ci: test against multiple node versions by aldy505 · Pull Request #476 · tinyhttp/tinyhttp

aldy505 · 2025-12-30T06:50:08Z

We're testing against Node 20, which is on maintenance mode right now. Let's test against new versions as well.

Also pinned GHA versions to the commit hash (using actions-up).

socket-security · 2025-12-31T01:29:59Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality
husky@9.1.7
@types/negotiator@0.6.4
@vitest/coverage-v8@3.2.4
@commitlint/cli@19.8.1
supertest-fetch@1.5.0
vitest@3.2.4
@tinyhttp/vary@0.1.3
es-escape-html@0.1.1
regexparam@2.0.2
regexparam@3.0.0
header-range-parser@1.1.3
@types/node@22.10.7
mime@2.6.0 ⏵ 4.1.0	⁺¹	⁺²
c8@10.1.3
vite@7.1.11
ipaddr.js@1.9.1 ⏵ 2.2.0	⁺¹	⁺¹
typescript@5.9.2
@commitlint/config-conventional@19.8.1
graphql@16.12.0
@changesets/cli@2.29.7
eta@2.2.0
@biomejs/biome@2.2.4

View full report

socket-security · 2025-12-31T01:30:03Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Critical CVE: npm `form-data` uses unsafe random function in form-data for choosing boundary CVE: GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary (CRITICAL) Affected versions: < 2.5.4; >= 3.0.0 < 3.0.4; >= 4.0.0 < 4.0.4 Patched version: 4.0.4 From: pnpm-lock.yaml → `npm/supertest-fetch@1.5.0` → `npm/form-data@4.0.2` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/form-data@4.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `safer-buffer` is 94.0% likely obfuscated Confidence: 0.94 Location: Package overview From: `?` → `npm/safer-buffer@2.1.2` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/safer-buffer@2.1.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `vite` is 91.0% likely obfuscated Confidence: 0.91 Location: Package overview From: package.json → `npm/vite@7.1.11` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/vite@7.1.11`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

v1rtl · 2026-01-02T15:27:39Z

Can you make this PR into a single commit instead?

v1rtl · 2026-01-02T15:27:58Z

Also not sure why we gotta put pinned hashes

Do actions not follow semver?

aldy505 · 2026-01-03T07:40:26Z

Can you make this PR into a single commit instead?

You can squash and merge this commit, doing a force push is a hassle.

Also not sure why we gotta put pinned hashes

Do actions not follow semver?

A good security practice that most people (security engineers) recently due.

Node.js v24 introduces several breaking changes that affect tests: 1. Cache-Control headers: Node.js v24's fetch automatically adds 'cache-control: no-cache' headers, preventing 304 Not Modified responses. Updated tests to explicitly set 'Cache-Control: max-age=3600' to allow conditional GET behavior. 2. IP/Hostname handling: Node.js v24 may connect via IPv6 (::1) even with Agent({ family: 4 }), and ignores custom Host headers for security. Updated tests to handle both IPv4 and IPv6 connections and accept 'localhost' hostname on v24+. 3. TRACE method: Node.js v24 blocks TRACE HTTP method for security (XST attack prevention). Added version check to skip test on v24+. 4. Host header validation: Node.js v24 has stricter validation for malformed headers. Updated tests to accept either 200 or 500 status codes depending on Node.js version. All changes maintain backward compatibility with Node.js v20 and v22 while supporting the new security-focused behavior in v24. Fixes #476 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* docs: add CLAUDE.md for AI-assisted development Add comprehensive documentation for Claude Code to understand: - Common development commands (build, test, lint) - High-level architecture (App class, Router, extensions) - Project structure and monorepo layout - Testing patterns and helpers - Release process with changesets - Code style and dependencies Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * chore: bump dev dependencies and configure workspace trust policy Update development dependencies: - @biomejs/biome: 2.2.4 → 2.3.7 - @commitlint/cli: 19.8.1 → 20.1.0 - @commitlint/config-conventional: 19.8.1 → 20.0.0 - @types/node: 22.10.7 → 24.10.1 - @vitest/coverage-v8: 3.2.4 → 4.0.13 - supertest-fetch: 1.5.0 → 2.0.0 - typescript: 5.9.2 → 5.9.3 - vite: 7.1.11 → 7.2.4 - vitest: 3.2.4 → 4.0.13 Add pnpm workspace trust policy configuration: - Enable no-downgrade trust policy - Set minimum release age to 24 hours - Configure trust policy timeout Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * test: fix compatibility with Node.js v24 Node.js v24 introduces several breaking changes that affect tests: 1. Cache-Control headers: Node.js v24's fetch automatically adds 'cache-control: no-cache' headers, preventing 304 Not Modified responses. Updated tests to explicitly set 'Cache-Control: max-age=3600' to allow conditional GET behavior. 2. IP/Hostname handling: Node.js v24 may connect via IPv6 (::1) even with Agent({ family: 4 }), and ignores custom Host headers for security. Updated tests to handle both IPv4 and IPv6 connections and accept 'localhost' hostname on v24+. 3. TRACE method: Node.js v24 blocks TRACE HTTP method for security (XST attack prevention). Added version check to skip test on v24+. 4. Host header validation: Node.js v24 has stricter validation for malformed headers. Updated tests to accept either 200 or 500 status codes depending on Node.js version. All changes maintain backward compatibility with Node.js v20 and v22 while supporting the new security-focused behavior in v24. Fixes #476 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * test: fix compatibility with Node.js v24 Node.js v24 introduces several breaking changes that affect tests: 1. Cache-Control headers: Node.js v24's fetch automatically adds 'cache-control: no-cache' headers, preventing 304 Not Modified responses. Updated tests to explicitly set 'Cache-Control: max-age=3600' to allow conditional GET behavior. 2. IP/Hostname handling: Node.js v24 may connect via IPv6 (::1) even with Agent({ family: 4 }), and ignores custom Host headers for security. Updated tests to handle both IPv4 and IPv6 connections and accept 'localhost' hostname on v24+. 3. TRACE method: Node.js v24 blocks TRACE HTTP method for security (XST attack prevention). Added version check to skip test on v24+. 4. Host header validation: Node.js v24 has stricter validation for malformed headers. Updated tests to accept either 200 or 500 status codes depending on Node.js version. All changes maintain backward compatibility with Node.js v20 and v22 while supporting the new security-focused behavior in v24. Fixes #476 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * chore: fix biome check errors - Update biome schema version from 2.2.4 to 2.3.7 - Ignore HTML template files with interpolation syntax - Remove unused biome-ignore comment in firebase example - Apply biome formatting to test files Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * chore: fix biome-ignore placeholder explanations Replace <explanation> placeholders with actual descriptions for: - jsonp: escape shadows global function - cookie: RFC 7230 field-content regex - content-disposition: RFC 5987/6266 parsing regexes Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * ci: update Biome version to 2.3.7 Sync CI Biome version with package.json to fix check failures. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * test: fix Node.js security backport compatibility - Skip TRACE test (security restriction backported to Node 20.19+, 22.13+) - Make hostname tests flexible for both old and new Host header behavior - Make malformed host tests accept both behaviors Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>

aldy505 added 3 commits December 30, 2025 13:49

ci: test against multiple node versions

aadee0c

ci: node 26 does not exists yet

c59a8af

ci: pin Biome to a specific version

3e0b4c5

v1rtl reviewed Dec 30, 2025

View reviewed changes

Comment thread .github/workflows/main.yml Resolved

ref: remove 25 as it's not LTS

c7190e7

aldy505 requested a review from v1rtl December 31, 2025 12:47

v1rtl merged commit 2799a2e into tinyhttp:master Jan 20, 2026
13 checks passed

Navigation Menu

Repository navigation

ci: test against multiple node versions - #476

ci: test against multiple node versions#476
v1rtl merged 4 commits into
tinyhttp:masterfrom
aldy505:ci/test-against-multiple-node-versions

aldy505 commented Dec 30, 2025

Uh oh!

Uh oh!

socket-security Bot commented Dec 31, 2025

Uh oh!

socket-security Bot commented Dec 31, 2025

Uh oh!

v1rtl commented Jan 2, 2026

Uh oh!

v1rtl commented Jan 2, 2026

Uh oh!

aldy505 commented Jan 3, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

aldy505 commented Dec 30, 2025

Uh oh!

Uh oh!

socket-security Bot commented Dec 31, 2025

Uh oh!

socket-security Bot commented Dec 31, 2025

Uh oh!

v1rtl commented Jan 2, 2026

Uh oh!

v1rtl commented Jan 2, 2026

Uh oh!

aldy505 commented Jan 3, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants