Conversation
Upgrade gulp-mocha 4.3.1 → 9.0.0, mocha ^3.5.3 → ^10.8.2, mocha-jenkins-reporter ^0.3.9 → ^0.4.8, @types/gulp-mocha → 0.0.37. Add overrides for serialize-javascript (^7.0.5) and diff (^4.0.4) to patch transitive CVEs that mocha 10 and mocha-jenkins-reporter pin below fixed versions. Resolves: CVE-2017-16042 (growl, critical) Resolves: CVE-2017-20165, CVE-2017-16137 (debug, high/low) Resolves: GHSA-h6ch-v84p-w6p9, CVE-2026-24001 (diff, high/low) Resolves: CVE-2021-44906 (minimist, critical) Resolves: GHSA-5c6j-r48x-rmvq, GHSA-qj8w-gfj5-8c6v (serialize-javascript, high) Total dev vulnerabilities: 61 → 54. No production dependencies affected. No code changes to gulpfiles — gulp-mocha API is unchanged.
|
|
mocha 3 exited automatically when tests finished. mocha 4+ waits for the event loop to drain, so a test that leaks a handle (an open socket, a timer, a server still listening) keeps the process alive. After the mocha 3 -> 10 upgrade in the previous commit, this caused the Kokoro CI job to run until the 3600s VM wall-clock cap and get killed with exit 1, even though every test suite passed. Add a root .mocharc.js with exit: true to restore the mocha 3 behavior. mocha searches upward for the nearest rc file, so this single config applies to every package's gulp test task. Only exit is set, so the mocha-jenkins-reporter config in the gulpfiles is untouched.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Upgrades the mocha test toolchain to clear 7 dev-dependency CVEs. No production dependencies affected.
gulp-mocha4.3.1 → 9.0.0mocha^3.5.3 → ^10.8.2mocha-jenkins-reporter^0.3.9 → ^0.4.8@types/gulp-mocha0.0.31 → 0.0.37overridesforserialize-javascript(^7.0.5) anddiff(^4.0.4)Advisories resolved