Skip to content

Conversation

MikeMcC399
Copy link
Contributor

Situation

Several devDependencies are problematic and unmaintained

Dependency Issue
ban-sensitive-files critical vulnerabilities
deps-ok critical vulnerabilities
git-issues depends on unsupported request
license-checker unmaintained with deprecated dependencies

Change

Remove without replacement:

Update npm lockfileVersion to 3.

Remove standard badge from README, since this is no longer in use.

Verification

Execute

git clean -xfd
npm ci
npm test
npm run deps

Tests should run successfully.

remove
ban-sensitive-files
deps-ok
git-issues
license-checker
@MikeMcC399
Copy link
Contributor Author

MikeMcC399 commented Sep 4, 2025

@AtofStryker

This PR reduces vulnerabilities significantly from

Before

43 vulnerabilities (4 low, 10 moderate, 11 high, 18 critical)

After

13 vulnerabilities (3 low, 1 moderate, 3 high, 6 critical)

A follow-on PR will bump devDependencies to their latest versions and further reduce the count of vulnerabilities caused by devDependencies. 4 vulnerabilities (2 low, 2 high) is achievable by judicious updates and culling.

npm audit --omit=dev is showing 0 vulnerabilities, so at least the released package is good!

Please review when you have time! Thanks!

@MikeMcC399 MikeMcC399 marked this pull request as ready for review September 4, 2025 06:57
@AtofStryker AtofStryker merged commit b18a4b8 into cypress-io:master Sep 4, 2025
1 check passed
@MikeMcC399 MikeMcC399 deleted the remove/non-essential-devdeps branch September 4, 2025 14:57
@MikeMcC399 MikeMcC399 mentioned this pull request Sep 4, 2025
Copy link

🎉 This PR is included in version 2.2.1 🎉

The release is available on:

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants