APIGOV-30670 Security Updates

.github/workflows/build.yml

@@ -7,34 +7,76 @@ jobs:
   Lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
-          node-version: '16.x'
+          node-version: "20.x"
       - name: Install dependencies
         run: yarn
       - name: Lint
         run: yarn run lint
 
-  Test:
+  MacOsTest:
     needs: Lint
     name: ${{ matrix.os }} ${{ matrix.nodeVersion }} Tests
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
-        nodeVersion: [ '14.19.3', '16.15.1', '18.4.0' ]
-        os: [ macos-latest, ubuntu-latest, windows-latest ]
+        nodeVersion: ["20.19.2", "22.16.0"]
+        os: [macos-latest]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.nodeVersion }}
       - name: Install dependencies
         run: yarn
       - name: Run tests
         run: yarn run test
+  WindowsTest:
+    needs: Lint
+    name: ${{ matrix.os }} ${{ matrix.nodeVersion }} Tests
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        nodeVersion: ["20.19.2", "22.16.0"]
+        os: [windows-latest]
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v2
+        with:
+          node-version: ${{ matrix.nodeVersion }}
+      - name: Install dependencies
+        run: yarn
+      - name: Run tests
+        run: yarn run test
+  UbuntuTest:
+    needs: Lint
+    name: ${{ matrix.os }} ${{ matrix.nodeVersion }} Tests
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        nodeVersion: ["20.19.2", "22.16.0"]
+        os: [ubuntu-latest]
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.nodeVersion }}
+      - name: Install libsecret
+        run: sudo apt-get install -y libsecret-1-0
+      - name: Install dependencies
+        run: yarn
+      - name: Run tests
+        run: yarn run test

CHANGELOG.md

@@ -1,57 +1,62 @@
+# v4.0.0 (June 18, 2025)
+
+- BREAKING CHANGE: Require Node.js 20.18.2 LTS or newer.
+- chore: Updated dependencies.
+
 # v3.0.1 (July 7, 2022)
 
- * fix: Added missing `src` directory. Doh!
+- fix: Added missing `src` directory. Doh!
 
 # v3.0.0 (July 7, 2022)
 
- * BREAKING CHANGE: Require Node.js 14.15.0 LTS or newer.
- * BREAKING CHANGE: Changed package to a ES module.
- * chore: Updated dependencies.
+- BREAKING CHANGE: Require Node.js 14.15.0 LTS or newer.
+- BREAKING CHANGE: Changed package to a ES module.
+- chore: Updated dependencies.
 
 # v2.0.0 (Feb 15, 2022)
 
- * BREAKING CHANGE: Require Node.js 12.13.0 LTS or newer.
- * fix: Fixed handling of 404 requests when getting latest version.
- * chore: Updated dependencies.
+- BREAKING CHANGE: Require Node.js 12.13.0 LTS or newer.
+- fix: Fixed handling of 404 requests when getting latest version.
+- chore: Updated dependencies.
 
 # v1.2.1 (Jun 8, 2021)
 
- * fix: Writing a file with a mode was applying the mode to the file and newly created directories.
- * fix: Default new directories to mode 777.
+- fix: Writing a file with a mode was applying the mode to the file and newly created directories.
+- fix: Default new directories to mode 777.
 
 # v1.2.0 (Jun 7, 2021)
 
- * feat: Added `applyOwner` flag with default of `true` which sets the owner of the metadata file
-   to the owner of closest existing parent directory to protect against commands run as sudo.
- * chore: Updated dependencies.
+- feat: Added `applyOwner` flag with default of `true` which sets the owner of the metadata file
+  to the owner of closest existing parent directory to protect against commands run as sudo.
+- chore: Updated dependencies.
 
 # v1.1.2 (Jan 25, 2021)
 
- * fix: Always recalculate the update available flag and write the results to disk in order to
-   prevent a stale update available flag. ([CLI-106](https://jira.axway.com/browse/CLI-106))
- * chore: Updated dependencies.
+- fix: Always recalculate the update available flag and write the results to disk in order to
+  prevent a stale update available flag. ([CLI-106](https://jira.axway.com/browse/CLI-106))
+- chore: Updated dependencies.
 
 # v1.1.1 (Jan 5, 2021)
 
- * chore: Updated dependencies.
+- chore: Updated dependencies.
 
 # v1.1.0 (Dec 1, 2020)
 
- * fix: Bumped minimum Node.js requirement to 10.19.0 to prevent warnings on install.
- * chore: Updated dependencies.
+- fix: Bumped minimum Node.js requirement to 10.19.0 to prevent warnings on install.
+- chore: Updated dependencies.
 
 # v1.0.2 (Nov 30, 2020)
 
- * chore: Updated dependencies.
+- chore: Updated dependencies.
 
 # v1.0.1 (Nov 9, 2020)
 
- * fix: Fixed typo that caused npm to be checked every time.
+- fix: Fixed typo that caused npm to be checked every time.
 
 # v1.0.0 (Nov 9, 2020)
 
- * Initial release with support for:
-   - Fetching the latest version for a specific dist tag
-   - Fetches latest version from npm every so often
-   - Persist the update metadata
-   - HTTP proxy support
+- Initial release with support for:
+  - Fetching the latest version for a specific dist tag
+  - Fetches latest version from npm every so often
+  - Persist the update metadata
+  - HTTP proxy support

Jenkinsfile

@@ -2,5 +2,5 @@
 library 'pipeline-library'
 
 runNPMPackage {
-  nodeVersions = [ '14.19.3', '16.15.1', '18.4.0' ]
+  nodeVersions = [ '20.19.2', '22.16.0' ]
 }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "check-kit",
-  "version": "3.0.1",
+  "version": "4.0.0",
   "description": "Checks if a newer version is available for command line interfaces",
   "type": "module",
   "exports": "./src/index.js",
@@ -28,7 +28,7 @@
     "test": "npm run lint && mocha test/**/test-*.js --reporter spec"
   },
   "dependencies": {
-    "@axway/amplify-request": "^3.0.10",
+    "@axway/amplify-request": "^4.0.2",
     "ci-info": "^3.3.2",
     "fs-extra": "^10.1.0",
     "registry-auth-token": "5.0.1",
@@ -55,6 +55,6 @@
     "url": "git://github.com/appcelerator/check-kit.git"
   },
   "engines": {
-    "node": ">=14.15.0"
+    "node": ">=20.18.2"
   }
 }

test/test-check-kit.js

@@ -103,7 +103,7 @@ describe('check-kit', function () {
 		it('should error if package.json is malformed', async () => {
 			await expect(check({
 				pkg: path.resolve(__dirname, 'fixtures/malformed/package.json')
-			})).to.eventually.be.rejectedWith(Error, 'Failed to parse package.json: Unexpected token { in JSON at position 1');
+			})).to.eventually.be.rejectedWith(Error, 'Failed to parse package.json: Expected property name or \'}\' in JSON at position 1');
 		});
 
 		it('should error if pkg is not an object', async () => {
@@ -342,7 +342,7 @@ describe('check-kit', function () {
 					version: '1.2.3'
 				},
 				registryUrl: 'http://127.0.0.1:1337'
-			})).to.eventually.be.rejectedWith(Error, /^Unexpected token { in JSON at position/);
+			})).to.eventually.be.rejectedWith(Error, /^Expected property name or '}' in JSON at position 1/);
 		});
 
 		it('should error if registry returned non-object JSON response', async () => {