From aa98bcf30992f2ecec40059ec485fe293183e8fd Mon Sep 17 00:00:00 2001 From: Brandur Date: Mon, 5 Oct 2026 23:24:21 -0500 Subject: [PATCH] Upgrade vulnerable deps + pull out `pnpm audit` While fixing an intermittent build from for JS [1], I ran into a different intermittent build problem in JS. The CI job runs `pnpm audit,` and the JS ecosystem has so many vulnerabilities being discovered all the time that this will arbitrarily fail the build at any time. I've upgraded the vulnerable dependencies here, but I'm also pulling `pnpm audit` out of the build for now. It doesn't seem like a bad idea, but we need a way to do this that doesn't involve randomly failing unrelated builds. I assume Dependabot will get to those dependencies, but we've been having a heck of a problem with noise from that recently too, but we may need to find option three. [1] https://github.com/riverqueue/river/pull/1452 --- .github/workflows/js.yaml | 2 -- js/docs/development.md | 6 +++--- js/package.json | 4 +++- js/pnpm-lock.yaml | 20 +++++++++++--------- 4 files changed, 17 insertions(+), 15 deletions(-) diff --git a/.github/workflows/js.yaml b/.github/workflows/js.yaml index 2a4959522..f8fe9bb9d 100644 --- a/.github/workflows/js.yaml +++ b/.github/workflows/js.yaml @@ -87,8 +87,6 @@ jobs: - run: pnpm run license:check - - run: pnpm audit - packages: name: Package archives runs-on: ubuntu-latest diff --git a/js/docs/development.md b/js/docs/development.md index 31580b72c..b584c3cb6 100644 --- a/js/docs/development.md +++ b/js/docs/development.md @@ -193,9 +193,9 @@ and on release tags. Each job installs the official Node.js build from `js/.node-version` and fails unless `typeof Temporal` is `object`. The jobs cover build, both type-check lanes, generated migrations (compared with River's sources), API reports, TypeDoc, README snippets, the 0.1 fixture, lint, -formatting, licenses, `pnpm audit`, packed archives and examples, unit tests on -Node 26.0.0 and the current Node 26 release, and integration tests on -PostgreSQL 14 through 18. +formatting, licenses, packed archives and examples, unit tests on Node 26.0.0 +and the current Node 26 release, and integration tests on PostgreSQL 14 +through 18. Unit tests compare cron schedules and snooze counting with goldens recorded from River Go in `src/testdata`, the same values the Rust port checks in its diff --git a/js/package.json b/js/package.json index cfed1b4bc..b6daf50cf 100644 --- a/js/package.json +++ b/js/package.json @@ -110,7 +110,9 @@ "overrides": { "deepmerge-ts": "8.0.1", "mysql2": "3.24.4", - "nanoid": "3.3.18" + "nanoid": "3.3.18", + "postcss-selector-parser": "7.1.6", + "source-map-js": "1.2.2" } }, "keywords": [ diff --git a/js/pnpm-lock.yaml b/js/pnpm-lock.yaml index 043b83c30..1c841c76d 100644 --- a/js/pnpm-lock.yaml +++ b/js/pnpm-lock.yaml @@ -8,6 +8,8 @@ overrides: deepmerge-ts: 8.0.1 mysql2: 3.24.4 nanoid: 3.3.18 + postcss-selector-parser: 7.1.6 + source-map-js: 1.2.2 importers: @@ -2370,8 +2372,8 @@ packages: pkg-types@2.3.1: resolution: {integrity: sha512-y+ichcgc2LrADuhLNAx8DFjVfgz91pRxfZdI3UDhxHvcVEZsenLO+7XaU5vOp0u/7V/wZ+plyuQxtrDlZJ+yeg==} - postcss-selector-parser@7.1.5: - resolution: {integrity: sha512-KvvtD7SrlBP7dlgkBghEE3r84CABm5SmV2aNcG4oCA+qDnJ/tvKonFVvwWAyyWUEwxuNawdfEAZKP9zM3oZ2Uw==} + postcss-selector-parser@7.1.6: + resolution: {integrity: sha512-7qASPzhKF2l2KLboRZux8CCTRMdGiV08vWmyKzPz22qZ7ZjQBOeY7rNzNoCLSUiftJ7HUq0GERHmxw/t0dCdMw==} engines: {node: '>=4'} postcss@8.5.25: @@ -2591,8 +2593,8 @@ packages: sonic-boom@4.2.1: resolution: {integrity: sha512-w6AxtubXa2wTXAUsZMMWERrsIRAdrK0Sc+FUytWvYAhBJLyuI4llrMIC1DtlNSdI99EI86KZum2MMq3EAZlF9Q==} - source-map-js@1.2.1: - resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==} + source-map-js@1.2.2: + resolution: {integrity: sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==} engines: {node: '>=0.10.0'} spdx-compare@1.0.0: @@ -3236,7 +3238,7 @@ snapshots: '@npmcli/query@5.0.0': dependencies: - postcss-selector-parser: 7.1.5 + postcss-selector-parser: 7.1.6 '@npmcli/redact@4.0.0': {} @@ -4626,7 +4628,7 @@ snapshots: dependencies: '@babel/parser': 7.29.9 '@babel/types': 7.29.8 - source-map-js: 1.2.1 + source-map-js: 1.2.2 make-dir@4.0.0: dependencies: @@ -5009,7 +5011,7 @@ snapshots: exsolve: 1.0.8 pathe: 2.0.3 - postcss-selector-parser@7.1.5: + postcss-selector-parser@7.1.6: dependencies: cssesc: 3.0.0 util-deprecate: 1.0.2 @@ -5018,7 +5020,7 @@ snapshots: dependencies: nanoid: 3.3.18 picocolors: 1.1.1 - source-map-js: 1.2.1 + source-map-js: 1.2.2 postgres-array@2.0.0: {} @@ -5208,7 +5210,7 @@ snapshots: dependencies: atomic-sleep: 1.0.0 - source-map-js@1.2.1: {} + source-map-js@1.2.2: {} spdx-compare@1.0.0: dependencies: