[mtrezza]

Closes #937

Security update of a development-only dependency. It fixes Dependabot alert #432, GHSA-p498-v437-472g (medium): "humanfs: Recursive copy follows symlinked files and copies data from outside the source tree" (vulnerable < 0.16.8, patched in 0.16.8).

@humanfs/node is a transitive dependency of eslint 10.7.0, which requires ^0.16.6, so only package-lock.json changes. npm ls @humanfs/node --omit=dev is empty, so the package is not part of the production dependency tree; hence the refactor: prefix.

Changes

@humanfs/node:

• 0.16.7: Added directory to package.json (f691b60).
• 0.16.7 (found only in the commits, not in the release notes or changelog; chore(deps): Upgrading retry dependency in node package. humanwhocodes/humanfs#140, 7b81d9a): The @humanwhocodes/retry dependency moved from ^0.3.0 to ^0.4.0. This only affects bytes() (which text() and json() use), write() and append(), the only methods that go through the retrier. With retry 0.3.x, these calls started immediately. With 0.4.x, every call to them enters the retrier's queue, at most 1000 run at the same time per NodeHfs instance (a call that is waiting for a retry still counts), and further calls wait until one finishes. As before, a call is only retried when readFile, writeFile or appendFile fails with ENFILE or EMFILE.
• 0.16.8: copy() and copyAll() now copy symlinks as symlinks (22bbaa4). This is the fix for GHSA-p498-v437-472g. Before, a symlink to a file was copied as a regular file with the content of the file it points to, even when that file was outside the source tree. A symlink to a directory was passed to fs.copyFile(), which does not copy directories, so the copy most likely failed rather than copying the directory's content.
• 0.16.8: Type dependencies are included at runtime: @humanfs/types moved from devDependencies to dependencies (956ce7a, closes Bug: HfsWalkEntry type missing since @humanfs/types is a devDependency humanwhocodes/humanfs#145).
• 0.16.8: @humanfs/core bumped from ^0.19.1 to ^0.19.2.

Dependencies that move with it (all are @humanfs/node's own dependencies):

• @humanfs/core 0.19.1 → 0.19.2: 0.19.2: Include type dependencies at runtime (956ce7a, closes Bug: HfsWalkEntry type missing since @humanfs/types is a devDependency humanwhocodes/humanfs#145). The published package only changes its package.json.
• @humanfs/types 0.15.0 added. It only contains type definitions.
• @humanwhocodes/retry: the nested 0.3.1 copy under @humanfs/node is removed, and @humanfs/node now uses the top-level 0.4.2 that eslint already uses. Changes between them:
  • 0.4.0: Implement concurrency (feat: Implement concurrency humanwhocodes/retry#38)
  • 0.4.1: Look for a specific DEBUG value before outputting debug messages (fix: Look for specific DEBUG value before outputting debug messages humanwhocodes/retry#40)
  • 0.4.2: Handle rejections from temporary promises (fix: handle rejections from temporary promises humanwhocodes/retry#44)

ESLint 10.7.0 only calls hfs.isDirectory() and hfs.walk() from @humanfs/node (in lib/eslint/eslint-helpers.js). Neither of them changed in these versions, and neither ever goes through the retrier. ESLint does not call copy() or copyAll() either, so neither the retry change nor the symlink fix affects linting.

The lock file was generated on the current master with npm 10.9.3. Unlike the lock in #937, it leaves the optional peer dependencies socks, smart-buffer and gcp-metadata (with its nested gaxios and node-fetch) untouched.

Breaking Changes

None

Code Changes Required

None — the upgrade is a drop-in replacement.

Summary by CodeRabbit

• Chores
  • Applied routine project maintenance updates. There are no changes to user-facing features, workflows, or application behavior in this release. Users do not need to take any action, and the existing experience remains unchanged. No new functionality or user-facing fixes are included. These updates are limited to behind-the-scenes project maintenance and do not affect how the product is used.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: fb4c5582-ccef-48de-8922-b02977f06956

Commits

Reviewing files that changed from the base of the PR and between 915af88 and bf92ea8.

Files selected for processing: 1

• package-lock.json

Included review availability: This review used your included allowance. Your plan provides up to 5 included reviews per hour; 3 remain after this review.

Walkthrough

The lockfile updates @humanfs/core to 0.19.2 and @humanfs/node to 0.16.8. It adds @humanfs/types 0.15.0 and changes the locked retry dependency range to ^0.4.0.

Changes: @humanfs dependency update

Layer / File(s)	Summary
Update @humanfs dependency records package-lock.json	The lockfile records the updated core and node versions, adds @humanfs/types, and updates the node package’s @humanwhocodes/retry range from ^0.3.0 to ^0.4.0. It removes the nested retry 0.3.1 entry.

Priority: Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Severity of issue fixed: Low

Merge Risk: Minimal · up to bf92e

This development-only dependency update presents no identified merge-blocking risk.

Pre-merge checks: 7

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title begins with the allowed prefix "refactor:" and uses a capitalized first letter after the prefix. It accurately describes the dependency update in the pull request.
Linked Issues check		Issue [#937] requires @humanfs/node to move from 0.16.6 to 0.16.8. The whole-PR diff changes both lockfile records for @humanfs/node to 0.16.8 and updates its integrity, resolved URL, and dependency r…
Out of Scope Changes check		The PR changes only package-lock.json. The changes update @humanfs/node, its required @humanfs/core and @humanfs/types entries, and the retry dependency layout. These are direct lockfile effects of th…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Security Check		PASS: The pull request changes only package-lock.json. It upgrades @humanfs/node from 0.16.6 to 0.16.8, which addresses the reported symlink-copy advisory, and upgrades its related packages with npm i…
Engage In Review Feedback		No review feedback required engagement. The supplied review data reports no CodeRabbit review threads and zero actionable findings in the current review.

Full details: Linked Issues check

Explanation

Issue [#937] requires @humanfs/node to move from 0.16.6 to 0.16.8. The whole-PR diff changes both lockfile records for @humanfs/node to 0.16.8 and updates its integrity, resolved URL, and dependency ranges. The lockfile also adds the required @humanfs/types entry and updates @humanfs/core to 0.19.2. package.json shows eslint as a devDependency, and all changed humanfs lock entries are marked dev-only. No additional coding or test requirement appears in the active issue.

Full details: Out of Scope Changes check

Explanation

The PR changes only package-lock.json. The changes update @humanfs/node, its required @humanfs/core and @humanfs/types entries, and the retry dependency layout. These are direct lockfile effects of the dependency upgrade in [#937]. The closed issue [#145] provides historical context only, and the related type dependency entry does not create unrelated scope.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Full details: Security Check

Explanation

PASS: The pull request changes only package-lock.json. It upgrades @humanfs/node from 0.16.6 to 0.16.8, which addresses the reported symlink-copy advisory, and upgrades its related packages with npm integrity hashes. The affected packages remain marked dev-only, and no application code or production dependency changes introduce a security vulnerability.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}