rooibos-roku 5.16.3 → 5.16.4

package/CHANGELOG.md

@@ -6,6 +6,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 
 
+## [5.16.4](https://github.com/rokucommunity/rooibos/compare/5.16.3...v5.16.4) - 2026-06-10
+### Changed
+ - Make tests less brittle - removes full transpile string checks ([#396](https://github.com/rokucommunity/rooibos/pull/396))
+ - Security enhancements
+ - upgrade to [brighterscript@0.72.5](https://github.com/rokucommunity/brighterscript/blob/master/CHANGELOG.md#0725---2026-06-10). Notable changes since 0.72.2:
+   - Security enhancements
+ - upgrade to [roku-debug@0.23.11](https://github.com/rokucommunity/roku-debug/blob/master/CHANGELOG.md#02311---2026-06-04). Notable changes since 0.23.8:
+     - Fix pressHomeButton crash in disconnectRequest ([#358](https://github.com/rokucommunity/roku-debug/pull/358))
+     - Security enhancements
+ - upgrade to [roku-deploy@3.17.6](https://github.com/rokucommunity/roku-deploy/blob/master/CHANGELOG.md#3176---2026-06-04). Notable changes since 3.17.4:
+     - Fix case-insensitive matching for absolute `files.src` glob patterns on case-insensitive file systems ([#279](https://github.com/rokucommunity/roku-deploy/pull/279))
+     - Preserve `!` glob-negation prefix in standardizePath ([#277](https://github.com/rokucommunity/roku-deploy/pull/277))
+     - Security enhancements
+ - upgrade to [ropm@0.11.8](https://github.com/rokucommunity/ropm/blob/master/CHANGELOG.md#0118---2026-05-30). Notable changes since 0.11.7:
+     - Security enhancements
+
+
+
 ## [5.16.3](https://github.com/rokucommunity/rooibos/compare/5.16.2...v5.16.3) - 2026-05-20
 ### Changed
  - Update ropm to 0.11.7 and remove lodash override ([#391](https://github.com/rokucommunity/rooibos/pull/391))

package/README.md

@@ -47,3 +47,7 @@ Yes, it's been used in production by quite a few respectable companies. There ar
 ### Is Rooibos actively maintained?
 
 We at RokuCommunity love rooibos, and regularly keep it up to date.
+
+## Accepted security advisories
+
+Dependencies flagged by `npm audit` that we have reviewed and chosen not to upgrade are tracked in [audit-ci.jsonc](https://github.com/RokuCommunity/rooibos/blob/master/audit-ci.jsonc). Each entry includes the advisory ID, the date it was added, and the reason it does not apply to this project.

package/audit-ci.jsonc

@@ -0,0 +1,15 @@
+{
+    // Fail on high severity and above. See README "Accepted security advisories" for
+    // why each allowlisted entry is safe to defer.
+    "$schema": "https://github.com/IBM/audit-ci/raw/main/docs/schema.json",
+    "high": true,
+    "allowlist": [
+        {
+            "GHSA-w5hq-g745-h8pq": {
+                // Added: 2026-05-22
+                "active": true,
+                "notes": "`uuid` <11.1.1 (via `postman-request` and dev-only `nyc>istanbul-lib-processinfo`): vulnerable code path is `v3()`/`v5()`/`v6()` when a caller-provided buffer is passed. All consumers in this dep graph call only `v4()` (no buffer arg), so the vulnerable path is unreachable."
+            }
+        }
+    ]
+}

package/dist/lib/utils/Diagnostics.js

@@ -14,6 +14,7 @@ function addDiagnosticForStatement(file, code, message, statement, severity = br
 function addDiagnosticForAnnotation(file, code, message, annotation, severity = brighterscript_1.DiagnosticSeverity.Error, endChar) {
     let line = annotation.range.start.line;
     let col = annotation.range.start.character;
+    // TODO: Fix the end character to be the end of the annotation, not the start + 9999
     file.addDiagnostics([createDiagnostic(file, code, message, line, col, annotation.range.end.line, annotation.range.end.character + 9999, severity)]);
 }
 function createDiagnostic(bscFile, code, message, startLine = 0, startCol = 99999, endLine = 0, endCol = 99999, severity = brighterscript_1.DiagnosticSeverity.Error) {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "rooibos-roku",
-    "version": "5.16.3",
+    "version": "5.16.4",
     "description": "simple, flexible, fun brightscript test framework for roku scenegraph apps - roku brighterscript plugin",
     "scripts": {
         "preversion": "npm run build && npm run lint && npm run test",
@@ -14,17 +14,17 @@
         "docs": "jsdoc -c jsdoc.json -d .tmp/docs --verbose",
         "test": "nyc mocha",
         "test:nocover": "mocha",
-        "audit": "npm audit",
+        "audit": "npm audit || audit-ci --config ./audit-ci.jsonc",
         "cli": "ts-node src/cli.ts",
         "package": "npm run build && npm pack"
     },
     "dependencies": {
-        "brighterscript": "^0.72.2",
+        "brighterscript": "^0.72.5",
         "fast-glob": "^3.2.12",
         "fs-extra": "^10.1.0",
         "minimatch": "^3.0.4",
-        "roku-debug": "^0.23.8",
-        "roku-deploy": "^3.17.4",
+        "roku-debug": "^0.23.11",
+        "roku-deploy": "^3.17.6",
         "rooibos_promises": "npm:@rokucommunity/promises@^0.5.0",
         "source-map": "^0.7.3",
         "undent": "^1.0.1",
@@ -43,6 +43,7 @@
         "@types/yargs": "^15.0.5",
         "@typescript-eslint/eslint-plugin": "^5.27.0",
         "@typescript-eslint/parser": "^5.27.0",
+        "audit-ci": "^7.1.0",
         "brighterscript-jsdocs-plugin": "^0.7.3",
         "chai": "^4.2.0",
         "docdash": "^2.0.2",
@@ -54,7 +55,7 @@
         "jsdoc": "^4.0.5",
         "mocha": "^10.8.2",
         "nyc": "^15.1.0",
-        "ropm": "^0.11.7",
+        "ropm": "^0.11.8",
         "source-map-support": "^0.5.13",
         "ts-node": "^10.7.0",
         "typescript": "^4.7.2"