mirror of
https://github.com/Heretek-AI/GDevelop-Heretek.git
synced 2026-10-12 02:02:42 +00:00
Claude
668656cd0c
CI on PR #5 failed on two jobs: - GDevelop.js (Jest): every test suite needs '../../Binaries/embuild/GDevelop.js/libGD.js', which is a compiled Emscripten artifact that wasn't built in CI. - newIDE/app (Jest): the npm audit --omit=dev --audit-level=high step (added in the previous review round) found 19 vulnerabilities in transitive deps that my custom guard had missed. GDevelop.js build (ci.yml): - Add 'emscripten-core/setup-emsdk@v4' action with version 3.1.21 (matches upstream CircleCI). - Drop '--ignore-scripts' from npm ci so patch-package and the libGD.js rebind postinstall run; add ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true so the deprecated Node 20 warning doesn't fail the step. - Add explicit 'Build libGD.js (Emscripten)' step that runs `npm run build` before `npm test`. This is the slowest step (~5-10 min cold). Audit fixes (package.json overrides + lockfile regeneration): - newIDE/app: add overrides for node-fetch, @grpc/grpc-js, protobufjs, websocket-driver, semver (^7.5.2), uuid (^11.1.1), yaml (^2.8.3), @protobufjs/utf8, form-data (^4.0.6), qs (^6.15.3). Bumped direct deps (semver 7.0.0 -> ^7.5.2, yaml ^2.8.2 -> ^2.8.3) where the override conflicted. - GDJS, newIDE/electron-app, newIDE/electron-app/app: form-data ^4.0.6, qs ^6.15.3 to clear the remaining two advisories. scripts/security/check-lockfiles.js: - Add the new packages to VULNERABLE_RANGES (node-fetch, @grpc/grpc-js, protobufjs, websocket-driver, semver, uuid, yaml, @protobufjs/utf8). - Tighten the range matcher to require same-major before comparing, so a '< 2.8.3' range correctly skips a 1.x version of the same-named package (yaml 1.x is a separate package line with no overlapping advisories). Verified: node scripts/security/check-lockfiles.js -> exit 0 cd newIDE/app && npm audit --omit=dev --audit-level=high -> 0 vulns cd newIDE/electron-app/app && npm audit --omit=dev --audit-level=high -> 0 vulns cd newIDE/app && npm test -> 132 suites, 1206 passed, 0 failed ci.yml YAML parses OK Electron-advisoried vulnerabilities in GDevelop.js and electron-app/app remain open because the user chose to stay on electron 32.x (see KNOWN_VULNS.md). Those will close once electron is bumped to 33.x.