From 18fd6c8124b83b247637c1ed8bb7d3ed7a45787f Mon Sep 17 00:00:00 2001 From: heyitsaamir Date: Mon, 5 Oct 2026 09:16:52 -0700 Subject: [PATCH] Remove vulnerable nodemon dependency Drop the tab example's nodemon dev dependency because latest nodemon still pulls chokidar 3 and vulnerable braces, and no patched braces 3.x is published. Use the existing tsx watch pattern instead and regenerate the npm lockfile so npm audit passes.\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- examples/tab/nodemon.json | 8 -- examples/tab/package.json | 3 +- package-lock.json | 279 ++------------------------------------ 3 files changed, 11 insertions(+), 279 deletions(-) delete mode 100644 examples/tab/nodemon.json diff --git a/examples/tab/nodemon.json b/examples/tab/nodemon.json deleted file mode 100644 index 521eaa9d7..000000000 --- a/examples/tab/nodemon.json +++ /dev/null @@ -1,8 +0,0 @@ -{ - "$schema": "https://raw.githubusercontent.com/SchemaStore/schemastore/refs/heads/master/src/schemas/json/nodemon.json", - "watch": ["./src/**"], - "ext": "ts,tsx", - "ignore": ["node_modules"], - "delay": 2, - "exec": "npm run build && npm start" -} diff --git a/examples/tab/package.json b/examples/tab/package.json index 4091a03b7..07e6a645a 100644 --- a/examples/tab/package.json +++ b/examples/tab/package.json @@ -14,7 +14,7 @@ "lint": "npx eslint", "lint:fix": "npx eslint --fix", "start": "node -r dotenv/config .", - "dev": "npx nodemon", + "dev": "npm run build:client && tsx watch -r dotenv/config src/index.ts", "build": "npx tsup && npm run build:client", "build:client": "npx vite build --outDir dist/client" }, @@ -32,7 +32,6 @@ "@types/node": "^26.6.2", "@vitejs/plugin-react": "^6.1.1", "dotenv": "^18.0.3", - "nodemon": "^3.1.4", "rimraf": "^6.0.1", "tsup": "^8.4.0", "typescript": "^5.4.5", diff --git a/package-lock.json b/package-lock.json index 55302668c..f0cad10ef 100644 --- a/package-lock.json +++ b/package-lock.json @@ -40,7 +40,7 @@ "@types/express": "^5.0.0", "@types/node": "^26.6.2", "dotenv": "^18.0.3", - "env-cmd": "*", + "env-cmd": "latest", "rimraf": "^6.0.1", "tsx": "^4.23.15", "typescript": "^5.4.5" @@ -196,7 +196,7 @@ "@microsoft/teams.config": "*", "@types/node": "^26.6.2", "dotenv": "^18.0.3", - "env-cmd": "*", + "env-cmd": "latest", "rimraf": "^6.0.1", "tsx": "^4.23.15", "typescript": "^5.4.5" @@ -284,7 +284,7 @@ "devDependencies": { "@types/node": "^26.6.2", "dotenv": "^18.0.3", - "env-cmd": "*", + "env-cmd": "latest", "rimraf": "^6.0.1", "tsx": "^4.23.15", "typescript": "^5.4.5" @@ -317,7 +317,7 @@ "devDependencies": { "@types/node": "^26.6.2", "dotenv": "^18.0.3", - "env-cmd": "*", + "env-cmd": "latest", "rimraf": "^6.0.1", "tsx": "^4.23.15", "typescript": "^5.4.5" @@ -350,7 +350,7 @@ "@microsoft/teams.config": "*", "@types/node": "^26.6.2", "dotenv": "^18.0.3", - "env-cmd": "*", + "env-cmd": "latest", "rimraf": "^6.0.1", "tsx": "^4.23.15", "typescript": "^5.4.5" @@ -417,7 +417,7 @@ "@microsoft/teams.config": "*", "@types/node": "^26.6.2", "dotenv": "^18.0.3", - "env-cmd": "*", + "env-cmd": "latest", "rimraf": "^6.0.1", "tsx": "^4.23.15", "typescript": "^5.4.5" @@ -599,7 +599,7 @@ "@types/express": "^5.0.0", "@types/node": "^26.6.2", "dotenv": "^18.0.3", - "env-cmd": "*", + "env-cmd": "latest", "rimraf": "^6.0.1", "tsx": "^4.23.15", "typescript": "^5.4.5" @@ -709,7 +709,7 @@ "@microsoft/teams.config": "*", "@types/node": "^26.6.2", "dotenv": "^18.0.3", - "env-cmd": "*", + "env-cmd": "latest", "rimraf": "^6.0.1", "tsx": "^4.23.15", "typescript": "^5.4.5" @@ -844,7 +844,7 @@ "@microsoft/teams.config": "*", "@types/node": "^26.6.2", "dotenv": "^18.0.3", - "env-cmd": "*", + "env-cmd": "latest", "rimraf": "^6.0.1", "tsx": "^4.23.15", "typescript": "^5.4.5" @@ -877,7 +877,7 @@ "@microsoft/teams.config": "*", "@types/node": "^26.6.2", "dotenv": "^18.0.3", - "env-cmd": "*", + "env-cmd": "latest", "rimraf": "^6.0.1", "tsx": "^4.23.15", "typescript": "^5.4.5" @@ -917,7 +917,6 @@ "@types/node": "^26.6.2", "@vitejs/plugin-react": "^6.1.1", "dotenv": "^18.0.3", - "nodemon": "^3.1.4", "rimraf": "^6.0.1", "tsup": "^8.4.0", "typescript": "^5.4.5", @@ -10121,17 +10120,6 @@ "tweetnacl": "^0.14.3" } }, - "node_modules/binary-extensions": { - "version": "2.3.0", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=8" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, "node_modules/body-parser": { "version": "2.3.0", "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz", @@ -10393,17 +10381,6 @@ "concat-map": "0.0.1" } }, - "node_modules/braces": { - "version": "3.0.3", - "dev": true, - "license": "MIT", - "dependencies": { - "fill-range": "^7.1.1" - }, - "engines": { - "node": ">=8" - } - }, "node_modules/browserslist": { "version": "4.28.8", "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.8.tgz", @@ -12916,17 +12893,6 @@ "url": "https://github.com/sponsors/sindresorhus" } }, - "node_modules/fill-range": { - "version": "7.1.1", - "dev": true, - "license": "MIT", - "dependencies": { - "to-regex-range": "^5.0.1" - }, - "engines": { - "node": ">=8" - } - }, "node_modules/finalhandler": { "version": "2.1.1", "license": "MIT", @@ -13794,11 +13760,6 @@ "node": ">= 4" } }, - "node_modules/ignore-by-default": { - "version": "1.0.1", - "dev": true, - "license": "ISC" - }, "node_modules/import-fresh": { "version": "3.3.1", "dev": true, @@ -13991,17 +13952,6 @@ "url": "https://github.com/sponsors/ljharb" } }, - "node_modules/is-binary-path": { - "version": "2.1.0", - "dev": true, - "license": "MIT", - "dependencies": { - "binary-extensions": "^2.0.0" - }, - "engines": { - "node": ">=8" - } - }, "node_modules/is-boolean-object": { "version": "1.2.2", "dev": true, @@ -14224,14 +14174,6 @@ "url": "https://github.com/sponsors/ljharb" } }, - "node_modules/is-number": { - "version": "7.0.0", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=0.12.0" - } - }, "node_modules/is-number-object": { "version": "1.1.1", "dev": true, @@ -16775,156 +16717,6 @@ "node": ">=18" } }, - "node_modules/nodemon": { - "version": "3.1.14", - "dev": true, - "license": "MIT", - "dependencies": { - "chokidar": "^3.5.2", - "debug": "^4", - "ignore-by-default": "^1.0.1", - "minimatch": "^10.2.1", - "pstree.remy": "^1.1.8", - "semver": "^7.5.3", - "simple-update-notifier": "^2.0.0", - "supports-color": "^5.5.0", - "touch": "^3.1.0", - "undefsafe": "^2.0.5" - }, - "bin": { - "nodemon": "bin/nodemon.js" - }, - "engines": { - "node": ">=10" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/nodemon" - } - }, - "node_modules/nodemon/node_modules/balanced-match": { - "version": "4.0.4", - "dev": true, - "license": "MIT", - "engines": { - "node": "18 || 20 || >=22" - } - }, - "node_modules/nodemon/node_modules/brace-expansion": { - "version": "5.0.12", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz", - "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==", - "dev": true, - "license": "MIT", - "dependencies": { - "balanced-match": "^4.0.2" - }, - "engines": { - "node": "20 || >=22" - } - }, - "node_modules/nodemon/node_modules/chokidar": { - "version": "3.6.0", - "dev": true, - "license": "MIT", - "dependencies": { - "anymatch": "~3.1.2", - "braces": "~3.0.2", - "glob-parent": "~5.1.2", - "is-binary-path": "~2.1.0", - "is-glob": "~4.0.1", - "normalize-path": "~3.0.0", - "readdirp": "~3.6.0" - }, - "engines": { - "node": ">= 8.10.0" - }, - "funding": { - "url": "https://paulmillr.com/funding/" - }, - "optionalDependencies": { - "fsevents": "~2.3.2" - } - }, - "node_modules/nodemon/node_modules/glob-parent": { - "version": "5.1.2", - "dev": true, - "license": "ISC", - "dependencies": { - "is-glob": "^4.0.1" - }, - "engines": { - "node": ">= 6" - } - }, - "node_modules/nodemon/node_modules/has-flag": { - "version": "3.0.0", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=4" - } - }, - "node_modules/nodemon/node_modules/minimatch": { - "version": "10.2.4", - "dev": true, - "license": "BlueOak-1.0.0", - "dependencies": { - "brace-expansion": "^5.0.2" - }, - "engines": { - "node": "18 || 20 || >=22" - }, - "funding": { - "url": "https://github.com/sponsors/isaacs" - } - }, - "node_modules/nodemon/node_modules/picomatch": { - "version": "2.3.2", - "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz", - "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=8.6" - }, - "funding": { - "url": "https://github.com/sponsors/jonschlinkert" - } - }, - "node_modules/nodemon/node_modules/readdirp": { - "version": "3.6.0", - "dev": true, - "license": "MIT", - "dependencies": { - "picomatch": "^2.2.1" - }, - "engines": { - "node": ">=8.10.0" - } - }, - "node_modules/nodemon/node_modules/semver": { - "version": "7.7.4", - "dev": true, - "license": "ISC", - "bin": { - "semver": "bin/semver.js" - }, - "engines": { - "node": ">=10" - } - }, - "node_modules/nodemon/node_modules/supports-color": { - "version": "5.5.0", - "dev": true, - "license": "MIT", - "dependencies": { - "has-flag": "^3.0.0" - }, - "engines": { - "node": ">=4" - } - }, "node_modules/normalize-path": { "version": "3.0.0", "dev": true, @@ -17864,11 +17656,6 @@ "url": "https://github.com/sponsors/lupomontero" } }, - "node_modules/pstree.remy": { - "version": "1.1.8", - "dev": true, - "license": "MIT" - }, "node_modules/punycode": { "version": "2.3.1", "license": "MIT", @@ -18873,28 +18660,6 @@ "url": "https://github.com/sponsors/isaacs" } }, - "node_modules/simple-update-notifier": { - "version": "2.0.0", - "dev": true, - "license": "MIT", - "dependencies": { - "semver": "^7.5.3" - }, - "engines": { - "node": ">=10" - } - }, - "node_modules/simple-update-notifier/node_modules/semver": { - "version": "7.7.4", - "dev": true, - "license": "ISC", - "bin": { - "semver": "bin/semver.js" - }, - "engines": { - "node": ">=10" - } - }, "node_modules/slash": { "version": "3.0.0", "dev": true, @@ -19610,17 +19375,6 @@ "url": "https://github.com/sponsors/SuperchupuDev" } }, - "node_modules/to-regex-range": { - "version": "5.0.1", - "dev": true, - "license": "MIT", - "dependencies": { - "is-number": "^7.0.0" - }, - "engines": { - "node": ">=8.0" - } - }, "node_modules/toidentifier": { "version": "1.0.1", "license": "MIT", @@ -19628,14 +19382,6 @@ "node": ">=0.6" } }, - "node_modules/touch": { - "version": "3.1.1", - "dev": true, - "license": "ISC", - "bin": { - "nodetouch": "bin/nodetouch.js" - } - }, "node_modules/tough-cookie": { "version": "4.1.4", "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-4.1.4.tgz", @@ -20154,11 +19900,6 @@ "url": "https://github.com/sponsors/ljharb" } }, - "node_modules/undefsafe": { - "version": "2.0.5", - "dev": true, - "license": "MIT" - }, "node_modules/undici": { "version": "8.11.2", "resolved": "https://registry.npmjs.org/undici/-/undici-8.11.2.tgz",