Update c8 10.1.3 → 12.0.0 (major) - #330
Conversation
|
Skipping PR review because a bot author is detected. If you want to trigger CodeAnt AI, comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #330 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 2 2
Lines 470 470
=========================================
Hits 470 470 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![llamapreview[bot]](https://avatars.githubusercontent.com/in/1023541?s=60&v=4){kind=small}
There was a problem hiding this comment.
AI Code Review by LlamaPReview
🎯 TL;DR & Recommendation
Recommendation: Approve with suggestions
This PR upgrades c8 from v10.1.3 to v12.0.0, bringing breaking changes in Node engine requirements and a security fix (CVE-2026-26996). All CI checks pass, but the project lacks an explicit engines field to guard against incompatible Node versions.
🌟 Strengths
- All security and quality scans passed.
- Upgrade includes a fix for CVE-2026-26996.
💡 Suggestions (P2)
- package.json: The new c8 requires Node
^20.19.0 || ^22.12.0 || >=23, but the project does not declare anenginesfield. This could cause silent failures for developers using older Node versions. Consider adding theenginesconstraint to make the requirement explicit.
💡 Have feedback? We'd love to hear it in our GitHub Discussions.
✨ This review was generated by LlamaPReview Advanced, which is free for all open-source projects. Learn more.
| "devDependencies": { | ||
| "ava": "^6.3.0", | ||
| "c8": "^10.1.3" | ||
| "c8": "^12.0.0" | ||
| } |
There was a problem hiding this comment.
P2 | Confidence: Medium
Speculative: The upgrade from c8 v10 to v12 jumps two major versions (10.1.3 → 12.0.0) carrying breaking changes that enforce stricter Node.js engine requirements: ^20.19.0 || ^22.12.0 || >=23. The project's package.json does not include an engines field to enforce this constraint. While the CI tests passed in this PR (suggesting the CI environment already satisfies the requirement), any developer or CI runner using Node <20.19.0 would encounter runtime failures when c8 is invoked (e.g., c8 ava). Without an explicit engines guard, the upgrade introduces a silent compatibility risk for local development or non‑updated CI runners. The positive side is that v11 already addressed CVE‑2026‑26996 (minimatch), so the upgrade also brings a security fix. Adding an engines field would make the constraint explicit and prevent accidental usage on incompatible Node versions.
Code Suggestion:
"engines": {
"node": "^20.19.0 || ^22.12.0 || >=23"
},
"devDependencies": {
"ava": "^6.3.0",
"c8": "^12.0.0"
}
Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.
What changed?
✳️ c8 (10.1.3 → 12.0.0) · Repo · Changelog
Release Notes
12.0.0
11.0.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 7 commits:
chore(main): release 12.0.0 (#600)feat!: update yargs to 18.x.x (#599)chore(deps): update dependency @types/node to v24 (#579)build: go back to publishing manuallychore(main): release 11.0.0 (#577)fix(deps)!: pull newer minimatch addressing CVE-2026-26996 (#576)chore: .editorconfig to avoid unintended mods to .snap files (#556)Release Notes
0.1.6
0.1.5
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 7 commits:
chore(master): release 0.1.6fix: Undo change to schema in 0.1.x serieschore(master): release 0.1.5fix: Re-add release-pleasechore: Remove release-pleasechore(master): release 0.1.4fix: Remove development dependenciesCommits
See the full diff on Github. The new version differs by 3 commits:
7.1.3update tshy, etcBlueOak-1.0.0Release Notes
8.0.0 (from changelog)
7.0.2 (from changelog)
Does any of this look wrong? Please let us know.
🆕 balanced-match (added, 4.0.4)
🆕 brace-expansion (added, 5.0.8)
🆕 cliui (added, 9.0.1)
🆕 wrap-ansi (added, 9.0.2)
🆕 glob (added, 13.0.6)
🆕 lru-cache (added, 11.5.2)
🆕 minimatch (added, 10.2.5)
🆕 path-scurry (added, 2.0.2)
🆕 yargs (added, 18.0.0)
🆕 yargs-parser (added, 22.0.0)
Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with
@depfu rebase.All Depfu comment commands