Vito Sansevero
ec3adbd3ea
- minimatch below 11.0.1 can blow up a pattern into a huge set of glob parts (denial of service). c8 12.0.0, the newest, still pulls test-exclude 8, which pins minimatch ^10.2.2, so Dependabot cannot raise an update on its own. - Override minimatch to 11.0.8 and glob to 14.0.4 together: glob 13 reads Minimatch.set as RegExps, which minimatch 11 replaced with Matcher objects, and glob 14 is the release built on minimatch 11. - Dev-only: tools/ is excluded from the registry package by .comfyignore, and c8 only matches the repo's own coverage globs. npm audit now reports 0.
16 lines
571 B
JSON
16 lines
571 B
JSON
{
|
|
"name": "kikotools-test-tools",
|
|
"private": true,
|
|
"type": "module",
|
|
"engines": { "node": ">=24" },
|
|
"scripts": {
|
|
"test": "node --test ../../tests/js/*.test.mjs",
|
|
"test:comfyui": "playwright test --config comfyui.config.mjs",
|
|
"test:browser": "playwright test --config playwright.config.mjs",
|
|
"test:coverage": "node frontend-coverage.mjs",
|
|
"coverage:update": "node frontend-coverage.mjs --update-baseline"
|
|
},
|
|
"devDependencies": { "@playwright/test": "1.64.1", "c8": "12.0.0" },
|
|
"overrides": { "glob": "14.0.4", "minimatch": "11.0.8" }
|
|
}
|