Merge pull request #5 from kasuvy/APIGOV-30670

kasuvy · web-flow · commit d6ed9dff3f6f · 2025-06-23T14:59:20.000-07:00
APIGOV-30670 Security Updates
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -7,34 +7,76 @@ jobs:
   Lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
-          node-version: '16.x'
+          node-version: "20.x"
       - name: Install dependencies
         run: yarn
       - name: Lint
         run: yarn run lint
 
-  Test:
+  MacOsTest:
     needs: Lint
     name: ${{ matrix.os }} ${{ matrix.nodeVersion }} Tests
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
-        nodeVersion: [ '14.19.3', '16.15.1', '18.4.0' ]
-        os: [ macos-latest, ubuntu-latest, windows-latest ]
+        nodeVersion: ["20.19.2", "22.16.0"]
+        os: [macos-latest]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.nodeVersion }}
       - name: Install dependencies
         run: yarn
       - name: Run tests
         run: yarn run test
+  WindowsTest:
+    needs: Lint
+    name: ${{ matrix.os }} ${{ matrix.nodeVersion }} Tests
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        nodeVersion: ["20.19.2", "22.16.0"]
+        os: [windows-latest]
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v2
+        with:
+          node-version: ${{ matrix.nodeVersion }}
+      - name: Install dependencies
+        run: yarn
+      - name: Run tests
+        run: yarn run test
+  UbuntuTest:
+    needs: Lint
+    name: ${{ matrix.os }} ${{ matrix.nodeVersion }} Tests
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        nodeVersion: ["20.19.2", "22.16.0"]
+        os: [ubuntu-latest]
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.nodeVersion }}
+      - name: Install libsecret
+        run: sudo apt-get install -y libsecret-1-0
+      - name: Install dependencies
+        run: yarn
+      - name: Run tests
+        run: yarn run test
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,57 +1,62 @@
+# v4.0.0 (June 18, 2025)
+
+- BREAKING CHANGE: Require Node.js 20.18.2 LTS or newer.
+- chore: Updated dependencies.
+
 # v3.0.1 (July 7, 2022)
 
- * fix: Added missing `src` directory. Doh!
+- fix: Added missing `src` directory. Doh!
 
 # v3.0.0 (July 7, 2022)
 
- * BREAKING CHANGE: Require Node.js 14.15.0 LTS or newer.
- * BREAKING CHANGE: Changed package to a ES module.
- * chore: Updated dependencies.
+- BREAKING CHANGE: Require Node.js 14.15.0 LTS or newer.
+- BREAKING CHANGE: Changed package to a ES module.
+- chore: Updated dependencies.
 
 # v2.0.0 (Feb 15, 2022)
 
- * BREAKING CHANGE: Require Node.js 12.13.0 LTS or newer.
- * fix: Fixed handling of 404 requests when getting latest version.
- * chore: Updated dependencies.
+- BREAKING CHANGE: Require Node.js 12.13.0 LTS or newer.
+- fix: Fixed handling of 404 requests when getting latest version.
+- chore: Updated dependencies.
 
 # v1.2.1 (Jun 8, 2021)
 
- * fix: Writing a file with a mode was applying the mode to the file and newly created directories.
- * fix: Default new directories to mode 777.
+- fix: Writing a file with a mode was applying the mode to the file and newly created directories.
+- fix: Default new directories to mode 777.
 
 # v1.2.0 (Jun 7, 2021)
 
- * feat: Added `applyOwner` flag with default of `true` which sets the owner of the metadata file
-   to the owner of closest existing parent directory to protect against commands run as sudo.
- * chore: Updated dependencies.
+- feat: Added `applyOwner` flag with default of `true` which sets the owner of the metadata file
+  to the owner of closest existing parent directory to protect against commands run as sudo.
+- chore: Updated dependencies.
 
 # v1.1.2 (Jan 25, 2021)
 
- * fix: Always recalculate the update available flag and write the results to disk in order to
-   prevent a stale update available flag. ([CLI-106](https://jira.axway.com/browse/CLI-106))
- * chore: Updated dependencies.
+- fix: Always recalculate the update available flag and write the results to disk in order to
+  prevent a stale update available flag. ([CLI-106](https://jira.axway.com/browse/CLI-106))
+- chore: Updated dependencies.
 
 # v1.1.1 (Jan 5, 2021)
 
- * chore: Updated dependencies.
+- chore: Updated dependencies.
 
 # v1.1.0 (Dec 1, 2020)
 
- * fix: Bumped minimum Node.js requirement to 10.19.0 to prevent warnings on install.
- * chore: Updated dependencies.
+- fix: Bumped minimum Node.js requirement to 10.19.0 to prevent warnings on install.
+- chore: Updated dependencies.
 
 # v1.0.2 (Nov 30, 2020)
 
- * chore: Updated dependencies.
+- chore: Updated dependencies.
 
 # v1.0.1 (Nov 9, 2020)
 
- * fix: Fixed typo that caused npm to be checked every time.
+- fix: Fixed typo that caused npm to be checked every time.
 
 # v1.0.0 (Nov 9, 2020)
 
- * Initial release with support for:
-   - Fetching the latest version for a specific dist tag
-   - Fetches latest version from npm every so often
-   - Persist the update metadata
-   - HTTP proxy support
+- Initial release with support for:
+  - Fetching the latest version for a specific dist tag
+  - Fetches latest version from npm every so often
+  - Persist the update metadata
+  - HTTP proxy support
diff --git a/Jenkinsfile b/Jenkinsfile
@@ -2,5 +2,5 @@
 library 'pipeline-library'
 
 runNPMPackage {
-  nodeVersions = [ '14.19.3', '16.15.1', '18.4.0' ]
+  nodeVersions = [ '20.19.2', '22.16.0' ]
 }
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "check-kit",
-  "version": "3.0.1",
+  "version": "4.0.0",
   "description": "Checks if a newer version is available for command line interfaces",
   "type": "module",
   "exports": "./src/index.js",
@@ -28,7 +28,7 @@
     "test": "npm run lint && mocha test/**/test-*.js --reporter spec"
   },
   "dependencies": {
-    "@axway/amplify-request": "^3.0.10",
+    "@axway/amplify-request": "^4.0.2",
     "ci-info": "^3.3.2",
     "fs-extra": "^10.1.0",
     "registry-auth-token": "5.0.1",
@@ -55,6 +55,6 @@
     "url": "git://github.com/appcelerator/check-kit.git"
   },
   "engines": {
-    "node": ">=14.15.0"
+    "node": ">=20.18.2"
   }
 }
diff --git a/test/test-check-kit.js b/test/test-check-kit.js
@@ -103,7 +103,7 @@ describe('check-kit', function () {
 		it('should error if package.json is malformed', async () => {
 			await expect(check({
 				pkg: path.resolve(__dirname, 'fixtures/malformed/package.json')
-			})).to.eventually.be.rejectedWith(Error, 'Failed to parse package.json: Unexpected token { in JSON at position 1');
+			})).to.eventually.be.rejectedWith(Error, 'Failed to parse package.json: Expected property name or \'}\' in JSON at position 1');
 		});
 
 		it('should error if pkg is not an object', async () => {
@@ -342,7 +342,7 @@ describe('check-kit', function () {
 					version: '1.2.3'
 				},
 				registryUrl: 'http://127.0.0.1:1337'
-			})).to.eventually.be.rejectedWith(Error, /^Unexpected token { in JSON at position/);
+			})).to.eventually.be.rejectedWith(Error, /^Expected property name or '}' in JSON at position 1/);
 		});
 
 		it('should error if registry returned non-object JSON response', async () => {
diff --git a/yarn.lock b/yarn.lock

Original file line number	Diff line number	Diff line change
`@@ -2,5 +2,5 @@`
`2`	`2`	`library 'pipeline-library'`
`3`	`3`
`4`	`4`	`runNPMPackage {`
`5`		`- nodeVersions = [ '14.19.3', '16.15.1', '18.4.0' ]`
	`5`	`+ nodeVersions = [ '20.19.2', '22.16.0' ]`
`6`	`6`	`}`