From 7e95d1544378d55bc44a3d9b5391d4972d38d673 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Tr=C3=A9panier?= Date: Tue, 23 Jun 2026 16:29:23 -0400 Subject: [PATCH 1/3] Update shell-quote to 1.8.4 to resolve CVE-2026-9277. --- yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yarn.lock b/yarn.lock index 85e8a28..6626dc0 100644 --- a/yarn.lock +++ b/yarn.lock @@ -7592,9 +7592,9 @@ __metadata: linkType: hard "shell-quote@npm:^1.6.1": - version: 1.8.1 - resolution: "shell-quote@npm:1.8.1" - checksum: 10c0/8cec6fd827bad74d0a49347057d40dfea1e01f12a6123bf82c4649f3ef152fc2bc6d6176e6376bffcd205d9d0ccb4f1f9acae889384d20baff92186f01ea455a + version: 1.8.4 + resolution: "shell-quote@npm:1.8.4" + checksum: 10c0/86c93678bc394cb81f5ddcdc87df9c95d279ef9652775cd1cd1eed361404169a8d8cbaacaeed232ab09919e36ee1e5363863570390d78571f8c22b7f6312fb40 languageName: node linkType: hard From 46deb9ca45a4ea58e0b7f3ab2be0c22029579046 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Tr=C3=A9panier?= Date: Thu, 25 Jun 2026 09:45:35 -0400 Subject: [PATCH 2/3] Pin CI to Node 22 for jest compatibility. GitHub Actions lts/* now resolves to Node 24, where jest-resolve fails under Yarn PnP because require.resolve.paths is unavailable in the ESM loader path. --- .github/workflows/test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 124c92b..c9d1fe3 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -21,7 +21,7 @@ jobs: comment-summary-in-pr: on-failure - uses: actions/setup-node@v4 with: - node-version: lts/* + node-version: 22 cache: yarn - run: yarn - run: yarn test From 4a85a8c02a6cebff0e9641351c3367403dd5941a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Tr=C3=A9panier?= Date: Thu, 25 Jun 2026 15:40:35 -0400 Subject: [PATCH 3/3] Use node-modules linker so jest works on Node 24 (lts/*) Node 24.15+ broke require.resolve.paths on the require synthesized for CJS files loaded via the Yarn PnP zip loader, crashing jest-resolve at load time. Switching to nodeLinker: node-modules avoids the PnP loader entirely, so CI can stay on node-version: lts/*. Reverts the Node 22 pin. --- .github/workflows/test.yml | 2 +- .yarnrc.yml | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index c9d1fe3..124c92b 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -21,7 +21,7 @@ jobs: comment-summary-in-pr: on-failure - uses: actions/setup-node@v4 with: - node-version: 22 + node-version: lts/* cache: yarn - run: yarn - run: yarn test diff --git a/.yarnrc.yml b/.yarnrc.yml index 3c87053..653bb0b 100644 --- a/.yarnrc.yml +++ b/.yarnrc.yml @@ -1,3 +1,5 @@ +nodeLinker: node-modules + packageExtensions: debug@^4: dependencies: