fix(deps): roll up dependabot bumps and slim scanner registry#93
Merged
Conversation
Roll up open dependabot npm bump (prettier) to latest and clear the high-severity brace-expansion DoS advisory (GHSA-3jxr-9vmj-r5cp) so the security workflow npm audit gate passes.
Lift the dpkg/rpm tab-line parser into utils.parseTabbed so apt and dnf stop repeating it, and route dnf through runScanner instead of its own hand-rolled permission/timeout catch block. Drops the legacy 'dnf list installed' fallback (repoquery ships with dnf4/dnf5).
Replace 40 hand-written scanner imports and the matching ALL_SCANNERS map with a readdirSync + dynamic-import registry keyed by filename. New scanners register by dropping a file in src/scanners; also removes the 40-line block that dependabot github-actions bumps kept conflicting on.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
security.ymland could not auto-merge together.npm auditgate passes.Changes
deps
prettier3.9.4 → 3.9.6;npm audit fixclears brace-expansion DoS (GHSA-3jxr-9vmj-r5cp).actions/setup-node→ v7.0.0 acrossci.yml,npm-publish.yml,security.yml.github/codeql-action/{init,autobuild,analyze}→ v4.37.0 insecurity.yml.refactor
utils.parseTabbedshared byapt+dnf;dnfnow usesrunScanner(drops its hand-rolled catch and the legacydnf listfallback).src/index.jsauto-loads scanners viareaddirSync+ dynamic import instead of 40 imports + a 40-entry map. New scanners register by dropping a file insrc/scanners/. Removes the block dependabot kept conflicting on.URLto eslint globals (required by the newnew URL(...)in index.js).Net: refactor removes ~121 lines.
Supersedes
Closes the following once merged: #87, #88, #89, #90, #91.
Test plan
npm run lint— no issuesnpm run format:check— cleannpm test— 14/14 passnpm audit --audit-level=high— 0 vulnerabilitiesnode bin/pkgmap.js --manager npm --json— runs, 38 scanners load