chore: migrate to Yarn 4 and upgrade dependencies (#655)

oliverlaz · github-advanced-security[bot] · web-flow · commit 5b5c68c22c44 · 2026-06-12T14:45:11.000+02:00
* chore: migrate to Yarn 4 and upgrade dependencies
* chore: adapt CI workflows to Yarn 4 and upgrade webpack
- setup-node action: use 'yarn install --immutable' (Yarn 4 syntax)
- unit.yml: drop Node 16 from matrix (Yarn 4 requires Node &gt;=18), bump checkout to v6
- bump webpack to ^5.107.2
* chore: restore Node 16 unit tests via Babel

Node 16 can't run Yarn 4 or tsx (both require Node &gt;=18). Run the unit
suite on Node 16 in a dedicated job: install deps on Node 24, then switch
to Node 16 and run mocha through @babel/register instead of tsx.

* Potential fix for pull request finding 'CodeQL / Workflow does not contain permissions'

Co-authored-by: Copilot Autofix powered by AI &lt;62310815+github-advanced-security[bot]@users.noreply.github.com&gt;

---------

Co-authored-by: Copilot Autofix powered by AI &lt;62310815+github-advanced-security[bot]@users.noreply.github.com&gt;
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
@@ -1 +1 @@
-* @arnautov-anton @MartinCupela @xernobyl @JimmyPettersson85 @itsmeadi
+* @arnautov-anton @MartinCupela @JimmyPettersson85 @itsmeadi
diff --git a/.github/actions/setup-node/action.yml b/.github/actions/setup-node/action.yml
@@ -13,14 +13,14 @@ runs:
   using: 'composite'
   steps:
     - name: Setup Node
-      uses: actions/setup-node@v5
+      uses: actions/setup-node@v6
       with:
         node-version: ${{ inputs.node-version }}
         registry-url: 'https://registry.npmjs.org'
         cache: 'yarn'
 
-    - name: Install Dependencies & Build
-      run: yarn install --frozen-lockfile --ignore-engines
+    - name: Install Dependencies
+      run: yarn install --immutable
       shell: bash
       env:
         PUPPETEER_SKIP_DOWNLOAD: ${{ inputs.skip-puppeteer }}
diff --git a/.github/workflows/browser.yml b/.github/workflows/browser.yml
@@ -10,7 +10,7 @@ jobs:
   browser:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/setup-node
       - name: Install Chrome
         run: npx puppeteer browsers install chrome
diff --git a/.github/workflows/cloud.yml b/.github/workflows/cloud.yml
@@ -10,7 +10,7 @@ jobs:
   qa:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/setup-node
       - name: Test
         env:
diff --git a/.github/workflows/initiate_release.yml b/.github/workflows/initiate_release.yml
@@ -12,7 +12,7 @@ jobs:
     name: 🚀 Create release PR
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0 # gives the changelog generator access to all previous commits
 
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
@@ -10,7 +10,7 @@ jobs:
   integration:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/setup-node
       - name: Test
         env:
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -10,7 +10,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/setup-node
       - name: Lint
         run: yarn run lint
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -16,7 +16,7 @@ jobs:
     if: github.event.pull_request.merged && startsWith(github.head_ref, 'release-')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/size.yml b/.github/workflows/size.yml
@@ -12,7 +12,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: preactjs/compressed-size-action@v2
         env:
           PUPPETEER_SKIP_DOWNLOAD: 'true'
diff --git a/.github/workflows/type.yml b/.github/workflows/type.yml
@@ -10,7 +10,7 @@ jobs:
   types:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/setup-node
       - name: Type check
         run: yarn run types
diff --git a/.github/workflows/unit.yml b/.github/workflows/unit.yml
@@ -6,14 +6,17 @@ on:
       - 'main'
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   unit:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node: [16, 18, 20, 22, 24]
+        node: [18, 20, 22, 24]
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/setup-node
         with:
           node-version: ${{ matrix.node }}
@@ -23,3 +26,21 @@ jobs:
           STREAM_API_KEY: ${{ secrets.STREAM_API_KEY }}
           STREAM_API_SECRET: ${{ secrets.STREAM_API_SECRET }}
         run: yarn run test-unit-node
+
+  # Node 16 can't run Yarn 4 or tsx (both require Node >= 18), so we install
+  # dependencies on a supported Node version and then switch to Node 16 to run
+  # the suite through Babel (see babel-register.js).
+  unit-node16:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/setup-node
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 16
+      - name: Test
+        env:
+          STREAM_APP_ID: ${{ secrets.STREAM_APP_ID }}
+          STREAM_API_KEY: ${{ secrets.STREAM_API_KEY }}
+          STREAM_API_SECRET: ${{ secrets.STREAM_API_SECRET }}
+        run: npm run test-unit-node16
diff --git a/.gitignore b/.gitignore
@@ -19,6 +19,13 @@ coverage.lcov
 # Grunt intermediate storage (http://gruntjs.com/creating-plugins#storing-task-files)
 .grunt
 
+.yarn/*
+!.yarn/patches
+!.yarn/plugins
+!.yarn/releases
+!.yarn/sdks
+!.yarn/versions
+
 # Compiled binary addons (http://nodejs.org/api/addons.html)
 build/Release
 
diff --git a/.yarn/releases/yarn-4.16.0.cjs b/.yarn/releases/yarn-4.16.0.cjs
diff --git a/.yarnrc.yml b/.yarnrc.yml
@@ -0,0 +1,9 @@
+enableHardenedMode: true
+
+enableScripts: false
+
+nodeLinker: node-modules
+
+npmMinimalAgeGate: 1d
+
+yarnPath: .yarn/releases/yarn-4.16.0.cjs
diff --git a/babel-register.js b/babel-register.js
@@ -1,3 +1,37 @@
 /* eslint-disable import/no-extraneous-dependencies */
-require('@babel/register')({ extensions: ['.js', '.ts'] });
+
+// Babel register hook used to run the unit suite on Node 16, where `tsx`
+// (which requires Node >= 18) can't be used. Babel runs fine on Node 16, so we
+// transpile `.ts`/`.js` on the fly to CommonJS here instead.
+//
+// One test (`test/unit/node/client_test.js`) uses `import.meta.url` with
+// `createRequire` to read package.json. `tsx` rewrites `import.meta` for CJS,
+// but Babel leaves it as-is, so we rewrite it ourselves. `createRequire`
+// accepts a path, so mapping `import.meta` -> `{ url: __filename }` is enough.
+function transformImportMeta({ template }) {
+  return {
+    visitor: {
+      MetaProperty(path) {
+        const { node } = path;
+        if (node.meta && node.meta.name === 'import' && node.property.name === 'meta') {
+          path.replaceWith(template.expression.ast('({ url: __filename })'));
+        }
+      },
+    },
+  };
+}
+
+require('@babel/register')({
+  extensions: ['.js', '.ts'],
+  babelrc: false,
+  configFile: false,
+  presets: [['@babel/preset-env', { targets: { node: '16' }, modules: 'commonjs' }], '@babel/preset-typescript'],
+  plugins: [
+    transformImportMeta,
+    '@babel/plugin-transform-object-assign',
+    '@babel/plugin-proposal-object-rest-spread',
+    '@babel/plugin-proposal-class-properties',
+  ],
+});
+
 require('dotenv').config();
diff --git a/package.json b/package.json
@@ -26,6 +26,7 @@
     "test": "yarn run test-unit-node",
     "test-types": "tsc --skipLibCheck --target es2020 --esModuleInterop true --noEmit true test/typescript/*.ts",
     "test-unit-node": "mocha --require tsx/cjs --require dotenv/config test/unit/common test/unit/node",
+    "test-unit-node16": "mocha --require ./babel-register.js test/unit/common test/unit/node",
     "test-integration-node": "mocha --require tsx/cjs --require dotenv/config test/integration/common test/integration/node --exit",
     "test-cloud": "mocha --require tsx/cjs --require dotenv/config test/integration/cloud --timeout 40000 --exit",
     "test-cloud-local": "LOCAL=true mocha --require tsx/cjs --require dotenv/config test/integration/cloud --timeout 40000 --ignore 'test/integration/cloud/{personalized_feed,files,images}.js'",
@@ -41,14 +42,14 @@
     }
   },
   "browser": {
-    "crypto": false,
-    "jsonwebtoken": false,
     "./lib/batch_operations.js": false,
     "./lib/redirect_url.js": false,
-    "qs": false,
-    "url": false,
+    "crypto": false,
     "http": false,
-    "https": false
+    "https": false,
+    "jsonwebtoken": false,
+    "qs": false,
+    "url": false
   },
   "react-native": {
     "crypto": false,
@@ -59,30 +60,31 @@
     "url": false
   },
   "devDependencies": {
-    "@babel/cli": "^7.23.0",
-    "@babel/core": "^7.23.3",
-    "@babel/eslint-parser": "^7.23.3",
-    "@babel/node": "^7.22.19",
-    "@babel/plugin-proposal-class-properties": "^7.16.7",
-    "@babel/plugin-proposal-object-rest-spread": "^7.16.7",
-    "@babel/plugin-transform-object-assign": "^7.23.3",
-    "@babel/plugin-transform-runtime": "^7.23.3",
-    "@babel/preset-env": "^7.23.3",
-    "@babel/preset-typescript": "^7.23.3",
-    "@babel/register": "^7.22.15",
+    "@babel/cli": "^7.29.7",
+    "@babel/core": "^7.29.7",
+    "@babel/eslint-parser": "^7.29.7",
+    "@babel/node": "^7.29.7",
+    "@babel/plugin-proposal-class-properties": "^7.18.6",
+    "@babel/plugin-proposal-object-rest-spread": "^7.20.7",
+    "@babel/plugin-transform-object-assign": "^7.29.7",
+    "@babel/plugin-transform-runtime": "^7.29.7",
+    "@babel/preset-env": "^7.29.7",
+    "@babel/preset-typescript": "^7.29.7",
+    "@babel/register": "^7.29.7",
     "@commitlint/cli": "^18.4.1",
     "@commitlint/config-conventional": "^18.4.0",
+    "@types/node": "^18.19.130",
     "@typescript-eslint/eslint-plugin": "^6.10.0",
     "@typescript-eslint/parser": "^6.10.0",
-    "babel-loader": "^9.1.2",
+    "babel-loader": "^9.2.1",
     "chai": "^4.3.10",
     "dotenv": "^16.0.3",
     "eslint": "^8.53.0",
     "eslint-config-airbnb-base": "^15.0.0",
-    "eslint-config-prettier": "^9.0.0",
+    "eslint-config-prettier": "^9.1.2",
     "eslint-plugin-chai-friendly": "^0.7.2",
     "eslint-plugin-import": "^2.29.0",
-    "eslint-plugin-prettier": "^5.0.1",
+    "eslint-plugin-prettier": "^5.5.6",
     "eslint-plugin-sonarjs": "^0.23.0",
     "eslint-plugin-typescript-sort-keys": "^3.1.0",
     "expect.js": "^0.3.1",
@@ -106,18 +108,18 @@
     "testdouble": "3.20.0",
     "tsx": "^4.21.0",
     "typescript": "^5.2.2",
-    "webpack": "^5.89.0",
+    "webpack": "^5.107.2",
     "webpack-cli": "^5.1.1"
   },
   "dependencies": {
-    "@babel/runtime": "^7.26.10",
+    "@babel/runtime": "^7.29.7",
     "@types/jsonwebtoken": "^9.0.5",
     "@types/qs": "^6.9.10",
-    "axios": "^1.13.5",
+    "axios": "^1.17.0",
     "faye": "^1.4.0",
-    "follow-redirects": "1.15.6",
+    "follow-redirects": "^1.16.0",
     "form-data": "^4.0.4",
-    "jsonwebtoken": "^9.0.2",
+    "jsonwebtoken": "^9.0.3",
     "jwt-decode": "^4.0.0",
     "qs": "^6.14.2"
   },
@@ -150,5 +152,5 @@
     "stream.io",
     "getstream"
   ],
-  "packageManager": "yarn@1.22.22+sha1.ac34549e6aa8e7ead463a7407e1c7390f61a6610"
+  "packageManager": "yarn@4.16.0"
 }
diff --git a/yarn.lock b/yarn.lock

Original file line number	Diff line number	Diff line change
`@@ -1 +1 @@`
`1`		`-* @arnautov-anton @MartinCupela @xernobyl @JimmyPettersson85 @itsmeadi`
	`1`	`+* @arnautov-anton @MartinCupela @JimmyPettersson85 @itsmeadi`