Repository navigation
[SCF-2415] [Part 4] Dedupe Ember tooling (ember-auto-import 2, ember-source-channel-url 3) - #9
Merged
Conversation
This was referenced Oct 28, 2026
Merged
ember-qunit 5 and ember-a11y-testing 4 each pulled in ember-auto-import 1 and with it webpack 4, babel-core 6 and node-libs-browser. Those carried babel-traverse 6 (critical, no fixed release), sha.js (critical), elliptic, json5 0.5, serialize-javascript 4 and braces 2. Scoped resolutions move both onto ember-auto-import 2, which the app already uses; ember-qunit 6's breaking change was exactly this move. Deduplicated to a single 2.13.1, the copy ember-auto-import v2 already elected as leader (the root dependency stays within ^2). Same 536 tests run (526 pass, 10 skipped), including all accessibility checks. Audit: critical 14 -> 6, high 72 -> 64. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ember-try 1.4's ember-try-config pulled ember-source-channel-url 1.x, which uses got 8 -> cacheable-request 2 -> http-cache-semantics 3.8.1 (high; one advisory has no fixed release). Version 3 keeps the same getChannelURL(channel) export, uses node-fetch instead of got, supports Node 18, and was already in the tree for config/ember-try.js. The key needs the **/ prefix because ember-try-config is not a direct dependency. Verified with `ember try:one ember-lts-4.8` (BOOTSTRAPVERSION=4): 536 tests, 526 pass, 10 skipped. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@babel/plugin-transform-modules-systemjs 7.27.1 -> 7.29.8 (forced via resolutions). Pulled in through @babel/preset-env. Fixes CVE-2026-44728 (COMP-10029). 7.29.x needs 7.29 helpers and traverse, so the rest of Babel moves too instead of running a nested 7.29 tree next to 7.27: every @babel/* entry was re-resolved to the newest release in its range and collapsed with yarn-deduplicate (@babel/core and @babel/preset-env 7.27 -> 7.29.7). Entries that dependents pin exactly or with ~ ranges (code-frame 7.12.11, runtime 7.12.18, plugin-transform-typescript ~7.4/~7.5) stay put. Babel's own deps (core-js-compat, babel-plugin-polyfill-*, regexpu-core, ...) are refreshed with it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
browserslist 4.25.0 -> 4.29.5 (forced via resolutions). The Babel 7.29 upgrade already brought in 4.29.5 for @babel/helper-compilation-targets; this merges the 4.25.0 copy still used by webpack and drops its old caniuse-lite, electron-to-chromium, node-releases and update-browserslist-db entries. Fixes CVE-2026-73088 and CVE-2026-73089 (COMP-10048, COMP-10050). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Merges the 0.0.28, 0.0.33, 0.1.0 and 0.2.3 copies into 0.2.7, which fixes CVE-2025-54798, CVE-2026-44705 and CVE-2026-49982. All dependents are dev/build tooling and only use APIs still present in 0.2.x. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The tmp resolution is "^0.2.7", but the lockfile recorded it as "tmp@0.2.7". Running yarn install rewrites the key; no resolved version changes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
brace-expansion 1.1.12 -> 1.1.21 (forced via resolutions). Pulled in through minimatch 3.x. Fixes CVE-2026-13149, CVE-2026-14257, CVE-2026-33750 and CVE-2026-69152 (COMP-10025..10028), plus CVE-2026-102276, CVE-2026-102277 and CVE-2026-102278. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
minimatch 3.1.2 -> 3.1.5 and mocha's exact 3.0.4 pin -> 3.1.5 (forced via resolutions). Fixes CVE-2026-26996, CVE-2026-27903 and CVE-2026-27904 (COMP-10014..10016), plus CVE-2022-3517 on 3.0.4. The floor stays on 3.x: the lockfile also resolves "minimatch@*", which would otherwise jump to a major that needs Node >= 20. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
picomatch 2.3.1 -> 2.3.2 (forced via resolutions). Pulled in through micromatch, anymatch and readdirp. Fixes CVE-2026-33671 and CVE-2026-33672 (COMP-10009, COMP-10010). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The last braces 2.3.2 copies (high) came from micromatch 3 under
ember-cli's sane watcher and its anymatch. micromatch 3 only calls
braces(pattern, options) and uses the returned array, which braces 3
still provides.
Comparing micromatch 3 before and after over brace-heavy globs: every
positive pattern (lists, ranges, nested, extensions) matches the same
files. Negated brace globs such as `!{a,b}/**` now compile to an extglob
and match differently, but sane only ever receives brace-free patterns
here (its default `**/*` and broccoli's `<outputPath>/**` ignore), and
micromatch skips braces entirely for those. `ember serve` still detects
a touched component and rebuilds.
Audit: high 56 -> 52.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fast-uri 3.0.6 -> 3.1.9 (forced via resolutions). Pulled in through ajv 8 (schema-utils, eslint's table). Fixes CVE-2026-6321, CVE-2026-6322, CVE-2026-13676, CVE-2026-16221, CVE-2026-18446, CVE-2026-75975 and CVE-2026-76172 (COMP-10038..10042, COMP-10047, COMP-10051), plus CVE-2026-84292, CVE-2026-86472, CVE-2026-110095, CVE-2026-110306 and CVE-2026-110725. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
mocha 8 pins nanoid 3.1.20 exactly; forcing it via resolutions merges it with postcss's 3.3.20. Fixes CVE-2026-67213, CVE-2026-67214 and CVE-2026-73086 (COMP-10021, COMP-10022, COMP-10046), plus CVE-2021-23566 and CVE-2024-55565 on 3.1.20. Dev-only: postcss's copy, the one that ships through runtime dependencies, was already patched. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ember-cli 3.28 (12.3.2) and its markdown-it-terminal (8.4.2) pulled two old markdown-it copies, each with high advisories, plus linkify-it 2 and 3. markdown-it 14 still ships a CommonJS build and keeps the md().use(plugin).render() API that ember-cli's MarkdownColor relies on; linkify-it 5 comes with it. `ember help generate` and a MarkdownColor render of headings, emphasis, code, links, lists, fences and ember-cli's color tokens produce byte-identical output before and after. Audit: high 62 -> 56. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ember-cli 3.28 depends on lodash.template ^4.5.0 for blueprint rendering and its initial-commit message; 4.5.0 has high advisories. 4.18.1 is in the same major and clears all of them. All 49 files of ember-cli's app and addon blueprints render identically through ember-cli's processTemplate before and after. Audit: high 52 -> 50. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ansi-html 0.0.7 (high) is pinned by broccoli's ^0.0.7 range, which on a 0.0.x version allows no other release, so it needs a resolution. 0.0.9 renders broccoli's ANSI-colored build-error page identically. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
express 4.21.2 pinned body-parser 1.20.3 and path-to-regexp 0.1.12 exactly (both high). express 4.22.3, within ember-cli's and testem's ^4 ranges, takes body-parser ~1.20.5 and path-to-regexp ~0.1.13; the caret body-parser ranges from ember-a11y-testing and @scalvert/ember-setup-middleware-reporter are refreshed onto the same 1.20.9. Lockfile refresh only. testem serves the test run through express. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
compression 1.8.0 (high) -> 1.8.2, within ember-cli's and testem's ^1.7.4 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
engine.io 6.6.4 (high) -> 6.6.11, within socket.io's ~6.6.0 range. It brings its own ws ~8.21.0 (8.21.3). testem talks to the browser over socket.io. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
socket.io-parser 4.2.4 (high) -> 4.2.7, within socket.io's ~4.2.4 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ws 8.17.1 and 8.18.2 (both high) remained after the engine.io refresh: - jsdom's ^8.2.3 range refreshes to 8.22.0. - socket.io-adapter 2.5.5 pinned ws ~8.17.1; socket.io-adapter 2.5.8, within socket.io's ~2.5.2 range, takes ~8.21.0 (8.21.3), the same copy engine.io already uses. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
websocket-driver 0.7.4 (critical) -> 0.7.5, within faye-websocket's >=0.5.1 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
proxy-addr 2.0.7 (critical) -> 2.0.8, within express's ~2.0.7 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
webpack 5's terser-webpack-plugin 5.3.14 depended on serialize-javascript 6.0.2 (high; the fix, 7.x, needs Node >= 20). 5.6.1, still inside webpack's ^5.3.11 range, no longer depends on serialize-javascript at all. Lockfile refresh only. The production build bundles the same modules and identifiers; only webpack's numeric module ids in the two ember-auto-import chunks (and so their content hashes and the references in index.html) change. Audit: high 50 -> 49. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
shell-quote 1.8.3 (critical, high) -> 1.12.0, within npm-run-all's ^1.6.1 range. npm-run-all drives `yarn lint`, which still runs all its tasks. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
form-data 4.0.3 (critical, high) -> 4.0.6, within jsdom's ^4.0.0 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@xmldom/xmldom 0.8.10 (13 high findings) -> 0.8.15, within testem's ^0.8.0 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
flatted 3.3.3 (high) -> 3.4.4, within flat-cache's ^3.2.9 range (eslint's cache, exercised by `yarn lint`). Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
js-yaml 3.14.1 (ember-cli, testem, tap-parser) and 4.0.0 (mocha) both have high advisories. - The ^3 ranges refresh to 3.15.2 (lockfile only). - mocha 8 pins js-yaml 4.0.0 exactly, so a resolution scoped to mocha moves it to 4.3.2 (same major). mocha uses it to read YAML config; loading a .mocharc.yml through it still runs all node tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
source-map-js 1.2.1 (high) -> 1.2.2, within css-tree's ^1.0.1 range (eslint-plugin-ember). It merges with the 1.2.2 copy already in the tree. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
underscore 1.13.7 (high) -> 1.13.8, within backbone's >=1.8.3 range. Lockfile refresh only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Gaurav0
force-pushed
the
gaurav/chore/SCF-2415-part-3-move-docs-tooling
branch
from
October 28, 2026 23:54
02ecad5 to
022d85a
Compare
Gaurav0
force-pushed
the
gaurav/chore/SCF-2415-part-4-dedupe-ember-tooling
branch
from
October 28, 2026 23:55
f303f8c to
d0ad9c5
Compare
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
With push on every branch and pull_request on every base branch, each push to a branch with an open PR ran the full matrix twice. PRs are still covered by the pull_request trigger, which uses '**' so stacked PRs on gaurav/chore/... bases run (b057803). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…he type attribute Since f005cd0 the default submit button set its type with @buttonType="submit", which only BsButton understands. A custom @buttonComponent that renders <button type="button" ...attributes> ignored it, so its clicks never submitted the footer form and @onsubmit never ran. Before f005cd0, onClick={{@onsubmit}} reached any button component through ...attributes. Pass type="submit" as an HTML attribute instead. BsButton applies ...attributes after its own type, so it still renders a submit button, and @buttonType is deprecated anyway. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…andles it 6c23b4c made the footer <form> always call preventDefault() on submit, to stop the page reload when its submit button calls @onsubmit. That also blocked native submission where it used to happen: a standalone footer without @onsubmit, and a footer given an action attribute (e.g. <modal.footer action="/export" method="post">). Only prevent the default when @onsubmit is given and the form has no action attribute. That still covers the reload in BsModal, where the footer always gets onSubmit and no action. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
8945d07 (upstream ember-bootstrap#2027) replaced `@arg visible = true` with `this._visible ?? true`, so @visible={{null}} (e.g. an unset model attribute) now shows the alert. @arg only falls back to its default for undefined, so null used to hide it. Fall back for undefined only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
8945d07 copied @visible into the tracked _visible from a {{did-update this.updateVisibility @visible}} modifier. Writing it during modifier commit schedules a second render, and only that render runs {{did-update this.showOrHide this._visible}}, so each @visible change took an extra render pass before the fade started. Resolve visibility in the visible getter instead. A dismissal records how often @visible had changed at the time (_dismissedAt), and holds until @visible changes again, which the getter counts in untracked fields. That keeps ember-bootstrap#2027's behavior (dismiss doesn't touch @visible, and setting @visible to false and back to true shows the alert again) without writing tracked state while rendering, which is what broke @localcopy on Ember canary. showOrHide's did-update now reads @visible itself, so without a fade onDismissed is called from the afterRender queue instead of from the modifier: a handler that sets @visible (as in ember-bootstrap#2027's test) would otherwise update a value that render has already used. With a fade it was already called later, from a timer. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ly under Embroider 7b53aa7 skipped it everywhere for an Embroider-only failure (ember-bootstrap#1682), so classic builds stopped checking that BsForm doesn't swallow errors thrown by @onsubmit. Skip it only when @embroider/core is installed, the check @embroider/test-setup's maybeEmbroider uses to build with Embroider. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Joeu
approved these changes
Nov 4, 2026
Gaurav0
merged commit Nov 5, 2026
ee88a0f
into
gaurav/chore/SCF-2415-part-3-move-docs-tooling
152 of 157 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Uses
resolutionsto force newer majors of two packages that other addons pull in at old versions, which removes large old subtrees fromyarn.lock(about 1.5k lines).ember-auto-import2 underember-qunitandember-a11y-testing.ember-source-channel-url3 underember-try-config.Riskiest part of the stack. These are major-version overrides of transitive dependencies, so please check the test suite and the
ember-tryscenarios rather than just the lockfile diff.Dependencies
ember-auto-import^2.10.0underember-qunitandember-a11y-testing; locked 2.13.1 (1.12.2 gone)dependency(^2.2.0); the resolutions are scoped, not new direct depsember-source-channel-url^3.0.0under**/ember-try-config; locked 3.0.0 (1.2.0 gone)devDependency(^3.0.0)Stack
Part of the SCF-2415 audit work, split from
gaurav/chore/SCF-2415-audit-critical-highfor easier review. This is part 4 of 10. Stacked on Part 3: its base isgaurav/chore/SCF-2415-part-3-move-docs-tooling, so the diff only shows this part. Merge in order.@visibleregressionsReview notes
Review the two resolutions. Look at the test run and the ember-try scenarios, not only the lockfile.
Testing
yarn install --frozen-lockfilepasses on this branch. The full suite (yarn lint,ember test) was run on Part 9 (0 lint errors, 526 passed, 10 skipped, 0 failed) and again on Part 10 (0 lint errors, 532 passed, 9 skipped, 0 failed). Part 10 adds 5 tests and un-skips 1.🤖 Generated with Claude Code