[mtrezza]

Security

This PR resolves six development alerts:

Alert	Severity	Advisory	Package	Vulnerable range	First patched	Resolved by
alert 192	high	GHSA-2883-xcg3-v3hh	js-yaml	>= 3.0.0, < 3.15.2	3.15.2	js-yaml 3.15.2
alert 188	high	GHSA-5p4m-2wfm-xmqj	js-yaml	>= 3.0.0, < 3.15.1	3.15.1	js-yaml 3.15.2
alert 167	high	GHSA-52cp-r559-cp3m	js-yaml	>= 3.0.0, < 3.15.0	3.15.0	js-yaml 3.15.2
alert 158	medium	GHSA-h67p-54hq-rp68	js-yaml	< 3.15.0	3.15.0	js-yaml 3.15.2
alert 67	medium	GHSA-mh29-5h37-fv8m	js-yaml	< 3.14.2	3.14.2	js-yaml 3.15.2
alert 137	low	GHSA-vpq2-c234-7xj6	@tootallnate/once	< 2.0.1	2.0.1	removing codecov

• codecov 3.8.1 was the only package that used @tootallnate/once 1.1.2, through teeny-request 6.0.1 > http-proxy-agent 4.0.1, which requires @tootallnate/once 1. Removing codecov removes that copy.
• codecov 3.8.1 also pinned js-yaml to exactly 3.14.0, which held the hoisted copy at that version. Its only other user is nyc > @istanbuljs/load-nyc-config 1.1.0, which requires ^3.13.1. With the pin gone, the second commit updates that copy to 3.15.2, the latest 3.x release. The other js-yaml copies (4.3.2 and 5.5.0) aren't affected by these alerts.

These development alerts stay open:

• Alert 139 (medium, GHSA-w5hq-g745-h8pq, uuid < 11.1.1): node_modules/uuid 3.4.0 is also required by nyc > istanbul-lib-processinfo 2.0.2 as ^3.3.3, so no version within range fixes it.
• Alerts 230, 232, 233 and 234 (undici < 6.29.1): they come from undici 6.29.0, which is bundled inside npm 11.21.1 through its bundled node-gyp. @semantic-release/npm 13.1.5 requires npm ^11.6.2. A bundled copy can't be updated through the lock file, and 11.21.1 is the latest npm 11.x release.

Why remove codecov

codecov 3.8.1 (November 2020) pins all of its dependencies to exact versions, and no fixed version will follow. Its final release, 3.8.3 (July 2021), is deprecated on npm in favor of Codecov's new uploader, and its repository codecov/codecov-node is archived.

The package is also unused. No npm script, config file or workflow runs it. CI uploads coverage with the codecov/codecov-action@v4 GitHub Action in .github/workflows/ci.yml, which doesn't use this npm package.

Changes

Commit 1: remove codecov

• package.json: removes the codecov (3.8.1) devDependency.

• package-lock.json: regenerated from master with npm uninstall codecov --ignore-scripts --package-lock-only. It removes codecov and the 15 packages that only it used:

  • teeny-request 6.0.1, with http-proxy-agent 4.0.1 and @tootallnate/once 1.1.2, https-proxy-agent 4.0.0 with its nested agent-base 5.1.1, agent-base 6.0.2, node-fetch 2.6.7 with whatwg-url 5.0.0, tr46 0.0.3 and webidl-conversions 3.0.1, and stream-events 1.0.5 with stubs 3.0.0
  • ignore-walk 3.0.3
  • urlgrey 0.4.4
  • argv 0.0.2

  No other entry changes: no package is added, no version changes and no dev or optional flag changes.

Commit 2: bump js-yaml from 3.14.0 to 3.15.2

• package-lock.json: npm update js-yaml --ignore-scripts --package-lock-only changes only the node_modules/js-yaml entry: its version, resolved and integrity, plus the license field that npm now records. Its dependencies (argparse ^1.0.7, esprima ^4.0.0) and its dev flag are unchanged.

js-yaml changes from 3.14.0 to 3.15.2, from the changelog on the v3 branch and the published packages:

• 3.14.1: Fixes possible code execution in the already unsafe load() through an anchor named hasOwnProperty. An alias such as *hasOwnProperty now resolves instead of throwing a TypeError.
• 3.14.2: Fixes prototype pollution in merge (<<) (GHSA-mh29-5h37-fv8m). A __proto__ key becomes an own property instead of setting the object's prototype.
• 3.15.0: Adds the maxTotalMergeKeys loader option, default 10000, which limits the total number of keys that merges process in one load call (GHSA-h67p-54hq-rp68, GHSA-52cp-r559-cp3m). The limit also applies to load().
• 3.15.1: Removes quadratic complexity from !!omap duplicate key detection (GHSA-5p4m-2wfm-xmqj).
• 3.15.2: Each merged mapping now counts toward maxTotalMergeKeys as well as each of its keys, so the 10000 limit applies to merged mappings and merged keys combined, and merges of empty mappings are bounded too (GHSA-2883-xcg3-v3hh). For example, 5001 merges of a one-key mapping now throw. A merge sequence is also limited to 100 entries. This is a hard limit that maxTotalMergeKeys: -1 doesn't disable.

Besides lib/, the published package also changes the browser bundles in dist/, the README and package.json (publishConfig.tag v3-legacy), and it no longer ships CHANGELOG.md. None of these affect what require('js-yaml') loads (index.js and lib/).

After both commits, lockfileVersion stays 3, npm ls --all --package-lock-only reports no missing or invalid dependencies, as on master, and npm audit --package-lock-only reports 12 vulnerable packages instead of 17.

Compatibility

@istanbuljs/load-nyc-config calls require('js-yaml').load(content) only for a .nycrc.yml or .nycrc.yaml config file, including one reached through extends. node-apn has no nyc config file and no nyc key in package.json; npm run coverage passes its options on the command line. So js-yaml isn't loaded during the coverage run.

load() was also compared between 3.14.0 and 3.15.2 on 32 inputs: a typical .nycrc.yml, anchors and merges, !!js/*, !!omap and other tags, and malformed input (bad or tab indentation, unclosed quotes, duplicate keys, unknown tags and aliases, null bytes, invalid escapes, multiple documents, deep nesting). 25 inputs give identical results. The 7 differences are the fixes listed above:

• Merges beyond the new limits now throw: a merge sequence of 101 entries, 11 merges of a 1000-key mapping, and 10001 merges of an empty mapping. Because the 10000 limit counts merged mappings and merged keys together, 5001 merges of a one-key mapping also throw, while 5000 still load.
• __proto__ keys, set directly or through a merge, become own properties instead of setting the prototype. This also lets !!omap accept a __proto__ key.
• An alias named hasOwnProperty resolves instead of throwing a TypeError.

Breaking Changes

None. codecov and js-yaml 3.x are development-only dependencies and aren't part of the published package.

Code Changes Required

None. No source, config or workflow file references the codecov npm package. The coverage upload in CI and the coverage badge in the README use the Codecov GitHub Action and service, not this package, and stay unchanged.

Summary by CodeRabbit

• Chores
  • Updated development tooling dependencies, removing an unused coverage-reporting tool and its associated packages.
  • Updated a YAML parsing dependency to a newer locked version. These maintenance changes do not alter user-facing functionality.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: d8f39398-db79-4cf4-ba07-ec37eaee70aa

Commits

Reviewing files that changed from the base of the PR and between e4c66f6 and 6bd964a.

Files selected for processing: 2

• package-lock.json
• package.json

Files with no reviewable changes: 1

• package.json

Included review availability: This review used your included allowance. 1 included review remains after this review. Your included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

Walkthrough

The pull request removes codecov from the development dependencies and removes its associated packages from the lockfile. It also updates the locked js-yaml 3.x package from 3.14.0 to 3.15.2.

Changes: Dependency updates

Layer / File(s)	Summary
Remove codecov and related lock entries package.json, package-lock.json	Removes codecov from the development dependencies and removes associated package entries from the lockfile.
Update the js-yaml lock entry package-lock.json	Updates js-yaml from 3.14.0 to 3.15.2 and changes its resolved URL, integrity value, and license metadata.

Priority: Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• parse-community/node-apn#231: PR #231 updates js-yaml 4.x copies and notes that codecov pins js-yaml 3.14.0; this pull request removes codecov and updates the remaining js-yaml 3.x lock entry.

Merge Risk: Minimal · up to 6bd96

The dependency cleanup is ready to merge with no identified current-head risk.

Pre-merge checks: 6

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title begins with the allowed refactor: prefix, uses a capitalized first word after the prefix, and accurately describes the dependency removal and js-yaml update.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Security Check		The PR changes only dependency manifests. It removes codecov 3.8.1 and its vulnerable transitive dependency tree, including @tootallnate/once 1.1.2. It updates the remaining js-yaml 3.x entry fr…
Engage In Review Feedback		PASS. The supplied current-review result contains zero actionable findings, and no CodeRabbit review threads were returned. Therefore, there is no review feedback that the pull request failed to engag…

Full details: Security Check

Explanation

The PR changes only dependency manifests. It removes codecov 3.8.1 and its vulnerable transitive dependency tree, including @tootallnate/once 1.1.2. It updates the remaining js-yaml 3.x entry from 3.14.0 to 3.15.2 with a new registry integrity value. No source, workflow, or security-sensitive code changes were introduced. Existing unrelated vulnerable entries remain unchanged and are not caused by this PR.

Full details: Engage In Review Feedback

Explanation

PASS. The supplied current-review result contains zero actionable findings, and no CodeRabbit review threads were returned. Therefore, there is no review feedback that the pull request failed to engage with.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.87%. Comparing base (5ddfb10) to head (6bd964a).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #233   +/-   ##
=======================================
  Coverage   95.87%   95.87%           
=======================================
  Files          23       23           
  Lines         849      849           
=======================================
  Hits          814      814           
  Misses         35       35           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.