Skip to content

Fix compatibility with Code for IBM i 3.0.0, update packages and fix security vulnerabilities.#69

Merged
SanjulaGanepola merged 7 commits into
IBM:mainfrom
venky225:fix/deps
Jun 8, 2026
Merged

Fix compatibility with Code for IBM i 3.0.0, update packages and fix security vulnerabilities.#69
SanjulaGanepola merged 7 commits into
IBM:mainfrom
venky225:fix/deps

Conversation

@venky225

Copy link
Copy Markdown
Collaborator

Fix dependabot issues

#67

Couldn't update below packages:

  1. vitest -> Upgrading this package is breaking some changes and test cases are getting failed.

  2. serialize-javascript -> Updated the parent dependency Mocha, it still depends on serialize-javascript@^6.0.2 as mocha maintainers haven't updated their dependency yet."

@venky225 venky225 requested a review from julesyan May 19, 2026 18:46
Signed-off-by: venky225 <kona.venkatareddy@gmail.com>
@julesyan

julesyan commented Jun 2, 2026

Copy link
Copy Markdown
Member

@venky225 can you look into why vitest upgrade causes the tests to fail?

@venky225

venky225 commented Jun 4, 2026

Copy link
Copy Markdown
Collaborator Author

@julesyan
Test cases are failing with following reason.
Vitest cannot be imported in a CommonJS module using require()" because vitest scans and attempts to run compiled test files in dist/vitest/*.test.js (CommonJS format), in addition to the source TypeScript files.

Root Cause:

  1. TypeScript is configured to compile to CommonJS ("module": "commonjs" in vscodeclle\language\tsconfig.jsontsconfig.json)
  2. Test files in vitest/ get compiled to CommonJS in dist/vitest/
  3. Vitest attempts to load both the .ts source files AND the .js compiled files

There are couple of solutions which I tried and they are working fine.

  1. Created vitest.config.ts that explicitly tells vitest to run only .ts files.
    include: ['vitest/**/*.test.ts']
  2. Changing the module to esnext ( "module": "esnext",) from commonjs in tsconfig.json (Test cases will run twice here. 1 for Source and 1 for compiled)

@julesyan

julesyan commented Jun 4, 2026

Copy link
Copy Markdown
Member

Please use the first solution as that is consistent with the vscode-ibmi repository

Signed-off-by: venky225 <kona.venkatareddy@gmail.com>
@venky225

venky225 commented Jun 5, 2026

Copy link
Copy Markdown
Collaborator Author

Please use the first solution as that is consistent with the vscode-ibmi repository

@julesyan
Updated the vitest. Now we are left with 3 vulnerabilities which are occurring from mocha. We need to wait for mocha to update their dependencies.

Are we using mocha in the project. I don't see it being used anywhere. Can we uninstall mocha.?

@julesyan

julesyan commented Jun 5, 2026

Copy link
Copy Markdown
Member

Yes we can remove mocha from the dependancies

Signed-off-by: venky225 <kona.venkatareddy@gmail.com>
@venky225

venky225 commented Jun 5, 2026

Copy link
Copy Markdown
Collaborator Author

Yes we can remove mocha from the dependancies

Done. All vulnerabilities have been resolved. Please verify.

@SanjulaGanepola SanjulaGanepola self-requested a review June 8, 2026 14:58
Signed-off-by: Sanjula Ganepola <Sanjula.Ganepola@ibm.com>
Signed-off-by: Sanjula Ganepola <Sanjula.Ganepola@ibm.com>
Signed-off-by: Sanjula Ganepola <Sanjula.Ganepola@ibm.com>
Signed-off-by: Sanjula Ganepola <Sanjula.Ganepola@ibm.com>
@SanjulaGanepola SanjulaGanepola marked this pull request as ready for review June 8, 2026 20:23
@SanjulaGanepola SanjulaGanepola changed the title Updating package dependencies and fixing security vulnerabilities. Fix compatibility with Code for IBM i 3.0.0, update packages and fix security vulnerabilities. Jun 8, 2026
@SanjulaGanepola

Copy link
Copy Markdown
Member

@venky225 I went ahead and pushed some additional changes to make the extension compatible with Code4i 3.0.0. Also, I bumped a few more packages.

@SanjulaGanepola SanjulaGanepola merged commit 69446c6 into IBM:main Jun 8, 2026
3 checks passed
@SanjulaGanepola SanjulaGanepola linked an issue Jun 8, 2026 that may be closed by this pull request
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

resolve dependabot issues

3 participants