fix: force ejs to ^6.0.1 via npm overrides (#709) - #710
Open
shrutiburman wants to merge 3 commits into
Open
Conversation
…store public lockfile URLs CI was failing two independent ways: - `audit`: `make install` (which deletes and regenerates package-lock.json from scratch) pulled undici@5.29.0 transitively via our own @actions/core@^1.0.0 / @actions/github@^6.0.0 devDependencies, and Twilio's Artifactory curation policy now blocks that version (403). Bumped both to the same major versions @twilio/cli-core already uses (^2.0.0 / ^9.0.0), which resolve to undici@6.x instead. - `lockfile-hygiene` / AppVeyor's `npm ci`: the committed package-lock.json had 26 entries resolved to npmjs.artifacts.twilio.com instead of the public registry (from someone's local Artifactory-backed `npm install` never being normalized back). AppVeyor has no route to that internal host, so `npm ci` there was failing outright. Regenerated the lockfile via `make install` (only reachable through Artifactory from this network) and ported the restore-lockfile-registry.js script from twilio-cli-core to rewrite the resulting Artifactory URLs back to registry.npmjs.org. Also wired the script into `make install` itself (rather than per-workflow) since this repo's Makefile always deletes and rebuilds the lockfile from scratch, so every future install self-corrects before anyone commits.
The lockfile-hygiene CI check scans .npmrc (among other files) for registry/resolved host lines, and its script runs under `bash -e -o pipefail`. Our .npmrc only had `engine-strict=true`, which matches nothing, so the scan's `grep | grep | sed` pipeline for that file exited 1, pipefail propagated it, and set -e killed the whole check before it ever reached package-lock.json -- regardless of that file's actual content. Reproduced locally against the exact PR merge commit. Pinning the public registry explicitly is good practice on its own (it's the default for anyone running npm here without a corporate .npmrc override) and incidentally gives the scan a matching line so it completes instead of dying early.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #709
What
ejsto^6.0.1via npmoverrides, matching the same critical-CVE fix applied intwilio-cli-core.@actions/core/@actions/github(our own devDependencies, unrelated to the CLI's runtime code) to the same major versions@twilio/cli-corealready uses. The old range pulled in a version ofundicithat our dependency curation policy now blocks.package-lock.jsonand restore allresolvedURLs to the public npm registry — a from-scratch reinstall against our internal registry mirror had left several entries pointing at that internal host, which external contributors and outside CI runners (e.g. AppVeyor) can't reach.registry=https://registry.npmjs.org/in.npmrcso the default registry is unambiguous for anyone building this repo without additional local configuration.restore-lockfile-registry.jshelper fromtwilio-cli-coreand wire it intomake install, so future installs self-correct before anyone commits a lockfile pointing at an internal host.Checklist
If you have questions, please file a support ticket, or create a GitHub Issue in this repository.