[OpenNMS/opennms] 8acf0e: NMS-20181: Dependency updates for core/web-assets, ...

  Branch: refs/heads/release-36.x
  Home:   https://github.com/OpenNMS/opennms
  Commit: 8acf0e58faf3200530bb4fa7d32264da0d8b283a
      https://github.com/OpenNMS/opennms/commit/8acf0e58faf3200530bb4fa7d32264da0d8b283a
  Author: Scott Theleman <[email protected]>
  Date:   2026-08-10 (Mon, 10 Aug 2026)

  Changed paths:
    M core/web-assets/.node-version
    M core/web-assets/package.json
    M core/web-assets/pnpm-lock.yaml
    M core/web-assets/src/main/assets/js/vendor/ipaddress-js.js
    M core/web-assets/src/test/javascript/ipaddress.test.js

  Log Message:
  -----------
  NMS-20181: Dependency updates for core/web-assets, August 2026 (#8767)

* Dependency updates for core/web-assets, August 2026

* NMS-20181: Revert TypeScript to ~5.9.3

TypeScript 6.0 buys nothing here: no script runs tsc (webpack transpiles
via babel), and @typescript-eslint 7.18.0 on this branch supports
<5.6.0 — a compiler major on release-36.x is risk without payoff. The
TS 6 bump belongs on develop together with @typescript-eslint 8.x.

169 jest tests pass after the revert.

* NMS-20181: Fix checkIpRange for IPv6; pin new leading-zero validation

checkIpRange's IPv6 branch called compareTo() on a native BigInt (jsbn
was dropped in ip-address 9), throwing TypeError and silently bypassing
the range validation in add-er.jsp/add-ir.jsp for IPv6. Compare with >=
like the IPv4 branch. Predates this PR.

Also pin ip-address 10.5.0's new rejection of leading-zero IPv4 octets
(ambiguous: octal to C parsers, decimal to Java) with explicit tests,
and cover inverted and mixed-family ranges.

* NMS-20181: Update .node-version to 22.22.2

Was 16.15.1 while engines requires >=22, tar@7 requires >=18, and the
Maven build pins v22.22.2 — aligns local nvm/fnm users with CI.

* NMS-20181: Remove dead phantomjs-prebuilt devDependency

Nothing uses it: tests are jest + jsdom, there is no karma, and no
reference exists in src/, pom.xml, or webpack.config.js. Removing it
drops [email protected] and its whole subtree (uuid@3, form-data@2,
har-validator, http-signature, sshpk, hoek, stringstream, ...) — 71
lockfile entries — and retires the unfixable 'request' CVE row.

Also prune the ten overrides that subtree was the last consumer of
(atob, cryptiles, deep-extend, form-data@>=2<3, fstream, growl, hoek,
sshpk, stringstream, uuid@<4). Verified the lockfile diff is pure
removal — no remaining package changed resolution. This also moots the
review finding that the uuid@<4 -> ^11.1.1 override left request
un-loadable (require('uuid/v4') hit ERR_PACKAGE_PATH_NOT_EXPORTED).

Build passes; 174 jest tests pass.

* NMS-20181: Override @tootallnate/once to 2.0.1

GHSA-vpq2-c234-7xj6 (CVSS 3.3, via jsdom's http-proxy-agent chain);
advisory postdates the original scan. Patch-level fix. 174 tests pass.



To unsubscribe from these emails, change your notification settings at https://github.com/OpenNMS/opennms/settings/notifications


_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/wiki/index.php?page=MailingListFaq
opennms-cvs mailing list

To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-cvs