 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
Bruno Rafael (aNickPlx)
left a comment
Bruno Rafael (aNickPlx)
left a comment
There was a problem hiding this comment.
Approved pending removal of uuid package
| msgpackr-extract: false | ||
| minimumReleaseAgeExclude: | ||
| - serialize-javascript@7.0.3 || 7.0.5 | ||
| - uuid@11.1.1 |
There was a problem hiding this comment.
remove usage of vulnerable uuid package
0856e9e to
71f3f9a
Compare
Bruno Rafael (aNickPlx)
left a comment
Bruno Rafael (aNickPlx)
left a comment
There was a problem hiding this comment.
Approving contingent on the fixing of the merge conflict 😇
- Migrate package manager from npm to pnpm 11.9.0: add packageManager field, replace package-lock.json with pnpm-lock.yaml, convert all workflows to pnpm/action-setup + `pnpm install --frozen-lockfile`, `pnpm publish --no-git-checks` (preserves OIDC trusted publishing), and update husky hook + CONTRIBUTING. - Add flake.nix/flake.lock providing a pinned Node.js + pnpm 11.9.0 dev shell (`nix develop`). - Update CI Node matrix from 18/20/22 to 22/24/26 (18/20/23/25 are EOL). - `pnpm audit --fix`: 0 vulnerabilities. Overrides for js-yaml, serialize-javascript and uuid consolidated into pnpm-workspace.yaml (the stale package.json js-yaml@4.1.1 pin was itself flagged). - Regenerate ssl-cert-snakeoil fixture as 2048-bit; the old 1024-bit key is rejected by modern OpenSSL (ERR_SSL_EE_KEY_TOO_SMALL), which had broken the HttpsProxyAgent suite on current Node (now 208 passing). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
`pnpm run test:filter attestGA` hangs indefinitely when launched under LD_PRELOAD=libfaketime (CI log shows apt-get completing, then 30 min of silence in the test command). pnpm is a heavier Node process than the npm it replaced and deadlocks under faked time. Invoke the mocha binary directly so only the test process is wrapped by libfaketime. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* chore: remove dead code and reclassify test-only dependencies Delete unused internal modules that were unreachable from the public API: - lib/core/labs.js + lib/core/labs/index.js (legacy `proxy-cage` helper) - lib/utils/dataHelper.js (imported `big.js`, which was never a declared dependency, and was referenced nowhere) - lib/utils/environment.js (legacy Function env-var extraction, unused) Move `crc-32` and `uuid` to devDependencies since they are only used by the test suite, not by lib/. Remove the leftover EV_CAGE_RUN_URL reference from the config test (the env var no longer exists in config). Test baseline unchanged: 204 passing (the 5 pre-existing proxy.test.js failures are environmental and unrelated to this change). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011HwoTRLdV2YMub47j88mv5 * feat!: convert SDK to TypeScript with a dual ESM/CJS build (#243) * feat!: convert SDK to TypeScript with a dual ESM/CJS build Rewrite the SDK source (lib/*.js -> lib/*.ts) in strict TypeScript, preserving runtime behaviour and the on-the-wire encryption formats exactly. Only module syntax and type annotations changed; the public API is identical. Build & packaging: - Add tsconfig.json (strict) and build with tsup to dist/ as dual ESM (index.mjs) + CommonJS (index.js) with bundled .d.ts. - Point package "main"/"module"/"types"/"exports" at dist and ship only dist; drop the tsc-based generate-types step. - keepNames so error `type`/constructor names are preserved. - require('@evervault/sdk') still returns the EvervaultClient class; `import Evervault from '@evervault/sdk'` works for ESM consumers. Types & internals: - Fold the hand-written types.d.ts / domainTargets.d.ts into source types; monkey-patched Node core modules use default imports so the mutable module.exports is patched (works in both CJS and ESM). Tests & CI: - Run the existing mocha suite against the TS source via tsx and replace rewire (incompatible with compiled TS) with proxyquire / shared-singleton config mutation. 204 passing, unchanged from the JS baseline (the 5 proxy.test.js failures are pre-existing and environmental). - Add typecheck + build steps to CI; bump CodeQL to v3 with the javascript-typescript language. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011HwoTRLdV2YMub47j88mv5 * fix: don't clobber global https.request from non-relay clients; inject config in sdk tests CI ran the suite against the real network and surfaced two test-infra regressions from the TS migration that the local sandbox hid: - EvervaultClient's constructor called `_shouldOverloadHttpModule`, whose else-branch unconditionally ran `https.request = originalRequest`. On every non-relay client this reset the global `https.request`, removing nock's interception (nock doesn't re-patch once "active"), which cascaded failures across client/http test files. Guard the restore so it only runs when this process actually overloaded `https.request` for Relay. This is also more correct: a plain client no longer disables another client's outbound Relay. - sdk.test.js pointed the client at its mock server by mutating the config singleton. Under tsx the module-cache timing made that unreliable, so the client hit the real API. Inject the mutated config into the client with proxyquire (`{ './config': config }`), mirroring the old rewire `__set__`. Local suite unchanged (204 passing; the 5 proxy.test.js failures are environmental to this sandbox). Verified the guard preserves nock's patch and that config injection reaches the client. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011HwoTRLdV2YMub47j88mv5 * test: run the suite against compiled CJS under plain Node instead of tsx The nock-based tests passed locally but failed in CI only. Running the suite through tsx (on-the-fly TS transpilation with a custom module loader) interacted with nock/axios HTTP interception differently on the CI runners, so requests bypassed nock and hit the network. Compile lib/*.ts to CJS with `tsc -p tsconfig.build.json` and run mocha against the emitted JS under plain Node — the same execution model the JavaScript suite used before the TypeScript migration. The compiled lib/*.js are build artifacts (git- and prettier-ignored); tsup still builds the published dual-format bundle from the .ts sources, and `tsc --noEmit` still type-checks. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011HwoTRLdV2YMub47j88mv5 * fix: stop mocharc spec from pulling the unit suite into the e2e run Mocha concatenates the `spec` from `.mocharc.json` with any CLI positional file arguments rather than letting the CLI override it. The `test:e2e` script (run by the `e2e.yml` workflow) invokes `mocha 'e2e/**/*.test.js'`, so once `.mocharc.json` declared `spec: tests/**`, that job silently ran the entire unit suite alongside the e2e tests. The e2e tests run first, call `enableOutboundRelay()` which monkey-patches the global `https.request`, and that leaves nock unable to intercept the unit tests — producing the CI-only failures. Keep only `timeout` in `.mocharc.json` and pass the unit spec explicitly on the CLI in `test` / `test:filter`, so each mocha invocation resolves exactly one suite (matching the pre-TypeScript setup). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011HwoTRLdV2YMub47j88mv5 * feat: infer real types across the SDK, replacing any at the public API Give consumers precise types instead of `any` on the client surface: - encrypt<T> returns EncryptedData<T>, preserving input shape (objects keep their keys with encrypted string leaves, Buffers stay Buffers, primitives become strings) and rejecting non-encryptable inputs - decrypt<T>, run<T> (-> FunctionRunResult<T>), createRunToken (-> RunToken) and createClientSideDecryptToken (-> ClientSideToken) now carry real types - hidden ECDH fields typed as Buffer / crypto.ECDH / NodeJS.Timeout Internally, export a reusable HttpClient type and thread it through attestationDoc/relayOutboundConfig/httpsHelper; type the PCR store, the attestation helpers, and the key/token/relay response shapes. Also make Http.getAppKey throw mapResponseCodeToError on non-2xx (mirroring getCageKey) instead of returning undefined and crashing downstream. Genuinely dynamic/vendored surfaces (crypto key material that is Buffer|string, the agent-base subclass, the asn1js DER encoder, the https.request/tls monkeypatch paths) are left untyped with rationale comments. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix: raise e2e mocha timeout to 30s to absorb httpbin latency The two path-filtering outbound-relay tests each make two httpbin.org requests; the 5s timeout was too tight for slow-but-reachable httpbin, causing intermittent timeouts. Align with the .mocharc.json default (30s). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Format and fix * Rename lint to format --------- Co-authored-by: Claude <noreply@anthropic.com> * Remove uuid dependency and cleanup changelog --------- Co-authored-by: Claude <noreply@anthropic.com>
…JS consumers
`build:test` compiled every `lib/**/*.ts` to a `.js` sibling so mocha could
require the sources under plain Node, which meant carrying `lib/**/*.js`
ignore rules in both .gitignore and .prettierignore to hide the emitted
files. Run the suite directly against the TypeScript instead, via the tsx
loader in .mocharc.json. `tsup` remains the only thing that emits, into the
already-ignored `dist/`, so no compiled JS lands in `lib/` at all.
Also fixes a packaging regression the rewrite introduced. The runtime is
`module.exports = EvervaultClient`, but tsup's dts rollup emitted
`export { EvervaultClient as default }`, so `new Evervault(...)` failed to
type-check for consumers with TS2351 "not constructable" — the previous
`tsc`-generated `types/` correctly emitted `export = EvervaultClient`.
`cjsInterop` restores that form for the CJS declaration while leaving the
`.d.mts` as a default export, and the `exports` map now nests `types` under
each condition so ESM consumers stop resolving the CJS declaration.
Verified against a packed tarball: CJS require, ESM import, and declaration
resolution under node, node16, and bundler.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
71f3f9a to
4402360
Compare
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
4 participants
Summary
Migrates the repo from npm to pnpm 11.9.0, refreshes the CI Node matrix to 22 / 24 / 26, and clears all
pnpm auditfindings. Also adds a Nix flake for a reproducible dev toolchain.Changes
npm → pnpm
packageManager: "pnpm@11.9.0"; replacepackage-lock.jsonwithpnpm-lock.yaml.pnpm/action-setup@v4(beforesetup-node, withcache: 'pnpm') andpnpm install --frozen-lockfile.pnpm publish --no-git-checks(the--no-git-checksreplaces npm's lack of branch checks, since the publish job runs on a detached tag). The existing OIDC trusted publishing flow is preserved — pnpm 11.9.0 includes the fix from pnpm#11526 (merged 15 May 2026, before the 11.9.0 release) that drops the unresolved${NODE_AUTH_TOKEN}placeholder and falls back to OIDC.CONTRIBUTING.mdupdated to pnpm.Nix flake
flake.nix/flake.lockprovide a pinned Node.js + pnpm 11.9.0 dev shell (nix develop). Contributors without Nix can use Corepack (pinned via thepackageManagerfield).Node matrix
18, 20, 22→22, 24, 26. Dropped versions are all EOL (18, 20 since Mar 2026; 23, 25 also EOL). 22 & 24 are Active LTS, 26 is Current.pnpm audit --fixpnpm-workspace.yaml(pnpm's native location, whereaudit --fixwrites). The oldpackage.jsonoverrideswere removed — itsjs-yaml@4.1.1pin had itself become the flagged vulnerable version; the lodash override was carried over.Test/CI fixes required for green CI on current Node
tests/utilities/ssl-cert-snakeoil.{key,pem}as a 2048-bit self-signed cert (was 1024-bit, expired Jul 2025). Modern OpenSSL rejects the 1024-bit key withERR_SSL_EE_KEY_TOO_SMALL, which broke theHttpsProxyAgentbefore allhook and silently disabled ~16 tests. Suite now reports 208 passing (was 190 + 2 failing). Same CN; no test pins its identity.pnpm rununderLD_PRELOAD=libfaketime.pnpm run …hangs indefinitely when launched under libfaketime (CI log showed apt-get completing, then 30 min of silence); pnpm is a heavier Node process than the npm it replaced. Invoking./node_modules/.bin/mocha … --grep attestGAwraps only the test process.Verification — CI green ✅
pnpm install --frozen-lockfile,pnpm run lint,pnpm run test:coverage(208 passing) and the libfaketime attestation step all pass on Node 22, 24 and 26.pnpm run generate-types, andpnpm audit(clean) via the flake.Notes for reviewers
audit --fixhardened the dev tree via overrides (which don't propagate to consumers);dependencies.uuidis intentionally left at^8.1.0. uuid is only used ine2e/({ v4 }, stable v8→v11), never inlib/, so consumers have no real exposure. Bumping/moving uuid todevDependenciesis a reasonable separate follow-up.pnpm publishOIDC path (and provenance) behaves like the previousnpm publish.