chore(deps): clear the dependency audit backlog

[dividedmind]

Works through yarn npm audit -AR and fixes everything fixable without a breaking change to appmap-node itself. What remains is explicitly accepted by advisory ID, with the reasoning and the version floors that unblock each group written up in a new maintainer doc.

yarn npm audit -AR now exits 0 with No audit suggestions.

Nothing here was ever shipped to consumers — yarn npm audit -R --environment production reported no suggestions both before and after. Every finding lived in devDependencies or in a private, test-only workspace under test/.

11 commits, deliberately unsquashed: the rationale for each change — especially the "why a bump cannot work here" cases — lives in the commit messages.

Dependency fixes

yarn dedupe was run after each bump, with targeted tests after each.

Change	Advisories cleared
body-parser 2.2.2 → 2.3.0	1 low. Lockfile-only — express's ^2.2.1 already admitted the fix
vitest 3.2.4 → 3.2.7 (test/vitest3)	1 critical (GHSA-5xrq-8626-4rwp)
vitest 4.0.18 → 4.1.10 (test/vitest4)	1 critical + 5 vite (pulls vite 8.x)
next 16.1.7 → 16.3.1 (test/next16)	9 next + 1 high sharp (GHSA-f88m-g3jw-g9cj)
vite 7.3.1 → 7.3.6, esbuild 0.27.3 → 0.28.2	5 vite + 1 esbuild
sqlite3 5.1.6 → 5.1.7	0 net — see caveat below

Two resolutions overrides

Both are cases where bumping was structurally impossible, not merely awkward:

• node-gyp: ^11.5.0 — clears 6 findings (npmlog, gauge, are-we-there-yet, rimraf, @npmcli/move-file, @tootallnate/once). Three separate optional node-gyp entries (8.4.1 via sqlite3, 9.4.0 via fsevents/node-addon-api declaring node-gyp: latest, 12.4.0 via npm's own tree) were dragging in a large deprecated subtree. yarn npm audit -AR walks optional lockfile entries even though nothing links them — sqlite3 and fsevents both ship prebuilt binaries, so node-gyp never actually runs here. Pinned to 11.5.0 rather than 12.x on purpose: 12.x would also clear the last glob notice but declares engines.node: ^20.17.0 || >=22.9.0, and CI still covers Node 18.
• postcss: ^8.5.26 — clears 4 findings, including two high-severity nanoid advisories via nanoid 3.3.18. next@14.2.35 depends on "postcss": "8.4.31", an exact pin, so the resolver had no range to move within and no bump could reach it.

sqlite3 caveat

Flagged because it's the one change that doesn't reduce the audit count — it nets +1. 5.1.7 replaces the unmaintained @mapbox/node-pre-gyp with prebuild-install, which genuinely improves the installed graph, but it still declares node-gyp: 8.x as an optional dep and prebuild-install is itself deprecated. Kept because the installed-tree improvement is real and prebuild-install is unavoidable (sqlite3 6.x depends on it too), but this is the commit to drop if you disagree.

One product change

65560be fix(vitest): support vitest 4.1, which moved runTest to chunk-artifact.js

Deliberately a separate fix: commit rather than folded in with the bumps. vitest 4.1 rebundled @vitest/runner, relocating the runTest declaration we wrap from dist/chunk-hooks.js to dist/chunk-artifact.js. Without a matching hook point the wrap silently never applies and vitest runs fall back to process recording, losing per-test AppMaps and their metadata. Required to bump test/vitest4 at all.

This PR will cut a patch release. The fix: commit triggers semantic-release; the chore:/test: commits alone would not. That's the intended outcome — the vitest 4.1 hook fix is user-facing.

Node 18 regression, caught and fixed

0c36467 test(vitest): skip the vitest 4 cases on Node 18

The vitest 4 bump broke Node 18 CI, and this is a genuine regression introduced by this branch rather than a pre-existing failure. 4.1.10 pulls vite 8, which brings rolldown, which imports styleText from node:util — added in Node 20.12:

SyntaxError: The requested module 'node:util' does not provide an export named 'styleText'
  at async start (.../vitest/dist/chunks/cac.*.js)

It's a SyntaxError at module load, so vitest run dies before executing anything and the run produces no AppMaps at all rather than failing an assertion — which is why it surfaced as an empty {} snapshot. Confirmed causal by temporarily downgrading: 4.0.18 runs fine on Node 18, because it resolved vite 7 without rolldown, despite declaring the same engines range.

Skipped rather than pinned back, because vitest 4 doesn't support Node 18 by its own declaration — exercising it there tests a combination no user can have, and any 4.x patch would break it again. Pinning back would also reinstate GHSA-5xrq-8626-4rwp (critical).

Scoped to v4 only, verified rather than assumed — every older major genuinely supports Node 18 and keeps running there:

	declared engines.node
vitest 0.34.6	>=v14.18.0
vitest 1.6.1 / 2.1.9	^18.0.0 || >=20.0.0
vitest 3.2.7	^18.0.0 || ^20.0.0 || >=22.0.0
vitest 4.1.10	^20.0.0 || ^22.0.0 || >=24.0.0

Accepted findings and the doc

cd1ccfd adds npmAuditIgnoreAdvisories to .yarnrc.yml plus docs/maintenance/deferred-upgrades.md.

Listed as 31 individual advisory IDs rather than package-level excludes, on purpose: excluding a package masks its future advisories too, and for next and vite that would have hidden genuinely actionable alerts against test/next16 (current Next 16.x) and the vitest 3/4 chains (vite 7/8). Verified precise rather than blanket — removing any single ID makes exactly that finding reappear, and nothing else.

The list is long, so it's built to be retired wholesale. Every block carries a REMOVE WHEN: line naming its trigger, and the doc has the matching table:

Do this	Blocks freed	Entries
Drop support for vitest < 3	vitest, vite, esbuild	5
Move test/next off Next 14	next	21
Raise engines.node to 20	serialize-javascript	2
Raise engines.node to 20.17	glob, plus drop/retarget the node-gyp pin	1
Bump mocha past 10.x	inflight	1
— unfixable	prebuild-install	0

26 of the 31 go away with the first two rows. The cleanup is also self-checking: delete a block, re-run yarn npm audit -AR, and if it still exits clean the entries were dead.

What's blocked and why

Every accepted finding is genuinely unreachable by a bump:

• next 14.2.35 (test/next) — 21 advisories, all fixed in 15.5.x+. 14.2.35 is the last stable 14.x; only canaries exist beyond it, so there's zero headroom within the major.
• vitest 0.34.6 / 1.6.1 / 2.1.9 — the same critical advisory, and no fix exists on those lines. Upstream fixed only 3.2.6 and 4.1.0; each of these is the final release of its major. Requires the Vitest UI server to be listening, which these tests never start.
• vite 5.4.21 / esbuild 0.21.5 — downstream of the above. vitest 1.6.1 pins vite: ^5.0.0, and 5.4.21 is the last 5.x.
• serialize-javascript 6.0.2 — no released mocha allows the fix: 10.8.2 and 11.8.0 both pin ^6.0.2, only mocha@12.0.0-rc.6 moves to ^7.0.2. An override is blocked too, because 7.x declares engines.node: >=20.0.0. Only reachable from mocha's parallel-mode workers, which test/mocha never uses.

The doc also records two decisions that are easy to undo by accident: that Dependabot rather than yarn audit is the security signal here (with the data showing why the devDependencies/auto-triage route was investigated and rejected), and that yarn audit is deliberately not a CI gate, since it duplicates Dependabot and would fail builds on findings we've explicitly accepted.

Test fixture fix

b505b1c test(next16): disable Next.js agent-rules file generation

Next 16 bundles @vercel/detect-agent and, on next dev, writes a managed AGENTS.md / CLAUDE.md block into the project dir when it detects an AI coding agent (CLAUDECODE, AI_AGENT, CURSOR_TRACE_ID, CODEX_*, COPILOT_*, …). So the suite left two untracked files behind when run under an agent and none when run by a human — the fixture wasn't reproducible across environments. agentRules: false fixes the cause instead of hiding it with .gitignore, and avoids committing Next's AI instructions into a fixture that serves one hello route.

Verification

Check	Result
yarn install --immutable (what CI runs)	pass — lockfile in sync with 6 changed manifests + 2 new resolutions
yarn dedupe --check	clean
yarn prepack	compiles
yarn lint	clean
yarn test on Node 24	38 suites passed, 2 skipped, 182 tests, 58 snapshots
yarn test on Node 18	37 suites passed, 3 skipped, 179 tests, 55 snapshots
yarn npm audit -AR	No audit suggestions, exit 0
yarn npm audit -R --environment production	No audit suggestions

Reviewer notes

• One flaky failure observed. The first full Node 18 run had a single toMatchSnapshot failure in the vitest v1+ block; the vitest file passed in isolation and a second full run passed clean. Recording it as a flake rather than asserting it's nothing — worth watching on CI.
• A latent fragility left alone: vitest 3.2.7 claims Node 18 support but resolves vite 7.3.6, which declares ^20.19.0 || >=22.12.0. So vitest3-on-Node-18 works by luck rather than contract — the same shape of trap that produced the v4 regression above. Upstream's inconsistency, not ours, but a plausible next breakage.
• One snapshot changed (test/__snapshots__/next16.test.ts.snap), and it's upstream churn, not an instrumentation change: Next now sends Cache-Control: no-cache instead of no-store, and the rendered page is 62 bytes longer. The recorded AppMap structure is otherwise identical.
• The postcss override is under-exercised. Both Next test apps pass, but neither contains any CSS or a postcss config, so postcss is loaded by the build pipeline without being meaningfully exercised. The override stays inside the 8.x major and both workspaces are private and test-only, so the blast radius is limited to CI.
• Both test-behaviour changes were verified by positive control, not just a green run: the vitest4 skip was checked on Node 18 and Node 24, and the next16 agent-file change was checked with the detection env vars still set, so generation would otherwise have fired.

After merge

Dependabot's view is narrower than yarn's and it had been reading main, so several of its open alerts (body-parser, nanoid, postcss, sharp, one esbuild) are fixed by this PR and should close on re-scan. Worth letting that happen before dismissing anything, then dismissing the residual next 14 alerts with reason not_used, rather than dismissing alerts that were about to resolve themselves.

Assisted-by: Claude:claude-opus-5[1m]

[Copilot]

Pull request overview

This PR clears the yarn npm audit -AR backlog by applying non-breaking dependency upgrades, adding narrowly-scoped audit suppressions (by advisory ID) with maintainer documentation, and includes a user-facing fix to keep Vitest 4.1 instrumentation working after runTest moved bundles.

Changes:

• Bump multiple dev/test dependencies (Vitest 3/4 fixtures, Next 16 fixture, sqlite3 fixture, and transitive toolchain deps via lockfile updates) and add two root resolutions overrides.
• Add .yarnrc.yml npmAuditIgnoreAdvisories entries plus a maintainer doc explaining what’s deferred and what version floors would remove each suppression block.
• Update Vitest hook instrumentation to also target @vitest/runner/dist/chunk-artifact.js, and adjust tests/fixtures for new behaviors (Node 18 Vitest 4 skip + Next 16 agent-rules file generation suppression).

Reviewed changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
yarn.lock	Updates the resolved dependency graph to incorporate the audit-clearing bumps/dedupes and new transitive trees.
package.json	Adds resolutions overrides (node-gyp, postcss) to eliminate otherwise-unreachable advisories without breaking Node 18 support.
.yarnrc.yml	Introduces npmAuditIgnoreAdvisories with block-level rationale and “REMOVE WHEN” triggers to keep yarn npm audit -AR clean.
docs/maintenance/deferred-upgrades.md	Documents deferred/accepted advisories and the concrete upgrade floors needed to retire each suppression block.
src/hooks/vitest.ts	Extends Vitest runner instrumentation to the new chunk-artifact.js location used by Vitest 4.1.
test/vitest.test.ts	Skips Vitest 4 fixture runs on unsupported Node versions to keep Node 18 CI green.
test/vitest3/package.json	Bumps the Vitest 3 fixture dependency range to a fixed, audited version line.
test/vitest4/package.json	Bumps the Vitest 4 fixture dependency range to 4.1.x (required for the audit fix + hook update).
test/sqlite/package.json	Bumps sqlite3 fixture to 5.1.7 (tooling/tree changes reflected in the lockfile).
test/next16/package.json	Bumps Next 16 fixture dependency range to pick up patched Next/sharp transitive fixes.
test/next16/next.config.js	Disables Next’s AI-agent “agent-rules” file generation to keep the fixture reproducible under agent-driven runs.
test/snapshots/next16.test.ts.snap	Updates snapshot for upstream Next 16 response header/body changes.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/appmap-node@228 -D

commit: 0c36467

[appmap-releasebot]

🎉 This PR is included in version 2.26.2 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀