@companieshouse/ch-node-utils 3.0.9 → 3.0.11

package/README.md

@@ -149,3 +149,26 @@ The navbar also requires the use of styles provided in the [ch.gov.uk.css](https
 It also requires the [navbar.js](https://github.com/companieshouse/cdn.ch.gov.uk/blob/master/app/assets/javascripts/lib/navbar.js) script to be added to the footer to make the navbar work in mobile mode (make sure it's the latest version).
 
 `<script src="{{ cdnHost }}/javascripts/lib/navbar.js"></script>`
+
+
+### Dependency Overrides
+- **brace-expansion@5.0.8**
+  - Reason:
+      - CVE-2026-13149 affects transitive dependencies brought in by `jest` and `ts-jest`
+      - `glob@10.5.0 -> minimatch@9.0.9 -> brace-expansion@2.1.2`
+      - `test-exclude@6.0.0 -> minimatch@3.1.5 -> brace-expansion@1.1.16`
+      - No fixed versions of `glob`, `test-exclude`, `jest`, or `ts-jest` were available at the time of implementation.
+   - Mitigation:
+      - An npm override is used to force `brace-expansion@5.0.8` for all dependency paths.
+      - The application test suite was executed successfully after applying the override.
+      - Jest test execution, coverage and snapshot generation were verified to behave as expected.
+   - Risk:
+      - This override spans multiple major versions (`1.x`/`2.x` -> `5.x`).
+      - Compatibility is not guaranteed by npm and should be revalidated whenever related dependencies are upgraded.
+  - Ticket/CVE:
+      - CVE-2026-13149
+      - https://companieshouse.atlassian.net/browse/ASM-2688
+  - Remove after:
+      - Remove once glob and test-exclude has been upgraded to use >= minimatch@10.2.5.
+      - Ensure proper testing is completed after removal.
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@companieshouse/ch-node-utils",
-  "version": "3.0.9",
+  "version": "3.0.11",
   "author": "companieshouse",
   "main": "./lib/index.js",
   "types": "./lib/index.d.ts",
@@ -18,8 +18,8 @@
     "prebuild": "rm -rf ./lib",
     "build": "tsc",
     "test": "jest",
-    "_lint": "eslint '{src,test}/**/*'",
-    "_lint:fix": "eslint '{src,test}/**/*' --fix",
+    "_lint": "eslint .",
+    "_lint:fix": "eslint . --fix",
     "coverage": "jest --coverage --forceExit --passWithNoTests",
     "prepublishOnly": "[ ! -d node_modules ] && npm install; tsc",
     "postpublish": "rm -rf lib"
@@ -27,7 +27,6 @@
   "license": "MIT",
   "dependencies": {
     "@companieshouse/node-session-handler": "^5.2.15",
-    "eslint": "^9.14.0",
     "express": "^4.18.3",
     "i18next": "^23.10.1",
     "i18next-fs-backend": "^2.3.1",
@@ -39,23 +38,29 @@
     "@types/express": "^4.17.21",
     "@types/i18next": "^13.0.0",
     "@types/ioredis": "4.28.10",
-    "@types/jest": "^29.5.14",
+    "@types/jest": "^30.0.0",
     "@types/node": "^20.11.28",
     "govuk-frontend-6-0-0": "npm:govuk-frontend@6.0.0",
-    "jest": "^29.7.0",
-    "jest-environment-jsdom": "^30.3.0",
+    "jest": "^30.4.2",
+    "jest-environment-jsdom": "^30.4.1",
     "nunjucks": "^3.2.4",
-    "ts-jest": "^29.4.6",
-    "typescript": "^5.4.2"
+    "ts-jest": "^29.4.12",
+    "typescript": "^5.4.2",
+    "eslint": "10.8.0",
+    "typescript-eslint": "^8.0.0"
   },
   "peerDependencies": {
     "govuk-frontend": "^6.0.0"
   },
   "overrides": {
-    "js-yaml": "^4.2.0"
+    "js-yaml": "^4.2.0",
+    "brace-expansion": "^5.0.8"
   },
   "bugs": {
     "url": "https://github.com/companieshouse/ch-node-utils/issues"
   },
-  "homepage": "https://github.com/companieshouse/ch-node-utils#readme"
+  "homepage": "https://github.com/companieshouse/ch-node-utils#readme",
+  "engines": {
+    "node": ">=24.18.0"
+  }
 }