fix: xss vulnerability in mocha #2469
Conversation
WalkthroughThis pull request updates the version numbers of the Mocha testing framework and several related dependencies across various configuration and package files. The update changes Mocha from version 10.2.0 to 11.1.0, with additional modifications in other packages such as debug, diff, terser, minimatch, yargs, and yargs-parser. The changes are applied consistently in files like Changes
Possibly Related PRs
Suggested Reviewers
Poem
✨ Finishing Touches
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (30)
.yarn/cache/@jridgewell-source-map-npm-0.3.2-6fd1f37b22-1aaa42075b.zipis excluded by!**/.yarn/**,!**/*.zip.yarn/cache/@ungap-promise-all-settled-npm-1.1.2-c0f42e147b-ee8fe811be.zipis excluded by!**/.yarn/**,!**/*.zip.yarn/cache/ansi-colors-npm-4.1.3-8ffd0ae6c7-43d6e2fc7b.zipis excluded by!**/.yarn/**,!**/*.zip.yarn/cache/chokidar-npm-3.6.0-3c413a828f-c327fb0770.zipis excluded by!**/.yarn/**,!**/*.zip.yarn/cache/cliui-npm-8.0.1-3b029092cf-eaa5561aeb.zipis excluded by!**/.yarn/**,!**/*.zip.yarn/cache/debug-npm-4.3.3-710fd4cc7f-723a9570dc.zipis excluded by!**/.yarn/**,!**/*.zip.yarn/cache/debug-npm-4.4.0-f6efe76023-1847944c2e.zipis excluded by!**/.yarn/**,!**/*.zip.yarn/cache/diff-npm-5.0.0-ad6900db18-4a179a75b1.zipis excluded by!**/.yarn/**,!**/*.zip.yarn/cache/diff-npm-5.2.0-f523a581f3-01b7b440f8.zipis excluded by!**/.yarn/**,!**/*.zip.yarn/cache/glob-npm-7.2.0-bb4644d239-bc78b6ea07.zipis excluded by!**/.yarn/**,!**/*.zip.yarn/cache/growl-npm-1.10.5-2d1da54198-1391a9add9.zipis excluded by!**/.yarn/**,!**/*.zip.yarn/cache/minimatch-npm-4.2.1-558ec7f418-27e49fb720.zipis excluded by!**/.yarn/**,!**/*.zip.yarn/cache/minimatch-npm-5.0.1-612724f6f0-2656580f18.zipis excluded by!**/.yarn/**,!**/*.zip.yarn/cache/mocha-npm-10.2.0-87db25c7c5-f7362898ae.zipis excluded by!**/.yarn/**,!**/*.zip.yarn/cache/mocha-npm-11.1.0-7c863baca0-50d1305813.zipis excluded by!**/.yarn/**,!**/*.zip.yarn/cache/mocha-npm-9.2.2-f7735febb8-8ee58bff86.zipis excluded by!**/.yarn/**,!**/*.zip.yarn/cache/nanoid-npm-3.3.8-d22226208b-2d1766606c.zipis excluded by!**/.yarn/**,!**/*.zip.yarn/cache/schema-utils-npm-4.3.0-6f0a75e2e2-86c5a7c72a.zipis excluded by!**/.yarn/**,!**/*.zip.yarn/cache/serialize-javascript-npm-6.0.0-0bb8a3c88d-ed3dabfbb5.zipis excluded by!**/.yarn/**,!**/*.zip.yarn/cache/terser-npm-5.14.2-b0f8815852-0646b5db1d.zipis excluded by!**/.yarn/**,!**/*.zip.yarn/cache/terser-npm-5.39.0-127c67156d-d84aff6423.zipis excluded by!**/.yarn/**,!**/*.zip.yarn/cache/terser-webpack-plugin-npm-5.3.11-1a5bba0883-a8f7c92c75.zipis excluded by!**/.yarn/**,!**/*.zip.yarn/cache/terser-webpack-plugin-npm-5.3.3-659a8e4514-db2bc0e570.zipis excluded by!**/.yarn/**,!**/*.zip.yarn/cache/workerpool-npm-6.2.0-d2a722f6bb-c7dce6eae0.zipis excluded by!**/.yarn/**,!**/*.zip.yarn/cache/workerpool-npm-6.2.1-1486cb2056-3e637f7632.zipis excluded by!**/.yarn/**,!**/*.zip.yarn/cache/workerpool-npm-6.5.1-7e0dd85ca7-b1b00139fe.zipis excluded by!**/.yarn/**,!**/*.zip.yarn/cache/yargs-npm-17.7.2-80b62638e1-abb3e37678.zipis excluded by!**/.yarn/**,!**/*.zip.yarn/cache/yargs-parser-npm-20.2.4-1de20916a6-db8f251ae4.zipis excluded by!**/.yarn/**,!**/*.zip.yarn/cache/yargs-parser-npm-21.1.1-8fdc003314-9dc2c217ea.zipis excluded by!**/.yarn/**,!**/*.zipyarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (21)
.pnp.cjs(39 hunks).yarnrc.yml(1 hunks)packages/bench-suite/package.json(1 hunks)packages/dapi-grpc/package.json(1 hunks)packages/dapi/package.json(1 hunks)packages/dash-spv/package.json(1 hunks)packages/dashmate/package.json(1 hunks)packages/dashpay-contract/package.json(1 hunks)packages/dpns-contract/package.json(1 hunks)packages/feature-flags-contract/package.json(1 hunks)packages/js-dapi-client/package.json(1 hunks)packages/js-dash-sdk/package.json(2 hunks)packages/js-grpc-common/package.json(1 hunks)packages/masternode-reward-shares-contract/package.json(1 hunks)packages/platform-test-suite/package.json(1 hunks)packages/search-contract/package.json(1 hunks)packages/token-history-contract/package.json(1 hunks)packages/wallet-lib/package.json(1 hunks)packages/wallet-utils-contract/package.json(1 hunks)packages/wasm-dpp/package.json(1 hunks)packages/withdrawals-contract/package.json(1 hunks)
✅ Files skipped from review due to trivial changes (3)
- packages/feature-flags-contract/package.json
- packages/js-grpc-common/package.json
- packages/token-history-contract/package.json
🔇 Additional comments (56)
.pnp.cjs (38)
2574-2580: Mocha Upgrade Verification
The dependency for Mocha is updated to"npm:11.1.0", which is a key part of this PR to help mitigate the XSS vulnerability (via transitively updatingserialize-javascript). Please double-check that all dependent modules are compatible with this new version.
2622-2628: Consistent Mocha Version Update
Mocha is consistently updated to"npm:11.1.0"in this section. Verify that no residual references to the old version remain and that version resolution is handled correctly by Yarn.
2673-2679: Mocha Dependency Consistency Check
The Mocha dependency here has also been updated to"npm:11.1.0". Confirm that this uniform update avoids any version conflicts.
2712-2718: Mocha Update in Reporter Section
The updated Mocha version"npm:11.1.0"is applied in this block. Ensure that testing frameworks and reporters referencing Mocha are adjusted accordingly.
2743-2749: Mocha Version Correctness Check
This hunk shows another instance of Mocha being updated to"npm:11.1.0". The change is consistent; just verify that any build or test scripts invoking Mocha use this version.
2814-2820: Mocha Version Consistency
Mocha is updated to"npm:11.1.0"here as well. Please ensure that the Yarn resolution strategy selects the correct version across the repository.
2856-2862: Mocha Dependency Update Check
The update to"npm:11.1.0"for Mocha in this segment appears correct. It’s important that tests pick up the upgraded version without breaking changes.
2874-2880: Mocha Dependency Verification
Mocha is again updated to"npm:11.1.0". Confirm that integration with other tools (e.g., Karma) is unaffected by this version bump.
2898-2904: Mocha Update for Consistency
The dependency update to"npm:11.1.0"is consistently applied in this range. No issues detected.
2919-2925: Mocha Dependency Version Check
Once more, Mocha is updated to"npm:11.1.0". It is essential to ensure that package-lock (or equivalent) files reflect this change correctly.
2984-2990: Mocha Update in Testing Environment
The version update to Mocha"npm:11.1.0"is applied here. Please verify that tests and scripts invoking Mocha do not rely on features deprecated in this version.
3048-3054: Mocha Dependency Version Steady
The dependency remains updated to"npm:11.1.0". Consistency in updates like these is key for avoiding subtle bugs.
3090-3096: Mocha Version Update Verified
Another instance of Mocha being bumped to"npm:11.1.0"; this is in line with the overall update objective.
3125-3131: Mocha Dependency Consistency
Mocha is updated to"npm:11.1.0"in this block as well. Verify that no downstream configuration depends on the old major version.
3173-3179: Mocha Update Checkpoint
The update to"npm:11.1.0"is reasserted here. It’s important that any breaking changes introduced between Mocha versions are properly tested.
3204-3210: Mocha Version Update Consistency
The Mocha dependency is updated to"npm:11.1.0". Confirm that all scripts and configuration files reference the updated version.
3917-3923: Debug Dependency Update
Thedebugpackage’s virtual reference is updated to use"npm:4.3.4". Verify that this change is compatible with any modules relying ondebugfunctionality.
3951-3957: Debug Dependency Consistency
Again, thedebugpackage is updated to"npm:4.3.4". This consistency should help avoid conflicts between direct and transitive dependencies.
3986-3992: Debug Version Update Verification
The second update fordebugto"npm:4.3.4"confirms consistency. This should streamline debugging capabilities across the project.
6064-6074: Ansi-Colors Version Update
Theansi-colorspackage appears to have been updated from"npm:4.1.1"to"npm:4.1.3". Ensure that both the soft and hard link entries use the correct version to avoid runtime discrepancies.
7519-7538: Chokidar Dependency Update
This hunk updates thechokidarpackage details along with its supporting dependencies. Verify that file-watching functionality works as expected after these updates.
7722-7736: CLIUI and Wrap-Ansi Updates
The updates here address new versions for packages such ascliuiandwrap-ansi. Please confirm that these changes do not affect CLI output formatting or other related features.
8561-8567: Mocha Version Enforcement
Once again, Mocha is updated to"npm:11.1.0". Verify that the dependency graph is consistent and that no legacy references persist.
8574-8580: Terser-Webpack-Plugin Version Update
The update toterser-webpack-pluginto"npm:5.3.11"is applied here. Ensure that the webpack build and asset bundling are working correctly after this bump.
8634-8640: Consistent Mocha Dependency Update
The Mocha dependency is updated once more to"npm:11.1.0", maintaining consistency throughout the file.
8709-8735: Debug Dependency and Virtual Package Update
This hunk revises the virtual package information fordebugand updates its version to"npm:4.4.0". Double-check that all modules referencingdebugresolve to the intended version.
8786-8796: Consistent Debug Dependency Updates
The virtual reference fordebugis confirmed updated here. Good consistency across the changes.
9062-9078: Diff Package Version Bump
Thediffpackage version is bumped from"npm:5.1.0"to"npm:5.2.0". This minor update should improve functionality without breaking dependent modules.
12964-12970: Mocha Version Update Consistency
Mocha is updated to"npm:11.1.0"again in this block. Maintain vigilance regarding version compatibility across all sub-packages.
14317-14323: Mocha Dependency Confirmation
Another occurrence of the Mocha update to"npm:11.1.0"confirms thorough coverage of this change. Continue to monitor that all sub-systems reference the correct version.
17008-17023: Schema-Utils and AJV Keywords Update
The updates toschema-utils,ajv, andajv-keywordsappear in this segment. Verify that JSON schema validations and related functionalities operate smoothly with these new versions.
18190-18203: Terser Dependency Update Check
Terser and its related dependencies are updated here. Please ensure that minification and source map generation remain intact post-update.
18221-18230: Terser-Webpack-Plugin Virtual Reference Update
This hunk updates the virtual reference forterser-webpack-pluginto align with"npm:5.3.11". Confirm that webpack’s bundling process correctly incorporates this new version.
18348-18368: Comprehensive Terser-Webpack-Plugin Update
The virtual package details forterser-webpack-pluginare updated in this section. Verify that these changes do not adversely affect build performance or bundle sizes.
18711-18717: Mocha Version Reiteration
Mocha is reasserted as"npm:11.1.0"in this block. As always, ensure that test suites and integration points use the updated version seamlessly.
20202-20211: Workerpool Dependency Update
Theworkerpoolpackage is updated to"npm:6.5.1". Confirm that asynchronous task management and worker pooling mechanisms continue to function as expected with this upgrade.
20436-20453: Yargs and Yargs-Parser Dependency Update
The updates toyargsandyargs-parserhere are intended to ensure improved CLI argument parsing. Validate that all command-line interfaces behave correctly post-update.
20462-20478: Final Yargs-Parser Updates
The dependency updates foryargs-parserare finalized in this hunk. Please verify that downstream tools relying on CLI parsing resolve these versions properly without issues.packages/search-contract/package.json (1)
25-25: Mocha Version Upgrade Verified.
The mocha dependency has been updated from^10.2.0to^11.1.0, which is consistent with the PR’s objectives of addressing dependency vulnerabilities (notably related to the serialize-javascript chain). Please ensure that all unit tests pass after this upgrade.packages/wallet-utils-contract/package.json (1)
25-25: Consistent Mocha Upgrade in Wallet Utils.
The upgrade to^11.1.0is correctly applied here. Verify that the new version does not introduce any unforeseen issues in your test suite.packages/dash-spv/package.json (1)
27-27: Mocha Dependency Update for dash-spv.
The mocha version change to^11.1.0aligns with the overall project update. Please run a full test suite to confirm that there are no regressions or compatibility issues with this update.packages/dashpay-contract/package.json (1)
34-34: Mocha Version Consistency in DashPay Contract.
The dependency update from^10.2.0to^11.1.0is correctly applied. Validate that the testing framework upgrade maintains compatibility with existing test scripts.packages/dpns-contract/package.json (1)
40-40: Mocha Dependency Version Updated.
The upgrade to^11.1.0is consistently applied in this file as well. Ensure that integration tests and any environment-specific test cases run smoothly with this change.packages/masternode-reward-shares-contract/package.json (1)
40-40: Upgrade Mocha Dependency Version in DevDependencies
The mocha version has been updated from "^10.2.0" to "^11.1.0", which is a vital change aimed at addressing the XSS vulnerability (via the serialize-javascript dependency). Please ensure that the project's test suite runs without issues after this upgrade.packages/withdrawals-contract/package.json (1)
41-41: Upgrade Mocha Dependency for Withdrawals Contract
The mocha dependency has been updated to "^11.1.0" to mitigate the XSS vulnerability. Confirm that existing tests in this package work as expected with the new version.packages/bench-suite/package.json (1)
20-20: Update Mocha Version in Bench Suite Dependencies
The dependency version for mocha is changed to "^11.1.0" for consistency with other packages and to address the vulnerability. Ensure that this change does not adversely affect any benchmark-related test execution..yarnrc.yml (1)
47-47: Update Karma-Mocha Configuration in Yarn Settings
The karma-mocha dependency configuration has been updated to use mocha "^11.1.0". This change is critical to prevent the XSS vulnerability tied to the older versions of dependencies. Verify that the build and test processes correctly pick up this configuration change.packages/dapi-grpc/package.json (1)
62-62: Upgrade Mocha Version in DAPI GRPC DevDependencies
The mocha version in the devDependencies has been updated to "^11.1.0". This aligns with the overall project strategy to remedy the serialize-javascript XSS vulnerability. Please double-check that all unit tests for the DAPI GRPC package continue to pass with the upgrade.packages/platform-test-suite/package.json (1)
59-59: Update Mocha Dependency for Security PatchThe Mocha version has been updated from
^10.2.0to^11.1.0as required to mitigate the XSS vulnerability linked toserialize-javascript. This aligns with the broader project upgrade strategy. Please ensure that the test suite runs without issues after this update.packages/dapi/package.json (1)
69-69: Upgrade DevDependency Mocha VersionThe
mochadependency in the devDependencies section has been updated to^11.1.0, consistent with the security advisory upgrade. Verify that all tests and scripts invoking Mocha are compatible with this new version.packages/wasm-dpp/package.json (1)
76-76: Consistent Mocha Version UpdateThe update to
mochaversion^11.1.0on line 76 ensures that the@dashevo/wasm-dpppackage benefits from the security patch addressing the XSS vulnerability. Please confirm that this change does not affect the WASM build or the test executions.packages/wallet-lib/package.json (1)
83-83: Mocha Version Upgrade in Wallet LibraryThe Mocha dependency in the devDependencies has been updated to
^11.1.0as shown on line 83. This change is in line with the overall project update for security improvements. Ensure that test scripts continue to function correctly with this upgrade.packages/js-dapi-client/package.json (1)
67-67: Update Mocha in JS DAPI Client PackageThe
mochadependency has been updated to^11.1.0(line 67) to address the XSS vulnerability problem via dependency upgrade. Confirm that any custom Mocha configurations or test setups in this package are compatible with version 11.packages/js-dash-sdk/package.json (2)
88-88: Updated Mocha Version to Address Vulnerabilities
The mocha dependency has been bumped to^11.1.0. This upgrade is crucial given the reported XSS vulnerability in theserialize-javascriptdependency (GHSA-76p7-773f-r4q5) that mocha indirectly uses. Please verify that no breaking changes in Mocha v11 affect your tests and that the new version indeed pulls in the patched dependencies.
100-100: Updated Terser-Webpack-Plugin Version
The version upgrade forterser-webpack-pluginto^5.3.11is a minor update that should improve stability or security. Ensure that all related webpack configurations remain compatible with this version change.packages/dashmate/package.json (1)
109-109: Consistent Mocha Upgrade in DevDependencies
The mocha dependency in thedevDependenciessection has been updated to^11.1.0, aligning it with the changes in other packages. This consistency helps ensure that all test-related tooling benefits from the security fixes (specifically addressing the XSS vulnerability viaserialize-javascript) and improvements introduced in Mocha v11. Please double-check that no unexpected breaking changes affect the test suite.
Issue being fixed or feature implemented
What was done?
How Has This Been Tested?
Running audit
Breaking Changes
None
Checklist:
For repository code-owners and collaborators only
Summary by CodeRabbit