chore: Upgrading oclif and related packages#160
Conversation
There was a problem hiding this comment.
Pull request overview
This PR upgrades oclif runtime/dev tooling dependencies to address the linked Dependabot security advisory (notably around minimatch usage across the dependency tree).
Changes:
- Bump
@oclif/coreand related oclif plugins to newer^4.x/^6.xpatch releases. - Upgrade
eslint-config-ocliffrom^5to^6andoclifdevDependency to^4.22.81. - Regenerate
package-lock.jsonto reflect the upgraded dependency graph (including updated minimatch versions).
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| package.json | Updates oclif and linting-related dependency versions. |
| package-lock.json | Locks upgraded versions and newly introduced transitive dependencies. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "eslint-config-oclif": "^6", | ||
| "eslint-config-oclif-typescript": "^3", |
There was a problem hiding this comment.
Upgrading to eslint-config-oclif v6 pulls in transitive tooling that now requires newer Node versions (e.g. eslint@10 in the lockfile requires Node ^20.19.0). This conflicts with the repo’s pinned Node version (v20.17.0 in .nvmrc) and can cause npm install/ci warnings or failures in engine-strict environments. Consider either keeping eslint-config-oclif on v5 for now, or bumping the repo’s Node version/engines to meet the new minimums (and regenerating the lockfile accordingly).
| "eslint-config-oclif": "^6", | |
| "eslint-config-oclif-typescript": "^3", | |
| "eslint-config-oclif": "^5", | |
| "eslint-config-oclif-typescript": "^2", |
There was a problem hiding this comment.
should we update the .nvmrc instead?
There was a problem hiding this comment.
@copilot - we updated the .nvmrc - can you reevaluate?
|
@madebydavid I've opened a new pull request, #161, to work on those changes. Once the pull request is ready, I'll request review from you. |
@copilot I closed your PR but that change is merged - can you review again? |
|
@madebydavid I've opened a new pull request, #162, to work on those changes. Once the pull request is ready, I'll request review from you. |
Goal
This is to resolve https://github.com/shipth-is/cli/security/dependabot/24
We seem to be using minimatch in a lot of packages.
What's changed
To note
Unfortunately, this doesn't fix all of them - it seems that one dev dependency eslint-config-oclif has a self-dependency on an earlier version of itself - see oclif/eslint-config-oclif#319
npm audit will pick this up:
Importantly, eslint-config-oclif is a dev dependency - so if we omit those we get no issues: