build(deps-dev): refresh vulnerable Jest transitive dependencies

Draft
KN
5d ago
+261-112

Summary

  • Refresh 24 development-only package records within their existing ranges. Keep package.json and Jest 29.7.0 unchanged.
  • Replace vulnerable Babel, browser-targeting, brace-expansion and js-yaml versions.
  • Add two bounded security regressions to the existing Jest command and document the exact audit snapshot and remaining finding.

Evidence

Base main: 83ceac969392e7ea1948652d0b2dd6d06233ddeb.
Head: ff2cb6d988391ab31324c78c477fce40b3c13e84.
Verified published tree: 0207e3c0790c0dcbe284ae9b357408c9276d94f3.

Independent assistant-cloud checks:

  • Node 24.22.1 / npm 11.9.0: locked npm ci succeeded and 70/70 Jest tests passed.
  • Negative control with the original main lockfile and the identical final tests: 68 passed / 2 failed. The zero-step brace child aborts under its heap cap; old js-yaml ignores the empty-merge-source budget.
  • Python 3.12.14 / pytest 9.2.0: 27/27 existing main installer tests passed.
  • JavaScript/Python syntax checks, dependency-tree validation and whitespace diagnostics passed. No separate build/lint script is configured.
  • All 15 baseline source files were matched to exact-main Git blob SHAs. Published tree comparison changes only package-lock.json and adds the regression/documentation files.

Exact-head hosted CI 41947175892 completed successfully at 2026-11-05 01:15:04 UTC. Node 18.20.8 and Node 20.20.2 each passed locked npm ci and 70/70 Jest tests; Python 3.11.17 passed 27/27 tests. All three checkout logs identify merge ref 05d89283087a8967bbb6b02837722eb44ec865cb, whose parents are the exact head and unchanged base above and whose tree equals the published head tree. This is verified merge-ref CI, not a claim that jobs checked out the bare head. GitHub warns that the existing checkout/setup actions use the forced Node 24 action runtime; the application-test versions above are confirmed separately in their logs.

Security result and boundaries

Current npm 11.9.0 audit changes from 49 affected package entries (34 low, 2 moderate, 13 high) across 16 distinct advisory URLs to 6 low entries with one distinct advisory. These counts include propagated dependency effects and are not counts of demonstrated project exploits. npm audit --omit=dev reports zero findings.

Deepmerge GHSA-gcqx-w48m-w2h4 remains under jest-config. No patched deepmerge version is published; npm proposes a breaking downgrade to Jest 25.1.0. This PR does not force that downgrade, suppress the finding, or claim the development toolchain is fully clean.

These are development-toolchain fixes. No npm runtime dependency, RPG Maker plugin code, Python installer, workflow, permission, credential, merge, deployment or release is changed. Existing installer Draft #5 is independent and untouched.

Research, advisory links, checks and reproducible commands.

Summary by Sourcery

Refresh the Jest development dependency lockfile to address known transitive vulnerabilities while preserving the existing Jest version and production dependency surface.

Bug Fixes:

  • Refresh vulnerable transitive Jest development dependencies within their existing version ranges.
  • Add bounded regression coverage for brace-expansion and js-yaml security fixes.

Enhancements:

  • Document the dependency security findings, audit results, remaining deepmerge advisory, and verification boundaries.

Documentation:

  • Add research documentation describing the dependency refresh, security audit evidence, and reproducible verification commands.

Tests:

  • Extend the existing Jest test suite with dependency-level security regression tests.

Summary by cubic

Refreshes the Jest development lockfile to replace vulnerable transitive packages (Babel, browserslist, brace-expansion, js-yaml) with patched versions within their existing ranges, keeping jest@29.7.0 and package.json unchanged. Adds two regression tests that catch re-introduction of the patched issues, and documents the audit snapshot; one low-severity deepmerge advisory remains because no patched release exists.

Verification

  • Locked npm ci and all 70 Jest tests pass on Node 24; the new tests fail against the original lockfile as expected.
  • All 27 Python installer tests pass; the refresh touches only package-lock.json and adds test/documentation files.