[APS-19017] fix: supply-chain hygiene (mocha->devDeps, pin Semgrep image, files allowlist)#1129
Open
Rohannagariya1 wants to merge 1 commit into
Open
[APS-19017] fix: supply-chain hygiene (mocha->devDeps, pin Semgrep image, files allowlist)#1129Rohannagariya1 wants to merge 1 commit into
Rohannagariya1 wants to merge 1 commit into
Conversation
…mage, add files allowlist [APS-19017] INF-005: remove mocha from dependencies (kept in devDependencies); CLI loads mocha from user project via requireModule(), prod copy unnecessary. npm ls mocha --omit=dev now empty. INF-007: pin Semgrep CI image returntocorp/semgrep -> @sha256:f4791a54c891eabe1188248135574e6e03dfc31dfd3f3b747c7bec7079bfed1b (latest as of 2026-06-15). INF-008: add package.json files allowlist [bin/, README.md, LICENSE.md] so npm pack no longer ships .github/, CODEOWNERS, .nycrc.yml, test/. Verified via npm pack --dry-run. NOT applied: CSL-003 md5->sha256 (constants.js) — behavioral change to upload-dedup hash; needs human sign-off. Resolves: APS-19017 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
karanshah-browserstack
approved these changes
Jun 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security Fix: APS-19017 (Low, supply-chain hygiene)
Applied the SAFE mechanical fixes from the ticket. The behavioral md5->sha256 change is intentionally NOT included (see below).
INF-005 — mocha in production dependencies
Removed
mochafromdependencies(kept indevDependencies). The CLI loads mocha from the user's own project viarequireModule(), so the production copy was unnecessary and shippedserialize-javascript(GHSA-5c6j-r48x-rmvq).Verified:
npm ls mocha --omit=dev->(empty). mocha isdev: truein the lock.INF-007 — unpinned Semgrep CI image
Pinned
.github/workflows/Semgrep.ymlfromreturntocorp/semgreptoreturntocorp/semgrep@sha256:f4791a54c891eabe1188248135574e6e03dfc31dfd3f3b747c7bec7079bfed1b(digest of:latestresolved via Docker Hub registry API on 2026-06-15).INF-008 — tarball ships .github/ and CODEOWNERS
Added a
filesallowlist to package.json:["bin/", "README.md", "LICENSE.md"]. (Note: the repo hasLICENSE.md, notLICENSE, and has noindex.js/lib/despitemain: index.js— so the allowlist lists only paths that actually exist.)Verified:
npm pack --dry-runnow emits onlybin/,README.md,LICENSE.md—.github/,CODEOWNERS,.nycrc.yml,test/are all excluded.INF-001 — axios
Already
^1.15.0; no change needed.NOT applied — needs human sign-off
Jira Ticket
https://browserstack.atlassian.net/browse/APS-19017