[OpenNMS/opennms] 5e73f2: NMS-20181: Revert TypeScript to ~5.9.3

  Branch: refs/heads/jira/NMS-20181-dependabot-core-web-assets-august-2026
  Home:   https://github.com/OpenNMS/opennms
  Commit: 5e73f2029767ccccff7874d238ff5ba219b36eb6
      https://github.com/OpenNMS/opennms/commit/5e73f2029767ccccff7874d238ff5ba219b36eb6
  Author: Scott Theleman <[email protected]>
  Date:   2026-08-10 (Mon, 10 Aug 2026)

  Changed paths:
    M core/web-assets/package.json
    M core/web-assets/pnpm-lock.yaml

  Log Message:
  -----------
  NMS-20181: Revert TypeScript to ~5.9.3

TypeScript 6.0 buys nothing here: no script runs tsc (webpack transpiles
via babel), and @typescript-eslint 7.18.0 on this branch supports
<5.6.0 — a compiler major on release-36.x is risk without payoff. The
TS 6 bump belongs on develop together with @typescript-eslint 8.x.

169 jest tests pass after the revert.


  Commit: afa4b3bfe25bad4a22e12a89c7cc9baa4e2bfa20
      https://github.com/OpenNMS/opennms/commit/afa4b3bfe25bad4a22e12a89c7cc9baa4e2bfa20
  Author: Scott Theleman <[email protected]>
  Date:   2026-08-10 (Mon, 10 Aug 2026)

  Changed paths:
    M core/web-assets/src/main/assets/js/vendor/ipaddress-js.js
    M core/web-assets/src/test/javascript/ipaddress.test.js

  Log Message:
  -----------
  NMS-20181: Fix checkIpRange for IPv6; pin new leading-zero validation

checkIpRange's IPv6 branch called compareTo() on a native BigInt (jsbn
was dropped in ip-address 9), throwing TypeError and silently bypassing
the range validation in add-er.jsp/add-ir.jsp for IPv6. Compare with >=
like the IPv4 branch. Predates this PR.

Also pin ip-address 10.5.0's new rejection of leading-zero IPv4 octets
(ambiguous: octal to C parsers, decimal to Java) with explicit tests,
and cover inverted and mixed-family ranges.


  Commit: a8ce6db6b393ade095301bf7ff5ac300cad73a32
      https://github.com/OpenNMS/opennms/commit/a8ce6db6b393ade095301bf7ff5ac300cad73a32
  Author: Scott Theleman <[email protected]>
  Date:   2026-08-10 (Mon, 10 Aug 2026)

  Changed paths:
    M core/web-assets/.node-version

  Log Message:
  -----------
  NMS-20181: Update .node-version to 22.22.2

Was 16.15.1 while engines requires >=22, tar@7 requires >=18, and the
Maven build pins v22.22.2 — aligns local nvm/fnm users with CI.


  Commit: 33ca7dccd71abdc6ba45bc934bf145d260419968
      https://github.com/OpenNMS/opennms/commit/33ca7dccd71abdc6ba45bc934bf145d260419968
  Author: Scott Theleman <[email protected]>
  Date:   2026-08-10 (Mon, 10 Aug 2026)

  Changed paths:
    M core/web-assets/package.json
    M core/web-assets/pnpm-lock.yaml

  Log Message:
  -----------
  NMS-20181: Remove dead phantomjs-prebuilt devDependency

Nothing uses it: tests are jest + jsdom, there is no karma, and no
reference exists in src/, pom.xml, or webpack.config.js. Removing it
drops [email protected] and its whole subtree (uuid@3, form-data@2,
har-validator, http-signature, sshpk, hoek, stringstream, ...) — 71
lockfile entries — and retires the unfixable 'request' CVE row.

Also prune the ten overrides that subtree was the last consumer of
(atob, cryptiles, deep-extend, form-data@>=2<3, fstream, growl, hoek,
sshpk, stringstream, uuid@<4). Verified the lockfile diff is pure
removal — no remaining package changed resolution. This also moots the
review finding that the uuid@<4 -> ^11.1.1 override left request
un-loadable (require('uuid/v4') hit ERR_PACKAGE_PATH_NOT_EXPORTED).

Build passes; 174 jest tests pass.


Compare: https://github.com/OpenNMS/opennms/compare/aeeda4f5ee98...33ca7dccd71a

To unsubscribe from these emails, change your notification settings at https://github.com/OpenNMS/opennms/settings/notifications


_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/wiki/index.php?page=MailingListFaq
opennms-cvs mailing list

To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-cvs