External/card-drop
Watch
5
0
Fork
You've already forked card-drop
 0
Code Issues 58 Pull requests Projects 1 Releases 37 Packages Wiki Activity Actions

0.11.0 Dependency Updates #531

New issue
Closed
opened 2026-09-15 18:29:20 +01:00 by Vylpes · 3 comments
Vylpes commented 2026-09-15 18:29:20 +01:00
Owner
Copy link

Investigate what dependencies need updating, update the non-breaking changes, create new tickets for breaking changes and milestone to this release. yarn audit should return 0 vulnerabilities`

Investigate what dependencies need updating, update the non-breaking changes, create new tickets for breaking changes and milestone to this release. `yarn audit` should return 0 vulnerabilities`
Vylpes added this to the 0.11.0 milestone 2026-09-15 18:29:20 +01:00
Vylpes added this to the 0.10 Sprint 4 project 2026-09-23 18:40:18 +01:00
Vylpes self-assigned this 2026-10-04 18:16:53 +01:00
Smithy-bot commented 2026-10-04 18:22:31 +01:00
Member
Copy link

Update

Non-breaking dependency updates are ready on branch feature/531-dependency-updates (commit pending local GPG signing).

Done

  • Upgraded non-breaking deps within current majors (discord.js, axios, jest, typescript-eslint, etc.)
  • Patched typeorm 0.3.28 → 0.3.31 (security)
  • Added/updated yarn resolutions for transitive advisories
  • Vendored temporary [email protected] backport (CVE-2026-93687 / GHSA-vfj7-8cjw-p6xm) until upstream publishes
  • yarn audit → 0 vulnerabilities
  • yarn build, yarn test, yarn lint pass

Breaking-change tickets (milestone 0.11.0)

  • #556 Upgrade dotenv v16 → v18
  • #557 Upgrade eslint v9 → v10
  • #558 Upgrade np v10 → v12
  • #559 Upgrade TypeScript v5 → v7
  • #560 Upgrade @types/node v24 → v26
  • #561 Upgrade @types/uuid v10 → v11
  • #562 Upgrade TypeORM 0.3.x → 1.x
  • #563 Remove vendored braces once upstream publishes a patched release
## Update Non-breaking dependency updates are ready on branch `feature/531-dependency-updates` (commit pending local GPG signing). ### Done - Upgraded non-breaking deps within current majors (discord.js, axios, jest, typescript-eslint, etc.) - Patched `typeorm` `0.3.28` → `0.3.31` (security) - Added/updated yarn resolutions for transitive advisories - Vendored temporary `[email protected]` backport (CVE-2026-93687 / GHSA-vfj7-8cjw-p6xm) until upstream publishes - `yarn audit` → **0 vulnerabilities** - `yarn build`, `yarn test`, `yarn lint` pass ### Breaking-change tickets (milestone **0.11.0**) - #556 Upgrade dotenv v16 → v18 - #557 Upgrade eslint v9 → v10 - #558 Upgrade np v10 → v12 - #559 Upgrade TypeScript v5 → v7 - #560 Upgrade @types/node v24 → v26 - #561 Upgrade @types/uuid v10 → v11 - #562 Upgrade TypeORM 0.3.x → 1.x - #563 Remove vendored braces once upstream publishes a patched release
Vylpes stopped working 2026-10-04 18:31:23 +01:00
14 minutes 24 seconds
Vylpes removed their assignment 2026-10-05 16:39:19 +01:00
Smithy-bot commented 2026-10-07 12:10:54 +01:00
Member
Copy link

QA result: FAIL

Tested release/0.11.0 @ 95cec9a (merged PR #564).

Pass

  • yarn install --frozen-lockfile
  • yarn build (tsc)
  • yarn lint (eslint)
  • yarn test — 28 suites / 120 passed / 30 todo / 9 snapshots

Fail (acceptance: yarn audit → 0 vulnerabilities)

yarn audit reports 9 vulnerabilities (8 moderate, 1 critical):

  1. critical — [email protected] via express (patched in >=2.0.8) — https://www.npmjs.com/advisories/1241210
    Likely fixable with a yarn resolution / bump; not present in current package.json resolutions.
  2. moderate ×8 — [email protected] via jest → istanbul/js-yaml/argparse — https://www.npmjs.com/advisories/1241202
    Audit says no patch available; may need a jest/tooling change or an accepted residual risk ticket.

Moved step/testing → step/todo. Unassigning pending reassignment for the audit remediations.

## QA result: FAIL Tested `release/0.11.0` @ `95cec9a` (merged PR #564). ### Pass - `yarn install --frozen-lockfile` - `yarn build` (tsc) - `yarn lint` (eslint) - `yarn test` — 28 suites / 120 passed / 30 todo / 9 snapshots ### Fail (acceptance: `yarn audit` → 0 vulnerabilities) `yarn audit` reports **9 vulnerabilities** (8 moderate, 1 critical): 1. **critical** — `[email protected]` via `express` (patched in `>=2.0.8`) — https://www.npmjs.com/advisories/1241210 Likely fixable with a yarn resolution / bump; not present in current `package.json` resolutions. 2. **moderate** ×8 — `[email protected]` via `jest` → istanbul/js-yaml/argparse — https://www.npmjs.com/advisories/1241202 Audit says **no patch available**; may need a jest/tooling change or an accepted residual risk ticket. Moved `step/testing` → `step/todo`. Unassigning pending reassignment for the audit remediations.
Smithy-bot removed their assignment 2026-10-07 12:10:54 +01:00
Vylpes commented 2026-10-07 12:16:35 +01:00
Author
Owner
Copy link

Passing anyway, was 0 when I fixed it

Passing anyway, was 0 when I fixed it
Vylpes 2026-10-07 12:16:35 +01:00
  • closed this issue
  • removed the
    step
    todo
         label
Vylpes self-assigned this 2026-10-07 12:16:42 +01:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
release/0.11.0
release/0.12.0
develop
v0.10.1
v0.10.0
v0.9.4
v0.9.3
v0.9.2
v0.9.1
v0.9.0
v0.8.4
v0.8.3
v0.8.2
v0.8.1
v0.8.0
v0.7.0
v0.6.4
v0.6.3
v0.6.2
v0.6.1
v0.6.0
v0.5.2
v0.5.1
v0.5.0
v0.4.2
v0.4.1
v0.4.0
v0.3.1
v0.3.0
v0.2.1
v0.2.0
v0.1.8
v0.1.7
v0.1.6
v0.1.5
v0.1.4
v0.1.3
v0.1.2
v0.1.1
v0.1.0
Labels
Clear labels
  
blocked

   
duplicate
This issue or pull request already exists

  
high priority
  
needs
approval

  
needs
criteria

  
needs
estimate

  
needs
tests

  
question
More information is needed

  
step
doing

  
step
review

  
step
testing

  
step
todo

  
step
uat

  
type
admin

  
type
alert

  
type
bug

  
type
change

  
type
defect

  
type
dependencies

  
type
development

  
type/documentation
  
type
epic

  
type
idea

  
type
incident

  
type
investigation

  
type
spike

  
type
story

  
type
tests

  
wontfix
This won't be fixed

No labels
blocked
duplicate
high priority
needs
approval
needs
criteria
needs
estimate
needs
tests
question
step
doing
step
review
step
testing
step
todo
step
uat
type
admin
type
alert
type
bug
type
change
type
defect
type
dependencies
type
development
type/documentation
type
epic
type
idea
type
incident
type
investigation
type
spike
type
story
type
tests
wontfix
Milestone
Clear milestone
No items
No milestone
0.11.0
Projects
Clear projects
No items
No project
0.10 Sprint 4
Assignees
Clear assignees
No assignees
Vylpes
2 participants
Notifications
Total time spent: 14 minutes 24 seconds
Vylpes
14 minutes 24 seconds
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
External/card-drop#531
No description provided.