From 8092aee7240220aa7913d163187b7fba8d9e5a51 Mon Sep 17 00:00:00 2001 From: KT0803 Date: Tue, 18 Nov 2025 12:10:53 +0530 Subject: [PATCH 01/11] chore: remove TODO comment and dead code from http adapter error handler (#7229) Remove commented-out code marked with @todo remove in the request error handler. The code was already disabled and no longer needed. --- lib/adapters/http.js | 2 -- 1 file changed, 2 deletions(-) diff --git a/lib/adapters/http.js b/lib/adapters/http.js index 28d3d2bb64..dfa6386d32 100755 --- a/lib/adapters/http.js +++ b/lib/adapters/http.js @@ -816,8 +816,6 @@ export default isHttpAdapterSupported && function httpAdapter(config) { // Handle errors req.on('error', function handleRequestError(err) { - // @todo remove - // if (req.aborted && err.code !== AxiosError.ERR_FR_TOO_MANY_REDIRECTS) return; reject(AxiosError.from(err, null, config, req)); }); From 86b24235979cc3818327e9c578452496a094dc2d Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 5 Dec 2025 09:08:26 +0200 Subject: [PATCH 02/11] chore(sponsor): update sponsor block (#7285) Co-authored-by: DigitalBrainJS <12586868+DigitalBrainJS@users.noreply.github.com> --- README.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 090cf6e076..a0c09ec5a3 100644 --- a/README.md +++ b/README.md @@ -1,12 +1,12 @@ -

🥇 Gold sponsors

Stytch

API-first authentication, authorization, and fraud prevention

Website | Documentation | Node.js

-		 Principal Financial Group

We’re bound by one common purpose: to give you the financial tools, resources and information you ne...

www.principal.com

+

🥇 Gold sponsors

Principal Financial Group

We’re bound by one common purpose: to give you the financial tools, resources and information you ne...

www.principal.com

Buy Instagram Followers Twicsy

Buy real Instagram followers from Twicsy starting at only $2.97. Twicsy has been voted the best site...

twicsy.com

-
Descope

Hi, we're Descope! We are building something in the authentication space for app developers and...

Website | Docs | Community

-		 Route4Me

Best Route Planning And Route Optimization Software

Explore | Free Trial | Contact

+		 Descope

Hi, we're Descope! We are building something in the authentication space for app developers and...

Website | Docs | Community

+
Route4Me

Best Route Planning And Route Optimization Software

Explore | Free Trial | Contact

Buzzoid - Buy Instagram Followers

At Buzzoid, you can buy Instagram followers quickly, safely, and easily with just a few clicks. Rate...

buzzoid.com

-
Poprey - Buy Instagram Likes

Buy Instagram Likes

poprey.com

-		 Requestly

A lightweight open-source API Development, Testing & Mocking platform

requestly.com

+		 Poprey - Buy Instagram Likes

Buy Instagram Likes

poprey.com

+
Requestly

A lightweight open-source API Development, Testing & Mocking platform

requestly.com

+		 💜 Become a sponsor 💜 Become a sponsor
From 88d78842541610692a04282233933d078a8a2552 Mon Sep 17 00:00:00 2001 From: Anchal Singh <128113546+imanchalsingh@users.noreply.github.com> Date: Fri, 5 Dec 2025 12:42:15 +0530 Subject: [PATCH 03/11] feat: enhance pipeFileToResponse with error handling (#7169) * Enhance pipeFileToResponse with error handling Added error handling for file streaming in pipeFileToResponse function. * Security: Fix path traversal vulnerability in pipeFileToResponse with input validation and error handling Security: Enhance file streaming with comprehensive path validation - Add path traversal protection in pipeFileToResponse function - Implement input validation to prevent directory traversal attacks - Improve error handling for file read operations with proper status codes - Ensure resolved paths stay within intended directory boundaries - Add security checks using path.resolve() and startsWith() methods - Fix CodeQL "Uncontrolled data in path expression" vulnerability - Maintain backward compatibility while enhancing security --------- Co-authored-by: Jay --- examples/server.js | 54 +++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 49 insertions(+), 5 deletions(-) diff --git a/examples/server.js b/examples/server.js index 0dd9be99fa..2c9cfda55f 100644 --- a/examples/server.js +++ b/examples/server.js @@ -3,6 +3,7 @@ import path from 'path'; import http from 'http'; import minimist from 'minimist'; import url from "url"; + const argv = minimist(process.argv.slice(2)); let server; let dirs; @@ -67,15 +68,53 @@ function send404(res, body) { } function pipeFileToResponse(res, file, type) { - if (type) { - res.writeHead(200, { - 'Content-Type': type + try { + // Validate file path - prevent directory traversal + const safeBasePath = path.join(__dirname, 'examples'); + const resolvedPath = path.resolve(path.join(safeBasePath, file)); + + // Ensure the resolved path is within intended directory + if (!resolvedPath.startsWith(safeBasePath)) { + res.writeHead(400); + res.end('Invalid file path'); + return; + } + + // Check if file exists + if (!fs.existsSync(resolvedPath)) { + res.writeHead(404); + res.end('File not found'); + return; + } + + if (type) { + res.writeHead(200, { + "Content-Type": type + }); + } else { + res.writeHead(200); + } + + const stream = fs.createReadStream(resolvedPath); + + stream.on("error", (err) => { + console.error("Error while reading file:", err.message); + if (!res.headersSent) { + res.writeHead(500, { "Content-Type": "text/plain" }); + } + res.end("File read error"); }); + + stream.pipe(res); + } catch (err) { + console.error("Unexpected error:", err.message); + if (!res.headersSent) { + res.writeHead(500, { "Content-Type": "text/plain" }); + } + res.end("Internal server error"); } - fs.createReadStream(path.join(__dirname, file)).pipe(res); } - dirs = listDirs(__dirname); server = http.createServer(function (req, res) { @@ -123,6 +162,7 @@ server = http.createServer(function (req, res) { } else { send404(res); } + return; } // Process server request @@ -130,10 +170,14 @@ server = http.createServer(function (req, res) { if (fs.existsSync(path.join(__dirname, url + '.js'))) { import('file://' + path.join(__dirname, url + '.js')).then((server) => { server.default(req, res); + }).catch(err => { + console.error('Error importing server:', err); + send404(res); }); } else { send404(res); } + return; } else { send404(res); From 2979a9414b9fdbfdfac7b4011c5917283e629c8c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 6 Dec 2025 09:47:38 +0200 Subject: [PATCH 04/11] chore(deps-dev): bump node-forge from 1.3.1 to 1.3.3 (#7293) Bumps [node-forge](https://github.com/digitalbazaar/forge) from 1.3.1 to 1.3.3. - [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md) - [Commits](https://github.com/digitalbazaar/forge/compare/v1.3.1...v1.3.3) --- updated-dependencies: - dependency-name: node-forge dependency-version: 1.3.3 dependency-type: indirect ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/package-lock.json b/package-lock.json index 4b3988d544..1159133bcd 100644 --- a/package-lock.json +++ b/package-lock.json @@ -17911,11 +17911,10 @@ } }, "node_modules/node-forge": { - "version": "1.3.1", - "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.3.1.tgz", - "integrity": "sha512-dPEtOeMvF9VMcYV/1Wb8CPoVAXtp6MKMlcbAt4ddqmGqUJ6fQZFXkNZNkNlfevtNkGtaSoXf/vNNNSvgrdXwtA==", + "version": "1.3.3", + "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.3.3.tgz", + "integrity": "sha512-rLvcdSyRCyouf6jcOIPe/BgwG/d7hKjzMKOas33/pHEr6gbq18IK9zV7DiPvzsz0oBJPme6qr6H6kGZuI9/DZg==", "dev": true, - "license": "(BSD-3-Clause OR GPL-2.0)", "engines": { "node": ">= 6.13.0" } @@ -40813,9 +40812,9 @@ } }, "node-forge": { - "version": "1.3.1", - "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.3.1.tgz", - "integrity": "sha512-dPEtOeMvF9VMcYV/1Wb8CPoVAXtp6MKMlcbAt4ddqmGqUJ6fQZFXkNZNkNlfevtNkGtaSoXf/vNNNSvgrdXwtA==", + "version": "1.3.3", + "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.3.3.tgz", + "integrity": "sha512-rLvcdSyRCyouf6jcOIPe/BgwG/d7hKjzMKOas33/pHEr6gbq18IK9zV7DiPvzsz0oBJPme6qr6H6kGZuI9/DZg==", "dev": true }, "node-gyp": { From 5c7a5cced262d59d9b6d5aa4ef6ed286eb76c028 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 6 Dec 2025 10:02:25 +0200 Subject: [PATCH 05/11] chore(deps-dev): bump js-yaml from 3.14.1 to 3.14.2 (#7296) Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 3.14.1 to 3.14.2. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/3.14.1...3.14.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 3.14.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 60 +++++++++++++++++++++++------------------------ 1 file changed, 30 insertions(+), 30 deletions(-) diff --git a/package-lock.json b/package-lock.json index 1159133bcd..0455d05015 100644 --- a/package-lock.json +++ b/package-lock.json @@ -2776,9 +2776,9 @@ } }, "node_modules/@eslint/eslintrc/node_modules/js-yaml": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz", - "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==", + "version": "4.1.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz", + "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==", "dev": true, "dependencies": { "argparse": "^2.0.1" @@ -7999,9 +7999,9 @@ "dev": true }, "node_modules/cosmiconfig/node_modules/js-yaml": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz", - "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==", + "version": "4.1.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz", + "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==", "dev": true, "dependencies": { "argparse": "^2.0.1" @@ -10613,9 +10613,9 @@ } }, "node_modules/eslint/node_modules/js-yaml": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz", - "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==", + "version": "4.1.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz", + "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==", "dev": true, "dependencies": { "argparse": "^2.0.1" @@ -15083,9 +15083,9 @@ "dev": true }, "node_modules/js-yaml": { - "version": "3.14.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.1.tgz", - "integrity": "sha512-okMH7OXXJ7YrN9Ok3/SXrnu4iX9yOk+25nqX4imS2npuvTYDmo/QEZoqwZkYaIDk3jVvBOTOIEgEhaLOynBS9g==", + "version": "3.14.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz", + "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==", "dev": true, "dependencies": { "argparse": "^1.0.7", @@ -21185,9 +21185,9 @@ } }, "node_modules/release-it/node_modules/js-yaml": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz", - "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==", + "version": "4.1.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz", + "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==", "dev": true, "dependencies": { "argparse": "^2.0.1" @@ -28807,9 +28807,9 @@ } }, "js-yaml": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz", - "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==", + "version": "4.1.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz", + "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==", "dev": true, "requires": { "argparse": "^2.0.1" @@ -32961,9 +32961,9 @@ "dev": true }, "js-yaml": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz", - "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==", + "version": "4.1.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz", + "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==", "dev": true, "requires": { "argparse": "^2.0.1" @@ -35030,9 +35030,9 @@ } }, "js-yaml": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz", - "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==", + "version": "4.1.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz", + "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==", "dev": true, "requires": { "argparse": "^2.0.1" @@ -38538,9 +38538,9 @@ "dev": true }, "js-yaml": { - "version": "3.14.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.1.tgz", - "integrity": "sha512-okMH7OXXJ7YrN9Ok3/SXrnu4iX9yOk+25nqX4imS2npuvTYDmo/QEZoqwZkYaIDk3jVvBOTOIEgEhaLOynBS9g==", + "version": "3.14.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz", + "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==", "dev": true, "requires": { "argparse": "^1.0.7", @@ -43280,9 +43280,9 @@ "dev": true }, "js-yaml": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz", - "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==", + "version": "4.1.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz", + "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==", "dev": true, "requires": { "argparse": "^2.0.1" From 7764844686b241f346b5a0462942cf20d9781cd1 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 6 Dec 2025 10:14:04 +0200 Subject: [PATCH 06/11] chore(deps): bump the github-actions group across 1 directory with 2 updates (#7282) Bumps the github-actions group with 2 updates in the / directory: [actions/checkout](https://github.com/actions/checkout) and [ffurrer2/extract-release-notes](https://github.com/ffurrer2/extract-release-notes). Updates `actions/checkout` from 5 to 6 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v5...v6) Updates `ffurrer2/extract-release-notes` from 2 to 3 - [Release notes](https://github.com/ffurrer2/extract-release-notes/releases) - [Changelog](https://github.com/ffurrer2/extract-release-notes/blob/main/CHANGELOG.md) - [Commits](https://github.com/ffurrer2/extract-release-notes/compare/v2...v3) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: ffurrer2/extract-release-notes dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jay --- .github/workflows/ci.yml | 2 +- .github/workflows/codeql-analysis.yml | 2 +- .github/workflows/depsreview.yaml | 2 +- .github/workflows/labeler.yml | 2 +- .github/workflows/notify.yml | 2 +- .github/workflows/npm-tag.yml | 2 +- .github/workflows/pr.yml | 4 ++-- .github/workflows/publish.yml | 6 +++--- .github/workflows/sponsors.yml | 2 +- 9 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 803f4cbcf0..3055e7c594 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -27,7 +27,7 @@ jobs: fail-fast: false steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v6 with: persist-credentials: true - name: Get changed files diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 3c853abb2d..854d1322eb 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -32,7 +32,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v5 + uses: actions/checkout@v6 with: persist-credentials: false diff --git a/.github/workflows/depsreview.yaml b/.github/workflows/depsreview.yaml index c5bdf2e2d0..640af43afc 100644 --- a/.github/workflows/depsreview.yaml +++ b/.github/workflows/depsreview.yaml @@ -9,7 +9,7 @@ jobs: runs-on: ubuntu-latest steps: - name: 'Checkout Repository' - uses: actions/checkout@v5 + uses: actions/checkout@v6 with: persist-credentials: false - name: 'Dependency Review' diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index 97adeb07c0..e7aa2206bf 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -14,7 +14,7 @@ jobs: pull-requests: write runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v6 with: fetch-depth: 0 - name: git config diff --git a/.github/workflows/notify.yml b/.github/workflows/notify.yml index 4c3282baee..ce74d3e3d9 100644 --- a/.github/workflows/notify.yml +++ b/.github/workflows/notify.yml @@ -32,7 +32,7 @@ jobs: # env: # GITHUB_CONTEXT: ${{ toJson(github) }} # run: echo "$GITHUB_CONTEXT" - - uses: actions/checkout@v5 + - uses: actions/checkout@v6 with: fetch-depth: 0 - name: git config diff --git a/.github/workflows/npm-tag.yml b/.github/workflows/npm-tag.yml index 7096f1be68..94dc78c836 100644 --- a/.github/workflows/npm-tag.yml +++ b/.github/workflows/npm-tag.yml @@ -14,7 +14,7 @@ jobs: contents: write id-token: write steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v6 - name: git config run: | git config user.name "${GITHUB_ACTOR}" diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index 0f70f0e416..f221b0e01a 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -19,7 +19,7 @@ jobs: releaseIt: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v6 with: fetch-depth: 0 - name: git config @@ -51,7 +51,7 @@ jobs: uses: martinbeentjes/npm-get-version-action@main - name: Extract release notes id: extract-release-notes - uses: ffurrer2/extract-release-notes@v2 + uses: ffurrer2/extract-release-notes@v3 - name: Generate PR body id: body uses: mathiasvr/command-output@v1 diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 48e5789ce4..a877b7f704 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -18,7 +18,7 @@ jobs: - name: "Release PR info" if: github.event_name != 'workflow_dispatch' run: echo "PR ${{ github.event.number }}" - - uses: actions/checkout@v5 + - uses: actions/checkout@v6 - name: git config run: | git config user.name "${GITHUB_ACTOR}" @@ -34,7 +34,7 @@ jobs: uses: martinbeentjes/npm-get-version-action@main - name: Extract release notes id: extract-release-notes - uses: ffurrer2/extract-release-notes@v2 + uses: ffurrer2/extract-release-notes@v3 - name: Check versions run: node ./bin/check-build-version.js ############# TAG RELEASE ############## @@ -65,7 +65,7 @@ jobs: needs: [publish] runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v6 with: fetch-depth: 0 - name: git config diff --git a/.github/workflows/sponsors.yml b/.github/workflows/sponsors.yml index 0396d93808..5df13dcbaa 100644 --- a/.github/workflows/sponsors.yml +++ b/.github/workflows/sponsors.yml @@ -11,7 +11,7 @@ jobs: sponsors: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v6 with: fetch-depth: 0 - name: git config From ec9d94e9f88da13e9219acadf65061fb38ce080a Mon Sep 17 00:00:00 2001 From: Nikunj Mochi <71729144+mochinikunj@users.noreply.github.com> Date: Sat, 6 Dec 2025 14:07:24 +0530 Subject: [PATCH 07/11] feat: add Node.js coverage script using c8 (closes #7289) (#7294) Co-authored-by: Jay --- package-lock.json | 457 +++++++++++++++++++++++++++++++++++++++++++++- package.json | 19 ++ 2 files changed, 470 insertions(+), 6 deletions(-) diff --git a/package-lock.json b/package-lock.json index 0455d05015..542f897c0c 100644 --- a/package-lock.json +++ b/package-lock.json @@ -28,6 +28,7 @@ "abortcontroller-polyfill": "^1.7.5", "auto-changelog": "^2.4.0", "body-parser": "^1.20.2", + "c8": "^10.1.3", "chalk": "^5.3.0", "coveralls": "^3.1.1", "cross-env": "^7.0.3", @@ -1999,6 +2000,16 @@ "node": ">=4" } }, + "node_modules/@bcoe/v8-coverage": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/@bcoe/v8-coverage/-/v8-coverage-1.0.2.tgz", + "integrity": "sha512-6zABk/ECA/QYSCQ1NGiVwwbQerUCZ+TQbp64Q3AgmfNvurHH0j8TtXa1qbShXA6qqkpAj4V5W8pP6mLe1mcMqA==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=18" + } + }, "node_modules/@colors/colors": { "version": "1.5.0", "resolved": "https://registry.npmjs.org/@colors/colors/-/colors-1.5.0.tgz", @@ -2982,6 +2993,16 @@ "node": ">=16 || 14 >=14.17" } }, + "node_modules/@istanbuljs/schema": { + "version": "0.1.3", + "resolved": "https://registry.npmjs.org/@istanbuljs/schema/-/schema-0.1.3.tgz", + "integrity": "sha512-ZXRY4jNvVgSVQ8DL3LTcakaAtXwTVUxE81hslsyD2AtoXW/wVob10HkOJ1X/pAlcI7D+2YoZKg5do8G/w6RYgA==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=8" + } + }, "node_modules/@jridgewell/gen-mapping": { "version": "0.1.1", "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.1.1.tgz", @@ -4120,6 +4141,13 @@ "integrity": "sha512-1m0bIFVc7eJWyve9S0RnuRgcQqF/Xd5QsUZAZeQFr1Q3/p9JWoQQEqmVy+DPTNpGXwhgIetAoYF8JSc33q29QA==", "dev": true }, + "node_modules/@types/istanbul-lib-coverage": { + "version": "2.0.6", + "resolved": "https://registry.npmjs.org/@types/istanbul-lib-coverage/-/istanbul-lib-coverage-2.0.6.tgz", + "integrity": "sha512-2QF/t/auWm0lsy8XtKVPG19v3sSOQlJe/YHZgfjb/KBBHOGSV+J2q/S671rcq9uTBrLAXmZpqJiaQbMT+zNU1w==", + "dev": true, + "license": "MIT" + }, "node_modules/@types/keyv": { "version": "3.1.4", "resolved": "https://registry.npmjs.org/@types/keyv/-/keyv-3.1.4.tgz", @@ -6455,6 +6483,60 @@ "node": ">= 0.8" } }, + "node_modules/c8": { + "version": "10.1.3", + "resolved": "https://registry.npmjs.org/c8/-/c8-10.1.3.tgz", + "integrity": "sha512-LvcyrOAaOnrrlMpW22n690PUvxiq4Uf9WMhQwNJ9vgagkL/ph1+D4uvjvDA5XCbykrc0sx+ay6pVi9YZ1GnhyA==", + "dev": true, + "license": "ISC", + "dependencies": { + "@bcoe/v8-coverage": "^1.0.1", + "@istanbuljs/schema": "^0.1.3", + "find-up": "^5.0.0", + "foreground-child": "^3.1.1", + "istanbul-lib-coverage": "^3.2.0", + "istanbul-lib-report": "^3.0.1", + "istanbul-reports": "^3.1.6", + "test-exclude": "^7.0.1", + "v8-to-istanbul": "^9.0.0", + "yargs": "^17.7.2", + "yargs-parser": "^21.1.1" + }, + "bin": { + "c8": "bin/c8.js" + }, + "engines": { + "node": ">=18" + }, + "peerDependencies": { + "monocart-coverage-reports": "^2" + }, + "peerDependenciesMeta": { + "monocart-coverage-reports": { + "optional": true + } + } + }, + "node_modules/c8/node_modules/istanbul-lib-coverage": { + "version": "3.2.2", + "resolved": "https://registry.npmjs.org/istanbul-lib-coverage/-/istanbul-lib-coverage-3.2.2.tgz", + "integrity": "sha512-O8dpsF+r0WV/8MNRKfnmrtCWhuKjxrq2w+jpzBL5UZKTi2LeVWnWOmWRxFlesJONmc+wLAGvKQZEOanko0LFTg==", + "dev": true, + "license": "BSD-3-Clause", + "engines": { + "node": ">=8" + } + }, + "node_modules/c8/node_modules/yargs-parser": { + "version": "21.1.1", + "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-21.1.1.tgz", + "integrity": "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==", + "dev": true, + "license": "ISC", + "engines": { + "node": ">=12" + } + }, "node_modules/cache-base": { "version": "1.0.1", "resolved": "https://registry.npmjs.org/cache-base/-/cache-base-1.0.1.tgz", @@ -13647,6 +13729,13 @@ "node": ">=10" } }, + "node_modules/html-escaper": { + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/html-escaper/-/html-escaper-2.0.2.tgz", + "integrity": "sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==", + "dev": true, + "license": "MIT" + }, "node_modules/http-cache-semantics": { "version": "4.1.1", "resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.1.1.tgz", @@ -14987,6 +15076,87 @@ "semver": "bin/semver" } }, + "node_modules/istanbul-lib-report": { + "version": "3.0.1", + "resolved": "https://registry.npmjs.org/istanbul-lib-report/-/istanbul-lib-report-3.0.1.tgz", + "integrity": "sha512-GCfE1mtsHGOELCU8e/Z7YWzpmybrx/+dSTfLrvY8qRmaY6zXTKWn6WQIjaAFw069icm6GVMNkgu0NzI4iPZUNw==", + "dev": true, + "license": "BSD-3-Clause", + "dependencies": { + "istanbul-lib-coverage": "^3.0.0", + "make-dir": "^4.0.0", + "supports-color": "^7.1.0" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/istanbul-lib-report/node_modules/istanbul-lib-coverage": { + "version": "3.2.2", + "resolved": "https://registry.npmjs.org/istanbul-lib-coverage/-/istanbul-lib-coverage-3.2.2.tgz", + "integrity": "sha512-O8dpsF+r0WV/8MNRKfnmrtCWhuKjxrq2w+jpzBL5UZKTi2LeVWnWOmWRxFlesJONmc+wLAGvKQZEOanko0LFTg==", + "dev": true, + "license": "BSD-3-Clause", + "engines": { + "node": ">=8" + } + }, + "node_modules/istanbul-lib-report/node_modules/make-dir": { + "version": "4.0.0", + "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-4.0.0.tgz", + "integrity": "sha512-hXdUTZYIVOt1Ex//jAQi+wTZZpUpwBj/0QsOzqegb3rGMMeJiSEu5xLHnYfBrRV4RH2+OCSOO95Is/7x1WJ4bw==", + "dev": true, + "license": "MIT", + "dependencies": { + "semver": "^7.5.3" + }, + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/istanbul-lib-report/node_modules/semver": { + "version": "7.7.3", + "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.3.tgz", + "integrity": "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==", + "dev": true, + "license": "ISC", + "bin": { + "semver": "bin/semver.js" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/istanbul-lib-report/node_modules/supports-color": { + "version": "7.2.0", + "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz", + "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==", + "dev": true, + "license": "MIT", + "dependencies": { + "has-flag": "^4.0.0" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/istanbul-reports": { + "version": "3.2.0", + "resolved": "https://registry.npmjs.org/istanbul-reports/-/istanbul-reports-3.2.0.tgz", + "integrity": "sha512-HGYWWS/ehqTV3xN10i23tkPkpH46MLCIMFNCaaKNavAXTF1RkqxawEPtnjnGZ6XKSInBKkiOA5BKS+aZiY3AvA==", + "dev": true, + "license": "BSD-3-Clause", + "dependencies": { + "html-escaper": "^2.0.0", + "istanbul-lib-report": "^3.0.0" + }, + "engines": { + "node": ">=8" + } + }, "node_modules/isurl": { "version": "1.0.0", "resolved": "https://registry.npmjs.org/isurl/-/isurl-1.0.0.tgz", @@ -23960,6 +24130,78 @@ "node": ">=10" } }, + "node_modules/test-exclude": { + "version": "7.0.1", + "resolved": "https://registry.npmjs.org/test-exclude/-/test-exclude-7.0.1.tgz", + "integrity": "sha512-pFYqmTw68LXVjeWJMST4+borgQP2AyMNbg1BpZh9LbyhUeNkeaPF9gzfPGUAnSMV3qPYdWUwDIjjCLiSDOl7vg==", + "dev": true, + "license": "ISC", + "dependencies": { + "@istanbuljs/schema": "^0.1.2", + "glob": "^10.4.1", + "minimatch": "^9.0.4" + }, + "engines": { + "node": ">=18" + } + }, + "node_modules/test-exclude/node_modules/brace-expansion": { + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz", + "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==", + "dev": true, + "license": "MIT", + "dependencies": { + "balanced-match": "^1.0.0" + } + }, + "node_modules/test-exclude/node_modules/glob": { + "version": "10.5.0", + "resolved": "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz", + "integrity": "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==", + "dev": true, + "license": "ISC", + "dependencies": { + "foreground-child": "^3.1.0", + "jackspeak": "^3.1.2", + "minimatch": "^9.0.4", + "minipass": "^7.1.2", + "package-json-from-dist": "^1.0.0", + "path-scurry": "^1.11.1" + }, + "bin": { + "glob": "dist/esm/bin.mjs" + }, + "funding": { + "url": "https://github.com/sponsors/isaacs" + } + }, + "node_modules/test-exclude/node_modules/minimatch": { + "version": "9.0.5", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz", + "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==", + "dev": true, + "license": "ISC", + "dependencies": { + "brace-expansion": "^2.0.1" + }, + "engines": { + "node": ">=16 || 14 >=14.17" + }, + "funding": { + "url": "https://github.com/sponsors/isaacs" + } + }, + "node_modules/test-exclude/node_modules/minipass": { + "version": "7.1.2", + "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.2.tgz", + "integrity": "sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==", + "dev": true, + "license": "ISC", + "engines": { + "node": ">=16 || 14 >=14.17" + } + }, "node_modules/text-decoder": { "version": "1.2.3", "resolved": "https://registry.npmjs.org/text-decoder/-/text-decoder-1.2.3.tgz", @@ -25176,6 +25418,28 @@ "integrity": "sha512-wa7YjyUGfNZngI/vtK0UHAN+lgDCxBPCylVXGp0zu59Fz5aiGtNXaq3DhIov063MorB+VfufLh3JlF2KdTK3xg==", "dev": true }, + "node_modules/v8-to-istanbul": { + "version": "9.3.0", + "resolved": "https://registry.npmjs.org/v8-to-istanbul/-/v8-to-istanbul-9.3.0.tgz", + "integrity": "sha512-kiGUalWN+rgBJ/1OHZsBtU4rXZOfj/7rKQxULKlIzwzQSvMJUUNgPwJEEh7gU6xEVxC0ahoOBvN2YI8GH6FNgA==", + "dev": true, + "license": "ISC", + "dependencies": { + "@jridgewell/trace-mapping": "^0.3.12", + "@types/istanbul-lib-coverage": "^2.0.1", + "convert-source-map": "^2.0.0" + }, + "engines": { + "node": ">=10.12.0" + } + }, + "node_modules/v8-to-istanbul/node_modules/convert-source-map": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz", + "integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==", + "dev": true, + "license": "MIT" + }, "node_modules/v8flags": { "version": "3.2.0", "resolved": "https://registry.npmjs.org/v8flags/-/v8flags-3.2.0.tgz", @@ -26674,10 +26938,11 @@ "dev": true }, "node_modules/yargs": { - "version": "17.6.2", - "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.6.2.tgz", - "integrity": "sha512-1/9UrdHjDZc0eOU0HxOHoS78C69UD3JRMvzlJ7S79S2nTaWRA/whGCTV8o9e/N/1Va9YIV7Q4sOxD8VV4pCWOw==", + "version": "17.7.2", + "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.2.tgz", + "integrity": "sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==", "dev": true, + "license": "MIT", "dependencies": { "cliui": "^8.0.1", "escalade": "^3.1.1", @@ -28211,6 +28476,12 @@ } } }, + "@bcoe/v8-coverage": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/@bcoe/v8-coverage/-/v8-coverage-1.0.2.tgz", + "integrity": "sha512-6zABk/ECA/QYSCQ1NGiVwwbQerUCZ+TQbp64Q3AgmfNvurHH0j8TtXa1qbShXA6qqkpAj4V5W8pP6mLe1mcMqA==", + "dev": true + }, "@colors/colors": { "version": "1.5.0", "resolved": "https://registry.npmjs.org/@colors/colors/-/colors-1.5.0.tgz", @@ -28946,6 +29217,12 @@ } } }, + "@istanbuljs/schema": { + "version": "0.1.3", + "resolved": "https://registry.npmjs.org/@istanbuljs/schema/-/schema-0.1.3.tgz", + "integrity": "sha512-ZXRY4jNvVgSVQ8DL3LTcakaAtXwTVUxE81hslsyD2AtoXW/wVob10HkOJ1X/pAlcI7D+2YoZKg5do8G/w6RYgA==", + "dev": true + }, "@jridgewell/gen-mapping": { "version": "0.1.1", "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.1.1.tgz", @@ -29800,6 +30077,12 @@ "integrity": "sha512-1m0bIFVc7eJWyve9S0RnuRgcQqF/Xd5QsUZAZeQFr1Q3/p9JWoQQEqmVy+DPTNpGXwhgIetAoYF8JSc33q29QA==", "dev": true }, + "@types/istanbul-lib-coverage": { + "version": "2.0.6", + "resolved": "https://registry.npmjs.org/@types/istanbul-lib-coverage/-/istanbul-lib-coverage-2.0.6.tgz", + "integrity": "sha512-2QF/t/auWm0lsy8XtKVPG19v3sSOQlJe/YHZgfjb/KBBHOGSV+J2q/S671rcq9uTBrLAXmZpqJiaQbMT+zNU1w==", + "dev": true + }, "@types/keyv": { "version": "3.1.4", "resolved": "https://registry.npmjs.org/@types/keyv/-/keyv-3.1.4.tgz", @@ -31735,6 +32018,39 @@ "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==", "dev": true }, + "c8": { + "version": "10.1.3", + "resolved": "https://registry.npmjs.org/c8/-/c8-10.1.3.tgz", + "integrity": "sha512-LvcyrOAaOnrrlMpW22n690PUvxiq4Uf9WMhQwNJ9vgagkL/ph1+D4uvjvDA5XCbykrc0sx+ay6pVi9YZ1GnhyA==", + "dev": true, + "requires": { + "@bcoe/v8-coverage": "^1.0.1", + "@istanbuljs/schema": "^0.1.3", + "find-up": "^5.0.0", + "foreground-child": "^3.1.1", + "istanbul-lib-coverage": "^3.2.0", + "istanbul-lib-report": "^3.0.1", + "istanbul-reports": "^3.1.6", + "test-exclude": "^7.0.1", + "v8-to-istanbul": "^9.0.0", + "yargs": "^17.7.2", + "yargs-parser": "^21.1.1" + }, + "dependencies": { + "istanbul-lib-coverage": { + "version": "3.2.2", + "resolved": "https://registry.npmjs.org/istanbul-lib-coverage/-/istanbul-lib-coverage-3.2.2.tgz", + "integrity": "sha512-O8dpsF+r0WV/8MNRKfnmrtCWhuKjxrq2w+jpzBL5UZKTi2LeVWnWOmWRxFlesJONmc+wLAGvKQZEOanko0LFTg==", + "dev": true + }, + "yargs-parser": { + "version": "21.1.1", + "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-21.1.1.tgz", + "integrity": "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==", + "dev": true + } + } + }, "cache-base": { "version": "1.0.1", "resolved": "https://registry.npmjs.org/cache-base/-/cache-base-1.0.1.tgz", @@ -37497,6 +37813,12 @@ "lru-cache": "^6.0.0" } }, + "html-escaper": { + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/html-escaper/-/html-escaper-2.0.2.tgz", + "integrity": "sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==", + "dev": true + }, "http-cache-semantics": { "version": "4.1.1", "resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.1.1.tgz", @@ -38461,6 +38783,59 @@ } } }, + "istanbul-lib-report": { + "version": "3.0.1", + "resolved": "https://registry.npmjs.org/istanbul-lib-report/-/istanbul-lib-report-3.0.1.tgz", + "integrity": "sha512-GCfE1mtsHGOELCU8e/Z7YWzpmybrx/+dSTfLrvY8qRmaY6zXTKWn6WQIjaAFw069icm6GVMNkgu0NzI4iPZUNw==", + "dev": true, + "requires": { + "istanbul-lib-coverage": "^3.0.0", + "make-dir": "^4.0.0", + "supports-color": "^7.1.0" + }, + "dependencies": { + "istanbul-lib-coverage": { + "version": "3.2.2", + "resolved": "https://registry.npmjs.org/istanbul-lib-coverage/-/istanbul-lib-coverage-3.2.2.tgz", + "integrity": "sha512-O8dpsF+r0WV/8MNRKfnmrtCWhuKjxrq2w+jpzBL5UZKTi2LeVWnWOmWRxFlesJONmc+wLAGvKQZEOanko0LFTg==", + "dev": true + }, + "make-dir": { + "version": "4.0.0", + "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-4.0.0.tgz", + "integrity": "sha512-hXdUTZYIVOt1Ex//jAQi+wTZZpUpwBj/0QsOzqegb3rGMMeJiSEu5xLHnYfBrRV4RH2+OCSOO95Is/7x1WJ4bw==", + "dev": true, + "requires": { + "semver": "^7.5.3" + } + }, + "semver": { + "version": "7.7.3", + "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.3.tgz", + "integrity": "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==", + "dev": true + }, + "supports-color": { + "version": "7.2.0", + "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz", + "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==", + "dev": true, + "requires": { + "has-flag": "^4.0.0" + } + } + } + }, + "istanbul-reports": { + "version": "3.2.0", + "resolved": "https://registry.npmjs.org/istanbul-reports/-/istanbul-reports-3.2.0.tgz", + "integrity": "sha512-HGYWWS/ehqTV3xN10i23tkPkpH46MLCIMFNCaaKNavAXTF1RkqxawEPtnjnGZ6XKSInBKkiOA5BKS+aZiY3AvA==", + "dev": true, + "requires": { + "html-escaper": "^2.0.0", + "istanbul-lib-report": "^3.0.0" + } + }, "isurl": { "version": "1.0.0", "resolved": "https://registry.npmjs.org/isurl/-/isurl-1.0.0.tgz", @@ -45459,6 +45834,57 @@ "source-map-support": "~0.5.20" } }, + "test-exclude": { + "version": "7.0.1", + "resolved": "https://registry.npmjs.org/test-exclude/-/test-exclude-7.0.1.tgz", + "integrity": "sha512-pFYqmTw68LXVjeWJMST4+borgQP2AyMNbg1BpZh9LbyhUeNkeaPF9gzfPGUAnSMV3qPYdWUwDIjjCLiSDOl7vg==", + "dev": true, + "requires": { + "@istanbuljs/schema": "^0.1.2", + "glob": "^10.4.1", + "minimatch": "^9.0.4" + }, + "dependencies": { + "brace-expansion": { + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz", + "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==", + "dev": true, + "requires": { + "balanced-match": "^1.0.0" + } + }, + "glob": { + "version": "10.5.0", + "resolved": "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz", + "integrity": "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==", + "dev": true, + "requires": { + "foreground-child": "^3.1.0", + "jackspeak": "^3.1.2", + "minimatch": "^9.0.4", + "minipass": "^7.1.2", + "package-json-from-dist": "^1.0.0", + "path-scurry": "^1.11.1" + } + }, + "minimatch": { + "version": "9.0.5", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz", + "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==", + "dev": true, + "requires": { + "brace-expansion": "^2.0.1" + } + }, + "minipass": { + "version": "7.1.2", + "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.2.tgz", + "integrity": "sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==", + "dev": true + } + } + }, "text-decoder": { "version": "1.2.3", "resolved": "https://registry.npmjs.org/text-decoder/-/text-decoder-1.2.3.tgz", @@ -46394,6 +46820,25 @@ "integrity": "sha512-wa7YjyUGfNZngI/vtK0UHAN+lgDCxBPCylVXGp0zu59Fz5aiGtNXaq3DhIov063MorB+VfufLh3JlF2KdTK3xg==", "dev": true }, + "v8-to-istanbul": { + "version": "9.3.0", + "resolved": "https://registry.npmjs.org/v8-to-istanbul/-/v8-to-istanbul-9.3.0.tgz", + "integrity": "sha512-kiGUalWN+rgBJ/1OHZsBtU4rXZOfj/7rKQxULKlIzwzQSvMJUUNgPwJEEh7gU6xEVxC0ahoOBvN2YI8GH6FNgA==", + "dev": true, + "requires": { + "@jridgewell/trace-mapping": "^0.3.12", + "@types/istanbul-lib-coverage": "^2.0.1", + "convert-source-map": "^2.0.0" + }, + "dependencies": { + "convert-source-map": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz", + "integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==", + "dev": true + } + } + }, "v8flags": { "version": "3.2.0", "resolved": "https://registry.npmjs.org/v8flags/-/v8flags-3.2.0.tgz", @@ -47582,9 +48027,9 @@ "dev": true }, "yargs": { - "version": "17.6.2", - "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.6.2.tgz", - "integrity": "sha512-1/9UrdHjDZc0eOU0HxOHoS78C69UD3JRMvzlJ7S79S2nTaWRA/whGCTV8o9e/N/1Va9YIV7Q4sOxD8VV4pCWOw==", + "version": "17.7.2", + "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.2.tgz", + "integrity": "sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==", "dev": true, "requires": { "cliui": "^8.0.1", diff --git a/package.json b/package.json index d1a33966c9..f0973efed4 100644 --- a/package.json +++ b/package.json @@ -46,6 +46,7 @@ "scripts": { "test": "npm run test:node && npm run test:browser && npm run test:package", "test:node": "npm run test:mocha", + "test:node:coverage": "c8 npm run test:mocha", "test:browser": "npm run test:karma", "test:package": "npm run test:eslint && npm run test:dtslint && npm run test:exports", "test:eslint": "node bin/ssl_hotfix.js eslint lib/**/*.js", @@ -112,6 +113,7 @@ "abortcontroller-polyfill": "^1.7.5", "auto-changelog": "^2.4.0", "body-parser": "^1.20.2", + "c8": "^10.1.3", "chalk": "^5.3.0", "coveralls": "^3.1.1", "cross-env": "^7.0.3", @@ -239,5 +241,22 @@ "extends": [ "@commitlint/config-conventional" ] + }, + "c8": { + "all": true, + "include": [ + "lib/**/*.js", + "lib/**/*.ts" + ], + "exclude": [ + "test", + "sandbox" + ], + "reporter": [ + "text", + "lcov", + "html" + ], + "report-dir": "./coverage" } } From 7d19335e43d6754a1a9a66e424f7f7da259895bf Mon Sep 17 00:00:00 2001 From: Rudransh Date: Sat, 6 Dec 2025 14:15:54 +0530 Subject: [PATCH 08/11] fix: silentJSONParsing=false should throw on invalid JSON (#7253) (#7257) Co-authored-by: Rudransh Gupta Co-authored-by: Jay --- lib/defaults/index.js | 4 +- test/regression_silent_json.js | 69 ++++++++++++++++++++++++++++++++++ 2 files changed, 71 insertions(+), 2 deletions(-) create mode 100644 test/regression_silent_json.js diff --git a/lib/defaults/index.js b/lib/defaults/index.js index cc14a8b361..b2288ae9e4 100644 --- a/lib/defaults/index.js +++ b/lib/defaults/index.js @@ -108,7 +108,7 @@ const defaults = { if (data && utils.isString(data) && ((forcedJSONParsing && !this.responseType) || JSONRequested)) { const silentJSONParsing = transitional && transitional.silentJSONParsing; - const strictJSONParsing = !silentJSONParsing && JSONRequested; + const strictJSONParsing = !silentJSONParsing; try { return JSON.parse(data, this.parseReviver); @@ -158,4 +158,4 @@ utils.forEach(['delete', 'get', 'head', 'post', 'put', 'patch'], (method) => { defaults.headers[method] = {}; }); -export default defaults; +export default defaults; \ No newline at end of file diff --git a/test/regression_silent_json.js b/test/regression_silent_json.js new file mode 100644 index 0000000000..37ecb837df --- /dev/null +++ b/test/regression_silent_json.js @@ -0,0 +1,69 @@ + +import assert from 'assert'; +import axios from '../index.js'; + +describe('Regression: Silent JSON Parsing', function () { + + beforeEach(function () { + // Mock adapter to return invalid JSON + axios.defaults.adapter = async (config) => { + return { + data: '{ invalid json }', + status: 200, + statusText: 'OK', + headers: {}, + config + }; + }; + }); + + afterEach(function () { + delete axios.defaults.adapter; + }); + + it('should throw SyntaxError when silentJSONParsing is false', async function () { + try { + await axios.get('/test', { + transitional: { + silentJSONParsing: false + } + }); + assert.fail('Should have thrown error'); + } catch (err) { + assert.ok(err.name === 'SyntaxError' || err.code === 'ERR_BAD_RESPONSE', 'Error should be SyntaxError or ERR_BAD_RESPONSE'); + } + }); + + it('should return raw string when silentJSONParsing is true (default)', async function () { + const response = await axios.get('/test', { + transitional: { + silentJSONParsing: true + } + }); + assert.strictEqual(response.data, '{ invalid json }'); + }); + + it('should throw SyntaxError when responseType is json (legacy behavior)', async function () { + try { + await axios.get('/test', { + responseType: 'json', + transitional: { + silentJSONParsing: false + } + }); + assert.fail('Should have thrown error'); + } catch (err) { + assert.ok(err.name === 'SyntaxError' || err.code === 'ERR_BAD_RESPONSE', 'Error should be SyntaxError or ERR_BAD_RESPONSE'); + } + }); + + it('should swallow error when silentJSONParsing is true and responseType is json (legacy behavior)', async function () { + const response = await axios.get('/test', { + responseType: 'json', + transitional: { + silentJSONParsing: true + } + }); + assert.strictEqual(response.data, '{ invalid json }'); + }); +}); From f7bdcd1b6c6e8a1f47598228193b0a2088dd382c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 8 Dec 2025 08:03:45 +0200 Subject: [PATCH 09/11] chore(deps-dev): bump tar-fs from 2.1.1 to 2.1.4 (#7244) Bumps [tar-fs](https://github.com/mafintosh/tar-fs) from 2.1.1 to 2.1.4. - [Commits](https://github.com/mafintosh/tar-fs/compare/v2.1.1...v2.1.4) --- updated-dependencies: - dependency-name: tar-fs dependency-version: 2.1.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jay --- package-lock.json | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/package-lock.json b/package-lock.json index 542f897c0c..d5604b1149 100644 --- a/package-lock.json +++ b/package-lock.json @@ -24066,9 +24066,9 @@ } }, "node_modules/tar-fs": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.1.tgz", - "integrity": "sha512-V0r2Y9scmbDRLCNex/+hYzvp/zyYjvFbHPNgVTKfQvVrb6guiE/fxP+XblDNR011utopbkex2nM4dHNV6GDsng==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.4.tgz", + "integrity": "sha512-mDAjwmZdh7LTT6pNleZ05Yt65HC3E+NiQzl672vQG38jIrehtJk/J3mNwIg+vShQPcLF/LV7CMnDW6vjj6sfYQ==", "dev": true, "dependencies": { "chownr": "^1.1.1", @@ -45779,9 +45779,9 @@ } }, "tar-fs": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.1.tgz", - "integrity": "sha512-V0r2Y9scmbDRLCNex/+hYzvp/zyYjvFbHPNgVTKfQvVrb6guiE/fxP+XblDNR011utopbkex2nM4dHNV6GDsng==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.4.tgz", + "integrity": "sha512-mDAjwmZdh7LTT6pNleZ05Yt65HC3E+NiQzl672vQG38jIrehtJk/J3mNwIg+vShQPcLF/LV7CMnDW6vjj6sfYQ==", "dev": true, "requires": { "chownr": "^1.1.1", From e0a120620e3728c8161ecdafb4903f373c83673a Mon Sep 17 00:00:00 2001 From: Nandan Acharya Date: Mon, 8 Dec 2025 11:52:30 +0530 Subject: [PATCH 10/11] test: add Node unit tests for toFormData and refactor buildURL to avoid param reassignment (#7272) Co-authored-by: Jay --- lib/helpers/buildURL.js | 17 +++++------ test/unit/helpers/toFormData.js | 53 +++++++++++++++++++++++++++++++++ 2 files changed, 60 insertions(+), 10 deletions(-) create mode 100644 test/unit/helpers/toFormData.js diff --git a/lib/helpers/buildURL.js b/lib/helpers/buildURL.js index 4f9c0d11bf..e159665662 100644 --- a/lib/helpers/buildURL.js +++ b/lib/helpers/buildURL.js @@ -29,29 +29,26 @@ function encode(val) { * @returns {string} The formatted url */ export default function buildURL(url, params, options) { - /*eslint no-param-reassign:0*/ if (!params) { return url; } - + const _encode = options && options.encode || encode; - if (utils.isFunction(options)) { - options = { - serialize: options - }; - } + const _options = utils.isFunction(options) ? { + serialize: options + } : options; - const serializeFn = options && options.serialize; + const serializeFn = _options && _options.serialize; let serializedParams; if (serializeFn) { - serializedParams = serializeFn(params, options); + serializedParams = serializeFn(params, _options); } else { serializedParams = utils.isURLSearchParams(params) ? params.toString() : - new AxiosURLSearchParams(params, options).toString(_encode); + new AxiosURLSearchParams(params, _options).toString(_encode); } if (serializedParams) { diff --git a/test/unit/helpers/toFormData.js b/test/unit/helpers/toFormData.js new file mode 100644 index 0000000000..1b4bada519 --- /dev/null +++ b/test/unit/helpers/toFormData.js @@ -0,0 +1,53 @@ +import assert from 'assert'; +import toFormData from '../../../lib/helpers/toFormData.js'; +import FormData from 'form-data'; + +describe('helpers::toFormData', function () { + it('should convert a flat object to FormData', function () { + const data = { + foo: 'bar', + baz: 123 + }; + + const formData = toFormData(data, new FormData()); + + assert.ok(formData instanceof FormData); + // form-data package specific checks + assert.ok(formData._streams.length > 0); + }); + + it('should convert a nested object to FormData', function () { + const data = { + foo: { + bar: 'baz' + } + }; + + const formData = toFormData(data, new FormData()); + + assert.ok(formData instanceof FormData); + }); + + it('should throw Error on circular reference', function () { + const data = { + foo: 'bar' + }; + data.self = data; + + try { + toFormData(data, new FormData()); + assert.fail('Should have thrown an error'); + } catch (e) { + assert.strictEqual(e.message, 'Circular reference detected in self'); + } + }); + + it('should handle arrays', function () { + const data = { + arr: [1, 2, 3] + }; + + const formData = toFormData(data, new FormData()); + assert.ok(formData instanceof FormData); + }); +}); From a4230f5581b3f58b6ff531b6dbac377a4fd7942a Mon Sep 17 00:00:00 2001 From: Jay Date: Mon, 8 Dec 2025 14:19:20 +0200 Subject: [PATCH 11/11] =?UTF-8?q?Revert=20"fix:=20silentJSONParsing=3Dfals?= =?UTF-8?q?e=20should=20throw=20on=20invalid=20JSON=20(#7253)=20(#7?= =?UTF-8?q?=E2=80=A6"=20(#7298)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This reverts commit 7d19335e43d6754a1a9a66e424f7f7da259895bf. --- lib/defaults/index.js | 4 +- test/regression_silent_json.js | 69 ---------------------------------- 2 files changed, 2 insertions(+), 71 deletions(-) delete mode 100644 test/regression_silent_json.js diff --git a/lib/defaults/index.js b/lib/defaults/index.js index b2288ae9e4..cc14a8b361 100644 --- a/lib/defaults/index.js +++ b/lib/defaults/index.js @@ -108,7 +108,7 @@ const defaults = { if (data && utils.isString(data) && ((forcedJSONParsing && !this.responseType) || JSONRequested)) { const silentJSONParsing = transitional && transitional.silentJSONParsing; - const strictJSONParsing = !silentJSONParsing; + const strictJSONParsing = !silentJSONParsing && JSONRequested; try { return JSON.parse(data, this.parseReviver); @@ -158,4 +158,4 @@ utils.forEach(['delete', 'get', 'head', 'post', 'put', 'patch'], (method) => { defaults.headers[method] = {}; }); -export default defaults; \ No newline at end of file +export default defaults; diff --git a/test/regression_silent_json.js b/test/regression_silent_json.js deleted file mode 100644 index 37ecb837df..0000000000 --- a/test/regression_silent_json.js +++ /dev/null @@ -1,69 +0,0 @@ - -import assert from 'assert'; -import axios from '../index.js'; - -describe('Regression: Silent JSON Parsing', function () { - - beforeEach(function () { - // Mock adapter to return invalid JSON - axios.defaults.adapter = async (config) => { - return { - data: '{ invalid json }', - status: 200, - statusText: 'OK', - headers: {}, - config - }; - }; - }); - - afterEach(function () { - delete axios.defaults.adapter; - }); - - it('should throw SyntaxError when silentJSONParsing is false', async function () { - try { - await axios.get('/test', { - transitional: { - silentJSONParsing: false - } - }); - assert.fail('Should have thrown error'); - } catch (err) { - assert.ok(err.name === 'SyntaxError' || err.code === 'ERR_BAD_RESPONSE', 'Error should be SyntaxError or ERR_BAD_RESPONSE'); - } - }); - - it('should return raw string when silentJSONParsing is true (default)', async function () { - const response = await axios.get('/test', { - transitional: { - silentJSONParsing: true - } - }); - assert.strictEqual(response.data, '{ invalid json }'); - }); - - it('should throw SyntaxError when responseType is json (legacy behavior)', async function () { - try { - await axios.get('/test', { - responseType: 'json', - transitional: { - silentJSONParsing: false - } - }); - assert.fail('Should have thrown error'); - } catch (err) { - assert.ok(err.name === 'SyntaxError' || err.code === 'ERR_BAD_RESPONSE', 'Error should be SyntaxError or ERR_BAD_RESPONSE'); - } - }); - - it('should swallow error when silentJSONParsing is true and responseType is json (legacy behavior)', async function () { - const response = await axios.get('/test', { - responseType: 'json', - transitional: { - silentJSONParsing: true - } - }); - assert.strictEqual(response.data, '{ invalid json }'); - }); -});