Skip to content

security: high-severity dependency fixes and Node 20 engines #317

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
thomasrockhu-codecov wants to merge 7 commits into from
Closed

security: high-severity dependency fixes and Node 20 engines #317

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
9b719ca
security: raise Nuxt to ~3.16.0 for patched releases
thomasrockhu-codecov Apr 2, 2026
d1d9a07
test(integration): fix Nuxt 3.16 bundle-stats snapshots
thomasrockhu-codecov Apr 3, 2026
404c941
chore: align Nuxt semver ranges with ^ convention in package.json
thomasrockhu-codecov Apr 3, 2026
3bd3717
security: resolve high-severity dependency advisories
thomasrockhu-codecov Apr 3, 2026
a3135a6
chore: require Node.js >= 20 in package engines
thomasrockhu-codecov Apr 3, 2026
cb34809
Merge branch 'main' into security/tier-s-nuxt-3-16
thomasrockhu-codecov Apr 3, 2026
bb3e913
chore: fix ESLint/prettier issues from lint run
thomasrockhu-codecov Apr 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion examples/astro-5/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
"@codecov/astro-plugin": "workspace:*",
"@types/react": "^19.0.1",
"@types/react-dom": "^19.0.2",
"astro": "^5.0.9",
"astro": "^5.15.8",
"react": "^19.0.0",
"react-dom": "^19.0.0"
}
Expand Down
14 changes: 7 additions & 7 deletions examples/astro/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,14 +11,14 @@
},
"dependencies": {
"@astrojs/check": "^0.9.4",
"@astrojs/node": "^8.3.4",
"@astrojs/react": "^3.6.3",
"@astrojs/node": "^9.0.0",
"@astrojs/react": "^4.1.1",
"@codecov/astro-plugin": "workspace:*",
"@types/react": "^18.3.12",
"@types/react-dom": "^18.3.1",
"astro": "^4.16.18",
"react": "^18.3.1",
"react-dom": "^18.3.1",
"@types/react": "^19.0.1",
"@types/react-dom": "^19.0.2",
"astro": "^5.15.8",
"react": "^19.0.0",
"react-dom": "^19.0.0",
"typescript": "^5.7.2"
}
}
6 changes: 3 additions & 3 deletions examples/bundle-analyzer-cli/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,13 +26,13 @@
"@rollup/plugin-commonjs": "^25.0.7",
"@rollup/plugin-node-resolve": "^15.2.3",
"npm-run-all": "^4.1.5",
"rollup": "^4.22.4",
"serve": "^14.2.1"
"rollup": "^4.59.1",
"serve": "^14.2.4"
},
"volta": {
"extends": "../../package.json"
},
"engines": {
"node": ">=18.0.0"
"node": ">=20.0.0"
}
}
2 changes: 1 addition & 1 deletion examples/bundle-analyzer-lib-cjs/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,6 @@
"extends": "../../package.json"
},
"engines": {
"node": ">=18.0.0"
"node": ">=20.0.0"
}
}
2 changes: 1 addition & 1 deletion examples/bundle-analyzer-lib-esm/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,6 @@
"extends": "../../package.json"
},
"engines": {
"node": ">=18.0.0"
"node": ">=20.0.0"
}
}
2 changes: 1 addition & 1 deletion examples/next-js-15/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
"lint": "next lint"
},
"dependencies": {
"next": "15.2.6",
"next": "15.2.9",
"react": "19.0.0",
"react-dom": "19.0.0"
},
Expand Down
14 changes: 7 additions & 7 deletions examples/next-js/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,18 +9,18 @@
"lint": "next lint"
},
"dependencies": {
"next": "14.2.25",
"react": "^18.3.1",
"react-dom": "^18.3.1"
"next": "15.2.9",
"react": "^19.0.0",
"react-dom": "^19.0.0"
},
"devDependencies": {
"@codecov/nextjs-webpack-plugin": "workspace:^",
"@types/node": "^20.12.12",
"@types/react": "^18.3.3",
"@types/react-dom": "^18.3.0",
"@types/react": "^19",
"@types/react-dom": "^19",
"autoprefixer": "^10.4.19",
"eslint": "^8.56.0",
"eslint-config-next": "14.2.25",
"eslint-config-next": "15.2.9",
"postcss": "^8.4.38",
"tailwindcss": "^3.4.3",
"typescript": "^5.4.5"
Expand All @@ -29,6 +29,6 @@
"extends": "../../package.json"
},
"engines": {
"node": ">=18.0.0"
"node": ">=20.0.0"
}
}
2 changes: 1 addition & 1 deletion examples/nuxt/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
"preview": "nuxt preview"
},
"dependencies": {
"nuxt": "^3.16.0",
"nuxt": "~3.16.2",
"vue": "^3.5.13",
"vue-router": "^4.5.0"
},
Expand Down
6 changes: 3 additions & 3 deletions examples/oidc/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,14 +23,14 @@
"eslint": "^8.56.0",
"eslint-plugin-react-hooks": "^4.6.0",
"eslint-plugin-react-refresh": "^0.4.5",
"rollup": "^4.22.4",
"rollup": "^4.59.1",
"typescript": "^5.3.3",
"vite": "6.3.5"
"vite": "6.4.1"
},
"volta": {
"extends": "../../package.json"
},
"engines": {
"node": ">=18.0.0"
"node": ">=20.0.0"
}
}
10 changes: 5 additions & 5 deletions examples/remix/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,16 +11,16 @@
"typecheck": "tsc"
},
"dependencies": {
"@remix-run/node": "^2.17.2",
"@remix-run/react": "^2.17.2",
"@remix-run/serve": "^2.17.2",
"@remix-run/node": "^2.17.4",
"@remix-run/react": "^2.17.4",
"@remix-run/serve": "^2.17.4",
"isbot": "^4.1.0",
"react": "^18.2.0",
"react-dom": "^18.2.0"
},
"devDependencies": {
"@codecov/remix-vite-plugin": "workspace:^",
"@remix-run/dev": "^2.17.2",
"@remix-run/dev": "^2.17.4",
"@types/react": "^18.2.20",
"@types/react-dom": "^18.2.7",
"@typescript-eslint/eslint-plugin": "^6.7.4",
Expand All @@ -35,7 +35,7 @@
"postcss": "^8.4.38",
"tailwindcss": "^3.4.4",
"typescript": "^5.1.6",
"vite": "6.3.5",
"vite": "6.4.1",
"vite-tsconfig-paths": "^4.2.1"
},
"engines": {
Expand Down
6 changes: 3 additions & 3 deletions examples/rollup/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,13 +17,13 @@
"@rollup/plugin-commonjs": "^25.0.7",
"@rollup/plugin-node-resolve": "^15.2.3",
"npm-run-all": "^4.1.5",
"rollup": "^4.22.4",
"serve": "^14.2.1"
"rollup": "^4.59.1",
"serve": "^14.2.4"
},
"volta": {
"extends": "../../package.json"
},
"engines": {
"node": ">=18.0.0"
"node": ">=20.0.0"
}
}
4 changes: 2 additions & 2 deletions examples/solidstart/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,11 +12,11 @@
"@solidjs/meta": "^0.29.4",
"@solidjs/router": "^0.14.1",
"@solidjs/start": "^1.0.10",
"solid-js": "^1.8.18",
"solid-js": "^1.9.4",
"vinxi": "^0.4.3",
"vite-plugin-solid": "^2.11.0"
},
"engines": {
"node": ">=18"
"node": ">=20.0.0"
}
}
2 changes: 1 addition & 1 deletion examples/sveltekit/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@
"svelte-check": "^4.1.1",
"tslib": "^2.4.1",
"typescript": "^5.0.0",
"vite": "6.3.5"
"vite": "6.4.1"
},
"type": "module"
}
6 changes: 3 additions & 3 deletions examples/tokenless/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,14 +23,14 @@
"eslint": "^8.56.0",
"eslint-plugin-react-hooks": "^4.6.0",
"eslint-plugin-react-refresh": "^0.4.5",
"rollup": "^4.22.4",
"rollup": "^4.59.1",
"typescript": "^5.3.3",
"vite": "6.3.5"
"vite": "6.4.1"
},
"volta": {
"extends": "../../package.json"
},
"engines": {
"node": ">=18.0.0"
"node": ">=20.0.0"
}
}
6 changes: 3 additions & 3 deletions examples/vite/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,14 +23,14 @@
"eslint": "^8.56.0",
"eslint-plugin-react-hooks": "^4.6.0",
"eslint-plugin-react-refresh": "^0.4.5",
"rollup": "^4.22.4",
"rollup": "^4.59.1",
"typescript": "^5.3.3",
"vite": "6.3.5"
"vite": "6.4.1"
},
"volta": {
"extends": "../../package.json"
},
"engines": {
"node": ">=18.0.0"
"node": ">=20.0.0"
}
}
4 changes: 2 additions & 2 deletions examples/webpack/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,15 +6,15 @@
"build": "webpack --config webpack.config.js"
},
"dependencies": {
"lodash": "^4.17.21"
"lodash": "^4.18.0"
},
"devDependencies": {
"@codecov/webpack-plugin": "workspace:^",
"webpack": "^5.96.1",
"webpack-cli": "^5.1.4"
},
"engines": {
"node": ">=18.0.0"
"node": ">=20.0.0"
},
"volta": {
"extends": "../../package.json"
Expand Down
16 changes: 8 additions & 8 deletions integration-tests/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@
"format:check": "prettier '**/*.{cjs,mjs,ts,tsx,md,json}' --ignore-path ../.gitignore --ignore-unknown --no-error-on-unmatched-pattern --check"
},
"dependencies": {
"lodash": "^4.17.21"
"lodash": "^4.18.0"
},
"devDependencies": {
"@codecov/astro-plugin": "workspace:*",
Expand All @@ -39,9 +39,9 @@
"@codecov/sveltekit-plugin": "workspace:^",
"@codecov/vite-plugin": "workspace:^",
"@codecov/webpack-plugin": "workspace:^",
"@remix-run/dev": "^2.17.2",
"@remix-run/node": "^2.17.2",
"@remix-run/react": "^2.17.2",
"@remix-run/dev": "^2.17.4",
"@remix-run/node": "^2.17.4",
"@remix-run/react": "^2.17.4",
"@rollup/plugin-commonjs": "^25.0.7",
"@rollup/plugin-node-resolve": "^15.2.3",
"@solidjs/start": "^1.0.10",
Expand All @@ -50,16 +50,16 @@
"@types/node": "^20.11.15",
"bun": "^1.1.4",
"isbot": "^4.1.0",
"nuxt": "^3.16.0",
"nuxt": "~3.16.2",
"react": "^18.2.0",
"react-dom": "^18.2.0",
"rollupV3": "npm:rollup@3.29.5",
"rollupV4": "npm:rollup@4.22.4",
"rollupV3": "npm:rollup@3.30.0",
"rollupV4": "npm:rollup@4.59.1",
"ts-node": "^10.9.2",
"vite-plugin-solid": "^2.11.0",
"viteV4": "npm:vite@4.5.14",
"viteV5": "npm:vite@5.4.19",
"viteV6": "npm:vite@6.3.5",
"viteV6": "npm:vite@6.4.1",
"vue-routerV4": "npm:vue-router@4.3.0",
"vueV3": "npm:vue@3.4.21",
"webpackV5": "npm:webpack@5.90.0"
Expand Down
25 changes: 10 additions & 15 deletions integration-tests/test-apps/astro-4/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,26 +1,21 @@
{
"name": "astro",
"name": "astro-4",
"type": "module",
"version": "0.0.1",
"scripts": {
"dev": "astro dev",
"start": "astro dev",
"build": "astro check && astro build",
"build": "astro build",
"preview": "astro preview",
"astro": "astro"
},
"dependencies": {
"@astrojs/check": "^0.9.4",
"@astrojs/node": "^8.3.4",
"@astrojs/react": "^3.6.3",
"@types/react": "^18.3.12",
"@types/react-dom": "^18.3.1",
"astro": "^4.16.18",
"react": "^18.3.1",
"react-dom": "^18.3.1",
"typescript": "^5.7.2"
},
"devDependencies": {
"@codecov/astro-plugin": "workspace:*"
"@astrojs/node": "^9.0.0",
"@astrojs/react": "^4.1.1",
"@codecov/astro-plugin": "workspace:*",
"@types/react": "^19.0.1",
"@types/react-dom": "^19.0.2",
"astro": "^5.15.8",
Copy link
Copy Markdown

@calvin-codecov calvin-codecov Apr 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This directory is called test-apps/astro-4 but we've changed astro to be 5.15.8, the same as the astro-5 directory's version. This seems like we are losing coverage

Copy link
Copy Markdown
Contributor Author

@thomasrockhu-codecov thomasrockhu-codecov Apr 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nice catch

"react": "^19.0.0",
"react-dom": "^19.0.0"
}
}
2 changes: 1 addition & 1 deletion integration-tests/test-apps/astro-5/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
"@codecov/astro-plugin": "workspace:*",
"@types/react": "^19.0.1",
"@types/react-dom": "^19.0.2",
"astro": "^5.0.9",
"astro": "^5.15.8",
"react": "^19.0.0",
"react-dom": "^19.0.0"
}
Expand Down
2 changes: 1 addition & 1 deletion integration-tests/test-apps/bundle-analyzer/dotenv-vercel/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,6 @@
"@codecov/bundle-analyzer": "workspace:^",
"dotenv": "^16.4.5",
"typescript": "^5.0.2",
"vite": "6.3.5"
"vite": "6.4.1"
}
}
10 changes: 5 additions & 5 deletions integration-tests/test-apps/nextjs/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,15 +9,15 @@
"lint": "next lint"
},
"dependencies": {
"react": "^18",
"react-dom": "^18",
"next": "14.2.25"
"react": "^19",
"react-dom": "^19",
"next": "15.2.9"
},
"devDependencies": {
"@codecov/nextjs-webpack-plugin": "workspace:^",
"typescript": "^5",
"@types/node": "^20",
"@types/react": "^18",
"@types/react-dom": "^18"
"@types/react": "^19",
"@types/react-dom": "^19"
}
}
2 changes: 1 addition & 1 deletion integration-tests/test-apps/nuxt/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
"preview": "nuxt preview"
},
"dependencies": {
"nuxt": "^3.16.0",
"nuxt": "~3.16.2",
"vue": "^3.5.13",
"vue-router": "^4.5.0"
},
Expand Down
Loading
Loading