Fix/security/2026-04-16

[chaimleib]

npm audit was reporting 16 vulnerabilities (3 moderate, 8 high, 5 critical) from transitive dependencies. This PR fixes our dependencies to resolve them.

The starting commit is tagged v0.3.4, the latest release. Somehow, that wasn't merged into master yet.

Removed/Replaced

To reduce the maintenance burden, it helps to have fewer dependencies, so some dependencies were removed.

It is also important to replace unmaintained dependencies containing known security vulnerabilities.

• mocha - replaced with test, which is built-in since Node v18.0.0.
  • the function provided to it now has a slightly different signature. It used to be function(done), but now it's function(t, done).
• should - replaced with assert/strict, which is built-in since Node v9.9.0.
• pre-commit - replaced with husky, which is actively-maintained.

Upgrades

• package-lock.json format to v3
• js-yaml 3.13.1 -> 4.1.1
  • safeLoad replaced with load
• fast-xml-parser 3.17.4 -> 5.6.0
  • validate was moved to XMLValidator.validate
• dockerode 2.2.9 -> 5.0.0
• junit-report-builder 2.1.0 -> 5.1.2
• lodash 2.4.2 -> 4.18.1
  • replaced some lodash calls with native calls to make debugging the upgrade easier
  • replaced _.merge with _.mergeWith
  • _.clone in lodash 4 no longer takes an isDeep argument, and clones shallow by default. To continue respecting isDeep, swap it out as needed with _.cloneDeep.
  • fixed an issue where in rules YAML files with multiple includes, required_instructions is initialized as an array, but objects are _.merge-d into it. In lodash 2 and 3, the object replaced the array. In lodash 4, the object gets appended to the array, which made tests fail. The fix was to delay normalizing required_instructions to objects until after the merge is done.

Other fixes

test/integration/exec.spec.js: should validate remote (https) Dockerfile

Encountered during refactor: remove devDeps mocha and should

Problems

• This test was timing out.
• Also, it was fetching a Dockerfile from the master branch of projectatomic/dockerfile_lint, which could get out-of-sync with the branch being tested.

Fix

Spawn a temporary HTTP server which serves the specified Dockerfile, but using the current commit. No more timeouts. No more possibility of master having an incompatible version of the Dockerfile.