Repository navigation
fix: fill in every star of a target, and trim slashes without a regex - #47
Merged
Merged
Conversation
CodeQL's default setup reported four alerts. In package.json `imports` and `exports`, Node.js fills in every `*` of a target, but the scan replaced only the first, so a target such as "./desks/*/*-fixtures.ts" pointed to a file that doesn't exist and the import wasn't followed. tsconfig `paths` gets `replaceAll` too: TypeScript allows one `*` there (error 5062), so nothing changes for a valid config, and the same code reads the same in all three places. The folder hint trimmed trailing slashes with /[\\/]+$/, which backtracks over every run of slashes: 200,000 slashes took 28.7 s. A loop takes 22 ms. Chose: replaceAll for tsconfig paths too (alternative: dismiss that alert as a false positive), so no alert needs dismissing by hand and the three lookups match.
Huldoser
enabled auto-merge (squash)
October 22, 2026 17:42
Huldoser
added a commit
that referenced
this pull request
Oct 26, 2026
## What changed Release 0.4.1, made with `npm run release`. ### Patch Changes - [#48](#48) [`6549682`](6549682) - A hook given a function the file declares, as in `test.beforeEach(skipOnCI)` or `beforeEach(requireBroker)`, is read like one written in place: the skips, timeouts and other settings it sets apply to the tests it runs before, and its fixtures are in their `fixtures`. Before, they were missed. A test or hook function passed by name no longer gets a `state-in-helper` warning saying no test, hook or describe in the file calls it. - [#47](#47) [`a603623`](a603623) - A `#` import or workspace package export whose target repeats the `*` of its pattern, as in `"#desks/*": "./desks/*/*-fixtures.ts"`, is followed to the file Node.js loads, with every `*` filled in. Only the first was filled in before, so the import wasn't followed and its tests were missing, with an `unresolved-test-import` error. A folder given as the pattern with a long run of slashes, as in `tests////unit`, no longer slows the scan down while the hint for it is written. ## Checklist - [ ] Tests cover the change, and `npm run coverage` reports 100%. - [ ] The docs describe the change: the guide or reference pages, the README, or the TSDoc of exported functions. - [x] No docs change is needed. - [x] A changeset describes the change for users (`npm run changeset`), or the change does not affect them.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Fixes the four open CodeQL alerts.
#imports and workspace package exports with a repeated*(alerts Release 0.1.0 #2, Release with npm run release and trusted publishing #3). Node.js fills in every*of atarget, so
"#desks/*": "./desks/*/*-fixtures.ts"loadsdesks/equities/equities-fixtures.tsfor#desks/equities. The scan replaced only the first*, didn't follow the import, and left its tests out with anunresolved-test-importerror. A failing test for each, now passing.paths(alert Build the scanner, command line, docs and release workflow for 0.1.0 #1). TypeScript allows one*in apathstarget (error 5062), so this was a falsepositive. It uses
replaceAlltoo, which changes nothing for a valid config, so the alert closes without beingdismissed by hand.
/[\\/]+$/backtracks over every run of slashes: a folderpattern with 200,000 slashes took 28.7 s. A loop trims them in 22 ms; the new test fails on the old code at its 5 s
limit.
A patch changeset.
Checklist
npm run coveragereports 100%.npm run changeset), or the change does not affect them.