Merge branch 'main' into dependabot/github_actions/github-actions-dee7dd5463

package.json

@@ -23,18 +23,18 @@
     "@esm2cjs/normalize-url": "^8.0.0",
     "@koa/bodyparser": "^5.1.2",
     "@mozilla/readability": "^0.6.0",
-    "@napi-rs/canvas": "^1.0.2",
+    "@napi-rs/canvas": "^1.0.6",
     "@types/turndown": "^5.0.6",
-    "@xmldom/xmldom": "^0.9.10",
+    "@xmldom/xmldom": "^0.9.11",
     "archiver": "^8.0.0",
-    "axios": "^1.18.1",
+    "axios": "^1.19.0",
     "bcrypt": "^6.0.0",
     "busboy": "^1.6.0",
-    "civkit": "^0.10.0-290dbd2",
+    "civkit": "^0.10.0-8468672",
     "cors": "^2.8.6",
     "dayjs": "^1.11.21",
     "htmlparser2": "^9.0.0",
-    "jose": "^6.2.3",
+    "jose": "^6.2.8",
     "koa": "^2.16.4",
     "koa-compress": "^5.2.2",
     "langdetect": "^0.2.1",
@@ -44,7 +44,7 @@
     "maxmind": "^4.3.29",
     "minio": "^8.0.7",
     "pdfjs-dist": "^4.10.38",
-    "puppeteer": "^23.3.0",
+    "puppeteer": "^25.7.0",
     "puppeteer-extra": "^3.3.6",
     "puppeteer-extra-plugin-block-resources": "^2.4.3",
     "robots-parser": "^3.0.1",
@@ -94,7 +94,7 @@
     },
     "civkit": {
       "minimatch": "^10.2.4",
-      "brace-expansion": "5.0.6"
+      "brace-expansion": "5.0.9"
     },
     "yargs": "^18.0.0"
   },

src/services/puppeteer.ts

@@ -12,9 +12,13 @@ import type {
   HTTPResponse,
   Page,
   Viewport,
-} from "puppeteer";
+} from "puppeteer" with { "resolution-mode": "import" };
 import type { Cookie } from "set-cookie-parser";
-import puppeteer, { TimeoutError } from "puppeteer";
+
+const { default: puppeteer, TimeoutError } =
+  require("puppeteer") as typeof import("puppeteer", {
+    with: { "resolution-mode": "import" },
+  });
 
 import { Defer, Deferred } from "civkit/defer";
 import { AssertionFailureError, ParamValidationError } from "civkit/civ-rpc";

src/services/serp/puppeteer.ts

@@ -9,9 +9,13 @@ import type {
   GoToOptions,
   Page,
   Viewport,
-} from "puppeteer";
+} from "puppeteer" with { "resolution-mode": "import" };
 import type { Cookie } from "set-cookie-parser";
-import puppeteer, { TimeoutError } from "puppeteer";
+
+const { default: puppeteer, TimeoutError } =
+  require("puppeteer") as typeof import("puppeteer", {
+    with: { "resolution-mode": "import" },
+  });
 
 import { Defer } from "civkit/defer";
 import { AssertionFailureError, ParamValidationError } from "civkit/civ-rpc";

tests/security-governance.test.cjs

@@ -79,18 +79,16 @@ test("security-sensitive dependency floors stay above blocked axios and basic-ft
   const axiosRange = packageJson.dependencies.axios.replace(/^[^\d]*/, "");
   const lockedAxiosVersion = packageLock.packages["node_modules/axios"].version;
   const lockedBasicFtpVersion =
-    packageLock.packages["node_modules/basic-ftp"].version;
+    packageLock.packages["node_modules/basic-ftp"]?.version;
 
   assert.ok(
     compareVersions(axiosRange, "1.15.0") >= 0,
     `Expected axios floor >= 1.15.0, received ${packageJson.dependencies.axios}`,
   );
-  assert.doesNotMatch(
+  assert.doesNotMatch(lockedAxiosVersion, /^1\.14\.0$/);
-    lockedAxiosVersion,
-    /^1\.14\.0$/,
-  );
   assert.ok(
-    compareVersions(lockedBasicFtpVersion, "5.2.2") >= 0,
+    !lockedBasicFtpVersion ||
+      compareVersions(lockedBasicFtpVersion, "5.2.2") >= 0,
     `Expected basic-ftp lock >= 5.2.2, received ${lockedBasicFtpVersion}`,
   );
 });