Skip to content

Restructure example-node into a single calculator app (fixes all Dependabot alerts)#53

Merged
thomasrockhu-codecov merged 1 commit into
mainfrom
th/bump-dependabot-deps
Jul 11, 2026
Merged

Restructure example-node into a single calculator app (fixes all Dependabot alerts)#53
thomasrockhu-codecov merged 1 commit into
mainfrom
th/bump-dependabot-deps

Conversation

@thomasrockhu-codecov

@thomasrockhu-codecov thomasrockhu-codecov commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

Summary

Modernizes example-node to mirror the structure of example-python: a single calculator app with runnable tests, wired up to Codecov via GitHub Actions.

This also resolves all 31 open Dependabot alerts — not by bumping transitive pins, but by removing their source. Every alert came from the deprecated codecov npm uploader (→ teeny-requestuuid/js-yaml, → http-proxy-agent@tootallnate/once) and the abandoned istanbul/old mocha trees. The new stack has 0 vulnerabilities.

Changes

  • App: added app/calculator.js (add/subtract/multiply/divide) and app/calculator.test.js, mirroring example-python.
  • Test + coverage: uses the built-in Node.js test runner (node --test, zero deps) plus c8 for lcov coverage and a JUnit report. npm test runs the suite, writes coverage/lcov.info, and junit.xml.
  • CI: replaced .travis.yml with .github/workflows/ci.yml (checkout → setup-node → install → test → upload coverage/test-results to Codecov, including OIDC).
  • Dependabot: added .github/dependabot.yml for the npm and github-actions ecosystems.
  • Config/docs: added codecov.yml, rewrote README.md, updated .gitignore.
  • Removed: the entire istanbul-mocha/ tree, the deprecated codecov uploader, .travis.yml, and the stray root package-lock.json.

Test plan

  • npm install installs cleanly (c8 only) with 0 vulnerabilities.
  • npm test passes (4 tests) and produces coverage/lcov.info + junit.xml.
  • GitHub Actions runs green and uploads coverage to Codecov.
  • Dependabot re-scan closes all 31 alerts.

Modernize the repository to mirror example-python: a single calculator app
under app/ with runnable tests, using Node's built-in test runner and c8 for
coverage. Removes the outdated istanbul-mocha tree and the deprecated codecov
uploader (which was the source of all 31 Dependabot alerts), drops Travis CI in
favor of GitHub Actions, and adds npm/github-actions Dependabot config.

Co-authored-by: Cursor <cursoragent@cursor.com>
@thomasrockhu-codecov thomasrockhu-codecov changed the title chore(deps): bump istanbul-mocha dependencies to resolve all Dependabot alerts Restructure example-node into a single calculator app (fixes all Dependabot alerts) Jul 11, 2026
@codecov

codecov Bot commented Jul 11, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 90.90909% with 2 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (main@30d57f6). Learn more about missing BASE report.
✅ All tests successful. No failed tests found.

Files with missing lines Patch % Lines
app/calculator.js 90.90% 2 Missing ⚠️
Additional details and impacted files
@@           Coverage Diff           @@
##             main      #53   +/-   ##
=======================================
  Coverage        ?   90.90%           
=======================================
  Files           ?        1           
  Lines           ?       22           
  Branches        ?        0           
=======================================
  Hits            ?       20           
  Misses          ?        2           
  Partials        ?        0           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

@thomasrockhu-codecov thomasrockhu-codecov merged commit b9e6737 into main Jul 11, 2026
8 of 10 checks passed
@thomasrockhu-codecov thomasrockhu-codecov deleted the th/bump-dependabot-deps branch July 11, 2026 00:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant