Skip to content

Upgrade Node and a few dependencies to address security vulnerabilities #1149

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
2 commits merged into from
Apr 20, 2026
Merged

Upgrade Node and a few dependencies to address security vulnerabilities #1149

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c177213
fix: bump dependencies to fix vulnerabilities
andrejak Apr 20, 2026
04ae7c4
fix: bump node and the terser plugin
andrejak Apr 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .tool-versions
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
nodejs 18.20.8

@igorp1 igorp1 Apr 20, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This makes me think we should bump it in assistant too (or maybe even switch assistant to bun -- considering it has no production runtime, it'd be just for benefit of dev really)

nodejs 20.19.4
4 changes: 2 additions & 2 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,7 @@
"@commitlint/cz-commitlint": "17.8.1",
"@rollup/plugin-commonjs": "25.0.8",
"@rollup/plugin-node-resolve": "15.3.1",
"@rollup/plugin-terser": "0.4.4",
"@rollup/plugin-terser": "1.0.0",
"@rollup/plugin-typescript": "12.3.0",
"@types/jest": "29.5.14",
"@typescript-eslint/eslint-plugin": "6.7.5",
Expand All @@ -98,7 +98,7 @@
"typescript": "5.9.3"
},
"engines": {
"node": ">=18.*"
"node": ">=20"
Comment on lines 100 to +101

@igorp1 igorp1 Apr 20, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we change this, would people using this version on node 18 begin to experience failure to install?

Can we bump tools versions and maintain the minimum engine on 18?

},
"release": {
"plugins": [
Expand Down
67 changes: 28 additions & 39 deletions yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1623,7 +1623,7 @@ __metadata:
"@commitlint/cz-commitlint": "npm:17.8.1"
"@rollup/plugin-commonjs": "npm:25.0.8"
"@rollup/plugin-node-resolve": "npm:15.3.1"
"@rollup/plugin-terser": "npm:0.4.4"
"@rollup/plugin-terser": "npm:1.0.0"
"@rollup/plugin-typescript": "npm:12.3.0"
"@types/jest": "npm:29.5.14"
"@types/node": "npm:18.0.0"
Expand Down Expand Up @@ -2537,19 +2537,19 @@ __metadata:
languageName: node
linkType: hard

"@rollup/plugin-terser@npm:0.4.4":
version: 0.4.4
resolution: "@rollup/plugin-terser@npm:0.4.4"
"@rollup/plugin-terser@npm:1.0.0":
version: 1.0.0
resolution: "@rollup/plugin-terser@npm:1.0.0"
dependencies:
serialize-javascript: "npm:^6.0.1"
serialize-javascript: "npm:^7.0.3"
smob: "npm:^1.0.0"
terser: "npm:^5.17.4"
peerDependencies:
rollup: ^2.0.0||^3.0.0||^4.0.0
peerDependenciesMeta:
rollup:
optional: true
checksum: 10c0/b9cb6c8f02ac1c1344019e9fb854321b74f880efebc41b6bdd84f18331fce0f4a2aadcdb481042245cd3f409b429ac363af71f9efec4a2024731d67d32af36ee
checksum: 10c0/08be445cc2e0677132ee06cdebbcd1b6cd3ab22e220fcd89d8a22eaf9ee501a940f425931ac65c65ab113803ad31a895f2575716248609c882c8e562fd6cc2d4
languageName: node
linkType: hard

Expand Down Expand Up @@ -3849,12 +3849,12 @@ __metadata:
languageName: node
linkType: hard

"brace-expansion@npm:^5.0.2":
version: 5.0.4
resolution: "brace-expansion@npm:5.0.4"
"brace-expansion@npm:^5.0.5":
version: 5.0.5
resolution: "brace-expansion@npm:5.0.5"
dependencies:
balanced-match: "npm:^4.0.2"
checksum: 10c0/359cbcfa80b2eb914ca1f3440e92313fbfe7919ee6b274c35db55bec555aded69dac5ee78f102cec90c35f98c20fa43d10936d0cd9978158823c249257e1643a
checksum: 10c0/4d238e14ed4f5cc9c07285550a41cef23121ca08ba99fa9eb5b55b580dcb6bf868b8210aa10526bdc9f8dc97f33ca2a7259039c4cc131a93042beddb424c48e3
languageName: node
linkType: hard

Expand Down Expand Up @@ -7910,11 +7910,11 @@ __metadata:
linkType: hard

"minimatch@npm:^10.2.2":
version: 10.2.4
resolution: "minimatch@npm:10.2.4"
version: 10.2.5
resolution: "minimatch@npm:10.2.5"
dependencies:
brace-expansion: "npm:^5.0.2"
checksum: 10c0/35f3dfb7b99b51efd46afd378486889f590e7efb10e0f6a10ba6800428cf65c9a8dedb74427d0570b318d749b543dc4e85f06d46d2858bc8cac7e1eb49a95945
brace-expansion: "npm:^5.0.5"
checksum: 10c0/6bb058bd6324104b9ec2f763476a35386d05079c1f5fe4fbf1f324a25237cd4534d6813ecd71f48208f4e635c1221899bef94c3c89f7df55698fe373aaae20fd
languageName: node
linkType: hard

Expand Down Expand Up @@ -8882,9 +8882,9 @@ __metadata:
linkType: hard

"picomatch@npm:^4.0.2, picomatch@npm:^4.0.3":
version: 4.0.3
resolution: "picomatch@npm:4.0.3"
checksum: 10c0/9582c951e95eebee5434f59e426cddd228a7b97a0161a375aed4be244bd3fe8e3a31b846808ea14ef2c8a2527a6eeab7b3946a67d5979e81694654f939473ae2
version: 4.0.4
resolution: "picomatch@npm:4.0.4"
checksum: 10c0/e2c6023372cc7b5764719a5ffb9da0f8e781212fa7ca4bd0562db929df8e117460f00dff3cb7509dacfc06b86de924b247f504d0ce1806a37fac4633081466b0
languageName: node
linkType: hard

Expand Down Expand Up @@ -9089,15 +9089,6 @@ __metadata:
languageName: node
linkType: hard

"randombytes@npm:^2.1.0":
version: 2.1.0
resolution: "randombytes@npm:2.1.0"
dependencies:
safe-buffer: "npm:^5.1.0"
checksum: 10c0/50395efda7a8c94f5dffab564f9ff89736064d32addf0cc7e8bf5e4166f09f8ded7a0849ca6c2d2a59478f7d90f78f20d8048bca3cdf8be09d8e8a10790388f3
languageName: node
linkType: hard

"rc@npm:^1.2.8":
version: 1.2.8
resolution: "rc@npm:1.2.8"
Expand Down Expand Up @@ -9579,20 +9570,20 @@ __metadata:
languageName: node
linkType: hard

"safe-buffer@npm:^5.1.0, safe-buffer@npm:~5.2.0":
version: 5.2.1
resolution: "safe-buffer@npm:5.2.1"
checksum: 10c0/6501914237c0a86e9675d4e51d89ca3c21ffd6a31642efeba25ad65720bce6921c9e7e974e5be91a786b25aa058b5303285d3c15dbabf983a919f5f630d349f3
languageName: node
linkType: hard

"safe-buffer@npm:~5.1.0, safe-buffer@npm:~5.1.1":
version: 5.1.2
resolution: "safe-buffer@npm:5.1.2"
checksum: 10c0/780ba6b5d99cc9a40f7b951d47152297d0e260f0df01472a1b99d4889679a4b94a13d644f7dbc4f022572f09ae9005fa2fbb93bbbd83643316f365a3e9a45b21
languageName: node
linkType: hard

"safe-buffer@npm:~5.2.0":
version: 5.2.1
resolution: "safe-buffer@npm:5.2.1"
checksum: 10c0/6501914237c0a86e9675d4e51d89ca3c21ffd6a31642efeba25ad65720bce6921c9e7e974e5be91a786b25aa058b5303285d3c15dbabf983a919f5f630d349f3
languageName: node
linkType: hard

"safer-buffer@npm:>= 2.1.2 < 3, safer-buffer@npm:>= 2.1.2 < 3.0.0":
version: 2.1.2
resolution: "safer-buffer@npm:2.1.2"
Expand Down Expand Up @@ -9666,12 +9657,10 @@ __metadata:
languageName: node
linkType: hard

"serialize-javascript@npm:^6.0.1":
version: 6.0.2
resolution: "serialize-javascript@npm:6.0.2"
dependencies:
randombytes: "npm:^2.1.0"
checksum: 10c0/2dd09ef4b65a1289ba24a788b1423a035581bef60817bea1f01eda8e3bda623f86357665fe7ac1b50f6d4f583f97db9615b3f07b2a2e8cbcb75033965f771dd2
"serialize-javascript@npm:^7.0.3":
version: 7.0.5
resolution: "serialize-javascript@npm:7.0.5"
checksum: 10c0/7b7818e5267f6d474ec7a56d36ba69dd712726a13eab37706ec94615fb7ca8945471f2b7fb0dc9dbe8c79c1930c1079d97f66f91315c8c8c2ca6c38898cec96f
languageName: node
linkType: hard

Expand Down
Loading