You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Internally AVA is now fully ESM. This is possible now that Node.js supports loading ES modules using require() calls and simplifies AVA's types and internals.
If you use AVA from a CommonJS project you'll have to update your imports:
-const test = require('ava');+const {default: test} = require('ava');
We expect an increasing number of projects to be ESM only. As per the above, CommonJS is still supported, but we don't expect cjs extensions to be used. The default file extensions are now js and mjs. Specify extensions: ['cjs', 'js', 'mjs'] for AVA to run test files with the cjs extension.
All test files (and those loaded through AVA's require config) are now loaded via import(). Use customization hooks for transpilation. The object form of the extensions configuration is no longer supported.
If you use AVA with @ava/typescript you must upgrade that package to v7.
New Features
There's two new test modifiers courtesy of@sindresorhus: test.skipIf() to skip a test based on a runtime condition. test.runIf() is the inverse: the test only runs when the condition is true.
test.skipIf(process.platform==='win32')('not on Windows',t=>{t.pass();});test.runIf(process.platform==='linux')('Linux only',t=>{t.pass();});
These work with other modifiers like .serial and .failing:
test.serial.skipIf(process.platform==='win32')('serial, not on Windows',t=>{t.pass();});test.failing.skipIf(process.platform==='win32')('expected failure, not on Windows',t=>{t.fail();});
Other Changes
Watch mode now ignores changes to *.tsbuildinfo files
TAP reporter is more defensive when restoring the original error name, thanks to @ninper00 in #3415
Reported errors when throwsAsync/notThrowsAsync are not awaited have been improved by @sindresorhus in #3436
Replace strip-ansi with node:util.stripVTControlCharacters by @fisker in #3403
Remove support for Node.js 18 and 23; require 20.19 or newer, 22.20 or newer or 24,12 or newer; update dependencies including transitive glob by @novemberborn in #3416
Review the following alerts detected in dependencies.
According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. It is recommended to resolve "Warn" alerts too. Learn more about Socket for GitHub.
Action
Severity
Alert (click "▶" to expand/collapse)
Block
High CVE: JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection in npm js-cookie
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/js-cookie@2.2.1. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Block
Potential code anomaly (AI signal): npm @smithy/core is 100.0% likely to have a medium risk anomaly
Notes: The code implements a conventional, well-structured event-stream unmarshalling pipeline with explicit handling for error, exception, and event message types. The primary security considerations are: potential exposure of header/body content through thrown errors, reliance on the deserializer contract (notably the $unknown flag), and ensuring that downstream consumers appropriately trust the deserialized payloads. In a supply-chain context, ensure that eventStreamCodec, deserializer implementations, and error handling are trusted and audited to avoid leaking sensitive metadata, and consider sanitizing error messages in production.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@smithy/core@3.24.3. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Block
Potential code anomaly (AI signal): npm asynckit is 100.0% likely to have a medium risk anomaly
Notes: The analyzed code is a standard wrapper/adapter for long-signature iterators in a streaming context. It includes proper handling to avoid duplicate callbacks, emits errors correctly, and finalizes the stream appropriately. There is no indication of malicious behavior, data exfiltration, or backdoor-like mechanisms. The risk is minimal and primarily relates to correct usage by downstream code (e.g., ensuring stream object has the expected properties).
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/asynckit@0.4.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Block
Potential code anomaly (AI signal): npm cbor2 is 100.0% likely to have a medium risk anomaly
Notes: Overall, the codebase appears to be a robust, feature-rich CBOR serialization library with extensive tag support and defensive input handling. There is no concrete evidence of malicious behavior or data exfiltration within the provided fragment. The main operational risk is inherent to any data-serialization component: untrusted inputs can trigger potentially expensive or error-prone constructions (URL/RegExp/Date) if downstream usage is insecure. The code mitigates this with strict validations and explicit error handling.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/cbor2@2.3.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Block
Potential code anomaly (AI signal): npm delayed-stream is 100.0% likely to have a medium risk anomaly
Notes: The DelayedStream module intercepts and buffers events from a source stream. While the core functionality appears to be for stream delay and management, two aspects raise concern: the overriding of the source's emit method and the attachment of a silent error handler (source.on('error', function() {})). The silent error handler is particularly suspicious as it can mask underlying problems or potential malicious activity originating from the source stream. Without further context on why errors are being suppressed, this behavior warrants caution. The code itself does not exhibit direct malware patterns like network exfiltration or reverse shells, but the error suppression could be a component of a larger, more covert operation.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/delayed-stream@1.0.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Block
Low CVE: Elliptic Uses a Cryptographic Primitive with a Risky Implementation
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/elliptic@6.6.1. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Block
Potential code anomaly (AI signal): npm function-bind is 100.0% likely to have a medium risk anomaly
Notes: The code is a standard Function.prototype.bind polyfill implementation. It carefully handles this binding, constructor behavior, and argument binding without introducing observable malicious behavior. The dynamic Function constructor is used as part of a legitimate polyfill technique and does not indicate an attack by itself in this context.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/function-bind@1.1.2. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Block
Potential code anomaly (AI signal): npm get-intrinsic is 100.0% likely to have a medium risk anomaly
Notes: The GetIntrinsic module is a conventional intrinsic resolver designed for sandboxed JavaScript environments. It includes careful validation, alias handling, and selective dynamic evaluation for specific intrinsics. While there is a real potential risk from Function-based evaluation if exposed to untrusted input, in this isolated code path there is no evidence of data leakage, backdoors, or external communications. The component is acceptable with proper sandbox boundaries; the most important mitigations are ensuring inputs are trusted and that dynamic evaluation cannot be triggered by untrusted sources.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/get-intrinsic@1.3.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Block
Potential code anomaly (AI signal): npm glob is 100.0% likely to have a medium risk anomaly
Notes: The Glob utilities implement a conventional and well-structured filesystem glob-walking mechanism with robust control flow (abort signals, backpressure) and safe output semantics. There is no evidence of malicious behavior, backdoors, or data exfiltration within this fragment. Risks mainly relate to how downstream consumers may handle emitted paths, not to the library itself.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/glob@13.0.6. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Block
Potential code anomaly (AI signal): npm mime-types is 100.0% likely to have a medium risk anomaly
Notes: The analyzed code is a standard, well-defined MIME type utility (mime-types) with normal functionality and no indicators of malicious behavior within this fragment. It reads a local mime-db, constructs mappings, and exposes deterministic helpers for MIME types, extensions, and charsets. No data exfiltration, no backdoors, and no unsafe operations observed.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/mime-types@2.1.35. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Block
Potential code anomaly (AI signal): npm ws is 100.0% likely to have a medium risk anomaly
Notes: The code implements a standard EventTarget-like mixin for wrapping event listeners and dispatching events to user callbacks. There are no suspicious patterns such as dynamic code execution, hardcoded secrets, or network activity. The risk is contingent on what the consumer does inside their handlers; the snippet itself does not introduce malware or data leakage mechanisms beyond normal event dispatch. Overall security risk is low in isolation.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/ws@8.20.1. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Block
Potential code anomaly (AI signal): npm ws is 100.0% likely to have a medium risk anomaly
Notes: The analyzed code segment represents a robust, standards-aligned WebSocket receiver. It correctly handles frame parsing, masking, fragmentation, and optional compression via PerMessageDeflate, with appropriate validation and error signaling. There is no evidence of malicious intent or backdoors within this module; the security posture is solid for a protocol parser, with typical risks mitigated by payload size checks and UTF-8 validation. Overall, the code is appropriate for integration in a WebSocket client/server library, with moderate security risk primarily tied to how downstream consumers handle emitted data and potential resource usage under edge cases.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/ws@8.20.1. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Warn
Obfuscated code: npm buffer is 96.0% likely obfuscated
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/buffer@4.9.2. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^6.0.0→^8.0.0Release Notes
avajs/ava (ava)
v8.0.1Compare Source
What's Changed
This release officially adds Node.js 26 support, with thanks to @novemberborn in #3450.
Per our policy, support for Node.js 25 has been removed.
Full Changelog: avajs/ava@v8.0.0...v8.0.1
v8.0.0Compare Source
Breaking Changes
AVA now expects Node.js 22.20, 24.12 or newer.
Internally AVA is now fully ESM. This is possible now that Node.js supports loading ES modules using
require()calls and simplifies AVA's types and internals.If you use AVA from a CommonJS project you'll have to update your imports:
We expect an increasing number of projects to be ESM only. As per the above, CommonJS is still supported, but we don't expect
cjsextensions to be used. The default file extensions are nowjsandmjs. Specifyextensions: ['cjs', 'js', 'mjs']for AVA to run test files with thecjsextension.All test files (and those loaded through AVA's
requireconfig) are now loaded viaimport(). Use customization hooks for transpilation. The object form of theextensionsconfiguration is no longer supported.If you use AVA with @ava/typescript you must upgrade that package to v7.
New Features
There's two new test modifiers courtesy of @sindresorhus:
test.skipIf()to skip a test based on a runtime condition.test.runIf()is the inverse: the test only runs when the condition is true.These work with other modifiers like
.serialand.failing:Other Changes
*.tsbuildinfofilesthrowsAsync/notThrowsAsyncare not awaited have been improved by @sindresorhus in #3436New Contributors
Full Changelog: avajs/ava@v7.0.0...v8.0.0
v7.0.0Compare Source
What's Changed
strip-ansiwithnode:util.stripVTControlCharactersby @fisker in #3403globby @novemberborn in #3416Full Changelog: avajs/ava@v6.4.1...v7.0.0
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.