Conversation
- Update mocha from 10.2.0 to 10.8.2 (fixes diff, js-yaml, nanoid, serialize-javascript vulnerabilities) - Update rollup from 3.10.1 to 3.29.5 (fixes high severity DOM Clobbering XSS vulnerability) - Update rimraf from 4.1.2 to 4.4.1 (fixes symbolic link following issue) - Update TypeScript from 4.9.4 to 5.7.2 (required for compatibility with newer @types/node) - Add skipLibCheck to tsconfig.json to resolve type conflicts between DOM and Node types All 6 vulnerabilities (1 low, 4 moderate, 1 high) have been resolved. Tests pass with same results as main branch (2 pre-existing flaky iframe tests). Co-authored-by: Hans-Joachim Krauch <achim-k@users.noreply.github.com>
|
Cursor Agent can help with this pull request. Just |
|
|
||
| /* Strict Type-Checking Options */ | ||
| "strict": true /* Enable all strict type-checking options. */, | ||
| "skipLibCheck": true /* Skip type checking of declaration files. */, |
There was a problem hiding this comment.
Yes, skipLibCheck: true is necessary with the TypeScript upgrade. Without it, the type checking fails with these errors:
error TS2430: Interface 'TextDecoder' incorrectly extends interface 'import("node:util").TextDecoder'.
error TS2430: Interface 'TextEncoder' incorrectly extends interface 'import("node:util").TextEncoder'.
This is a known conflict between DOM types (from lib.dom.d.ts) and Node types when using TypeScript 5.7+ with newer @types/node. The project needs both:
• DOM types: For the browser/worker environment (the core comlink functionality)
• Node types: For testing with mocha
skipLibCheck is a standard and safe solution—it only skips type checking of .d.ts declaration files in node_modules, not your actual source code. Your source code still gets full strict type checking.
Alternative: We could downgrade TypeScript back to 4.9.4, but that would prevent using mocha 10.8.2 (which requires newer TypeScript due to its dependencies), leaving us with the security vulnerabilities unfixed.
3 participants
Fix npm security vulnerabilities by updating dependencies and adjusting TypeScript configuration.
Slack Thread