Skip to content

Modernize dependencies and fix vulnerabilities#306

Open
ehuelsmann wants to merge 191 commits into
openapi-library:masterfrom
ehuelsmann:master
Open

Modernize dependencies and fix vulnerabilities#306
ehuelsmann wants to merge 191 commits into
openapi-library:masterfrom
ehuelsmann:master

Conversation

@ehuelsmann
Copy link
Copy Markdown

There are 99+ vulnerabilities reported by Dependabot on my fork. I've been working to fix them. Here's my progress.

ehuelsmann and others added 30 commits April 10, 2026 09:50
… versions and Node to 20

Agent-Logs-Url: https://github.com/ehuelsmann/OpenAPIValidators/sessions/78dd686b-daa5-4a97-9e88-35eb3ceb2c8b

Co-authored-by: ehuelsmann <2326559+ehuelsmann@users.noreply.github.com>
… updates

Bumps the npm_and_yarn group with 18 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [express](https://github.com/expressjs/express) | `4.17.1` | `4.22.0` |
| [axios](https://github.com/axios/axios) | `0.21.2` | `1.15.0` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.0.0` | `4.1.1` |
| [@babel/helpers](https://github.com/babel/babel/tree/HEAD/packages/babel-helpers) | `7.9.2` | `7.29.2` |
| [@babel/traverse](https://github.com/babel/babel/tree/HEAD/packages/babel-traverse) | `7.9.5` | `7.29.0` |
| [@npmcli/git](https://github.com/npm/git) | `2.0.6` | `2.1.0` |
| [ajv](https://github.com/ajv-validator/ajv) | `6.12.5` | `6.14.0` |
| [cookiejar](https://github.com/bmeck/node-cookiejar) | `2.1.2` | `2.1.4` |
| [decode-uri-component](https://github.com/SamVerschueren/decode-uri-component) | `0.2.0` | `0.2.2` |
| [diff](https://github.com/kpdecker/jsdiff) | `3.5.0` | `3.5.1` |
| [get-func-name](https://github.com/chaijs/get-func-name) | `2.0.0` | `2.0.2` |
| [json5](https://github.com/json5/json5) | `1.0.1` | `1.0.2` |
| [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` |
| [minimist](https://github.com/minimistjs/minimist) | `1.2.5` | `1.2.8` |
| [node-fetch](https://github.com/node-fetch/node-fetch) | `2.6.1` | `2.7.0` |
| [pathval](https://github.com/chaijs/pathval) | `1.1.0` | `1.1.1` |
| [picomatch](https://github.com/micromatch/picomatch) | `2.2.2` | `2.3.2` |
| [ws](https://github.com/websockets/ws) | `7.4.6` | `7.5.10` |

Bumps the npm_and_yarn group with 1 update in the /packages/chai-openapi-response-validator directory: [axios](https://github.com/axios/axios).
Bumps the npm_and_yarn group with 1 update in the /packages/jest-openapi directory: [axios](https://github.com/axios/axios).
Bumps the npm_and_yarn group with 1 update in the /packages/openapi-validator directory: [axios](https://github.com/axios/axios).


Updates `express` from 4.17.1 to 4.22.0
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/4.22.0/History.md)
- [Commits](expressjs/express@4.17.1...4.22.0)

Updates `axios` from 0.21.2 to 1.15.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v0.21.2...v1.15.0)

Updates `js-yaml` from 4.0.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.0.0...4.1.1)

Updates `@babel/helpers` from 7.9.2 to 7.29.2
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.2/packages/babel-helpers)

Updates `@babel/traverse` from 7.9.5 to 7.29.0
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.0/packages/babel-traverse)

Updates `@npmcli/git` from 2.0.6 to 2.1.0
- [Release notes](https://github.com/npm/git/releases)
- [Changelog](https://github.com/npm/git/blob/main/CHANGELOG.md)
- [Commits](npm/git@v2.0.6...v2.1.0)

Updates `ajv` from 6.12.5 to 6.14.0
- [Release notes](https://github.com/ajv-validator/ajv/releases)
- [Commits](ajv-validator/ajv@v6.12.5...v6.14.0)

Updates `body-parser` from 1.19.0 to 1.20.4
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@1.19.0...1.20.4)

Updates `cookie` from 0.4.0 to 0.7.2
- [Release notes](https://github.com/jshttp/cookie/releases)
- [Commits](jshttp/cookie@v0.4.0...v0.7.2)

Updates `cookiejar` from 2.1.2 to 2.1.4
- [Commits](https://github.com/bmeck/node-cookiejar/commits)

Updates `decode-uri-component` from 0.2.0 to 0.2.2
- [Release notes](https://github.com/SamVerschueren/decode-uri-component/releases)
- [Commits](SamVerschueren/decode-uri-component@v0.2.0...v0.2.2)

Updates `diff` from 3.5.0 to 3.5.1
- [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md)
- [Commits](kpdecker/jsdiff@v3.5.0...v3.5.1)

Updates `follow-redirects` from 1.14.7 to 1.15.11
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.14.7...v1.15.11)

Updates `get-func-name` from 2.0.0 to 2.0.2
- [Release notes](https://github.com/chaijs/get-func-name/releases)
- [Commits](https://github.com/chaijs/get-func-name/commits/v2.0.2)

Updates `json5` from 1.0.1 to 1.0.2
- [Release notes](https://github.com/json5/json5/releases)
- [Changelog](https://github.com/json5/json5/blob/main/CHANGELOG.md)
- [Commits](json5/json5@v1.0.1...v1.0.2)

Updates `lodash` from 4.17.21 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.18.1)

Updates `minimist` from 1.2.5 to 1.2.8
- [Changelog](https://github.com/minimistjs/minimist/blob/main/CHANGELOG.md)
- [Commits](minimistjs/minimist@v1.2.5...v1.2.8)

Updates `node-fetch` from 2.6.1 to 2.7.0
- [Release notes](https://github.com/node-fetch/node-fetch/releases)
- [Commits](node-fetch/node-fetch@v2.6.1...v2.7.0)

Updates `pathval` from 1.1.0 to 1.1.1
- [Release notes](https://github.com/chaijs/pathval/releases)
- [Changelog](https://github.com/chaijs/pathval/blob/master/CHANGELOG.md)
- [Commits](chaijs/pathval@v1.1.0...v1.1.1)

Updates `picomatch` from 2.2.2 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.2.2...2.3.2)

Updates `send` from 0.17.1 to 0.19.2
- [Release notes](https://github.com/pillarjs/send/releases)
- [Changelog](https://github.com/pillarjs/send/blob/master/HISTORY.md)
- [Commits](pillarjs/send@0.17.1...0.19.2)

Updates `serve-static` from 1.14.1 to 1.16.3
- [Release notes](https://github.com/expressjs/serve-static/releases)
- [Changelog](https://github.com/expressjs/serve-static/blob/master/HISTORY.md)
- [Commits](expressjs/serve-static@v1.14.1...v1.16.3)

Updates `ws` from 7.4.6 to 7.5.10
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@7.4.6...7.5.10)

Updates `axios` from 0.21.4 to 1.15.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v0.21.2...v1.15.0)

Updates `axios` from 0.21.4 to 1.15.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v0.21.2...v1.15.0)

Updates `axios` from 0.21.4 to 1.15.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v0.21.2...v1.15.0)

---
updated-dependencies:
- dependency-name: express
  dependency-version: 4.22.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.15.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@babel/helpers"
  dependency-version: 7.29.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@babel/traverse"
  dependency-version: 7.29.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@npmcli/git"
  dependency-version: 2.1.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ajv
  dependency-version: 6.14.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-version: 1.20.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: cookie
  dependency-version: 0.7.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: cookiejar
  dependency-version: 2.1.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: decode-uri-component
  dependency-version: 0.2.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: diff
  dependency-version: 3.5.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: follow-redirects
  dependency-version: 1.15.11
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: get-func-name
  dependency-version: 2.0.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: json5
  dependency-version: 1.0.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimist
  dependency-version: 1.2.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: node-fetch
  dependency-version: 2.7.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: pathval
  dependency-version: 1.1.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: send
  dependency-version: 0.19.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: serve-static
  dependency-version: 1.16.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 7.5.10
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.15.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.15.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.15.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
…ferentRequestModules tests

Agent-Logs-Url: https://github.com/ehuelsmann/OpenAPIValidators/sessions/1426bdf5-7939-47eb-ac0a-ac0d02af027c

Co-authored-by: ehuelsmann <2326559+ehuelsmann@users.noreply.github.com>
ci: fix CI failures - modernize workflow, update Node 20 error messages, fix test flakiness
Co-authored-by: ehuelsmann <2326559+ehuelsmann@users.noreply.github.com>
Co-authored-by: ehuelsmann <2326559+ehuelsmann@users.noreply.github.com>
… versions and Node to 20

Agent-Logs-Url: https://github.com/ehuelsmann/OpenAPIValidators/sessions/78dd686b-daa5-4a97-9e88-35eb3ceb2c8b

Co-authored-by: ehuelsmann <2326559+ehuelsmann@users.noreply.github.com>
…ferentRequestModules tests

Agent-Logs-Url: https://github.com/ehuelsmann/OpenAPIValidators/sessions/1426bdf5-7939-47eb-ac0a-ac0d02af027c

Co-authored-by: ehuelsmann <2326559+ehuelsmann@users.noreply.github.com>
…_yarn-dbe58a7275

chore(deps): bump the npm_and_yarn group across 4 directories with 23 updates
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v6)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [@types/js-yaml](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/js-yaml) from 4.0.3 to 4.0.9.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/js-yaml)

---
updated-dependencies:
- dependency-name: "@types/js-yaml"
  dependency-version: 4.0.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [eslint-config-airbnb-typescript](https://github.com/iamturns/eslint-config-airbnb-typescript) from 14.0.1 to 14.0.2.
- [Release notes](https://github.com/iamturns/eslint-config-airbnb-typescript/releases)
- [Changelog](https://github.com/iamturns/eslint-config-airbnb-typescript/blob/master/CHANGELOG.md)
- [Commits](iamturns/eslint-config-airbnb-typescript@v14.0.1...v14.0.2)

---
updated-dependencies:
- dependency-name: eslint-config-airbnb-typescript
  dependency-version: 14.0.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
…ns/checkout-6

chore(deps): bump actions/checkout from 4 to 6
…ns/setup-node-6

chore(deps): bump actions/setup-node from 4 to 6
…-config-airbnb-typescript-14.0.2

chore(deps-dev): bump eslint-config-airbnb-typescript from 14.0.1 to 14.0.2
…js-yaml-4.0.9

chore(deps-dev): bump @types/js-yaml from 4.0.3 to 4.0.9
Bumps the npm_and_yarn group with 1 update in the / directory: [handlebars](https://github.com/handlebars-lang/handlebars.js).


Updates `handlebars` from 4.7.7 to 4.7.9
- [Release notes](https://github.com/handlebars-lang/handlebars.js/releases)
- [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md)
- [Commits](handlebars-lang/handlebars.js@v4.7.7...v4.7.9)

---
updated-dependencies:
- dependency-name: handlebars
  dependency-version: 4.7.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Copilot AI and others added 30 commits May 7, 2026 07:54
Co-authored-by: ehuelsmann <2326559+ehuelsmann@users.noreply.github.com>
…ion-node-20

Adopt Node16 TypeScript module semantics and fix ESM interop in Chai test
…encies

Update version bump script to patch internal package references in `yarn.lock`
Remove 'request' notice: we're several versions later now and 'reques…
Replace CodeCov bash script with GitHub Action
Bumps the npm_and_yarn group with 1 update in the / directory: [fast-uri](https://github.com/fastify/fast-uri).


Updates `fast-uri` from 3.1.0 to 3.1.2
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.0...v3.1.2)

---
updated-dependencies:
- dependency-name: fast-uri
  dependency-version: 3.1.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
…d_yarn-053c9c4054

chore(deps): bump fast-uri from 3.1.0 to 3.1.2 in the npm_and_yarn group across 1 directory
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 5 to 6.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@v5...v6)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
…cov/codecov-action-6

chore(deps): bump codecov/codecov-action from 5 to 6
Bumps [@types/superagent](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/superagent) from 4.1.24 to 8.1.9.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/superagent)

---
updated-dependencies:
- dependency-name: "@types/superagent"
  dependency-version: 8.1.9
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
…superagent-8.1.9

chore(deps): bump @types/superagent from 4.1.24 to 8.1.9
Bumps [globals](https://github.com/sindresorhus/globals) from 15.15.0 to 17.6.0.
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](sindresorhus/globals@v15.15.0...v17.6.0)

---
updated-dependencies:
- dependency-name: globals
  dependency-version: 17.6.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
…s-17.6.0

chore(deps-dev): bump globals from 15.15.0 to 17.6.0
There are two uncovered statements due to a conditional on importing modules.
Since we're testing the ESM module and not the CJS module, these two lines
remain untested.
Bumps [nyc](https://github.com/istanbuljs/nyc) from 15.1.0 to 18.0.0.
- [Release notes](https://github.com/istanbuljs/nyc/releases)
- [Changelog](https://github.com/istanbuljs/nyc/blob/main/CHANGELOG.md)
- [Commits](istanbuljs/nyc@v15.1.0...nyc-v18.0.0)

---
updated-dependencies:
- dependency-name: nyc
  dependency-version: 18.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
….0.0

chore(deps-dev): bump nyc from 15.1.0 to 18.0.0
Bumps [ts-node](https://github.com/TypeStrong/ts-node) from 9.1.1 to 10.9.2.
- [Release notes](https://github.com/TypeStrong/ts-node/releases)
- [Changelog](https://github.com/TypeStrong/ts-node/blob/main/development-docs/release-template.md)
- [Commits](TypeStrong/ts-node@v9.1.1...v10.9.2)

---
updated-dependencies:
- dependency-name: ts-node
  dependency-version: 10.9.2
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
…e-10.9.2

chore(deps-dev): bump ts-node from 9.1.1 to 10.9.2
Bumps [fs-extra](https://github.com/jprichardson/node-fs-extra) and [@types/fs-extra](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/fs-extra). These dependencies needed to be updated together.

Updates `fs-extra` from 9.1.0 to 11.3.5
- [Changelog](https://github.com/jprichardson/node-fs-extra/blob/master/CHANGELOG.md)
- [Commits](jprichardson/node-fs-extra@9.1.0...11.3.5)

Updates `@types/fs-extra` from 9.0.13 to 11.0.4
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/fs-extra)

---
updated-dependencies:
- dependency-name: "@types/fs-extra"
  dependency-version: 11.0.4
  dependency-type: direct:development
  update-type: version-update:semver-major
- dependency-name: fs-extra
  dependency-version: 11.3.5
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
…574e415d68

chore(deps): bump fs-extra and @types/fs-extra
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants