chore: update vulnerable dependencies

[jescalada]

Description

Attempts to reduce the number of "vulnerabilities" detected by OSSF Scorecard in our experimental packages and CLI:

nyc required a major bump, everything else was a minor/patch bump. vitest was manually bumped to 3.2.7, will figure out how to fix properly in the v4 upgrade PR. None of these appear to have broken our tests.

Checklist

General

• I have read the CONTRIBUTING.md guidelines
• Commit messages follow Conventional Commits format
• I have a FINOS CLA on file

Tests

• Tests have been added/updated for new functionality
• Unit tests pass (npm test)
• Linting and formatting pass (npm run lint and npm run format:check)
• Type checks pass (npm run check-types)

[netlify]

✅ Deploy Preview for endearing-brigadeiros-63f9d0 ready!

Name	Link
🔨 Latest commit	d49f927
🔍 Latest deploy log	https://app.netlify.com/projects/endearing-brigadeiros-63f9d0/deploys/6a5f0c0b8fb304000887e1fa
😎 Deploy Preview	https://deploy-preview-1652.git-proxy.preview.finos.org
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 7 package(s) with unknown licenses.
• ⚠️ 11 packages with OpenSSF Scorecard issues.

View full job summary

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.10%. Comparing base (19b7bbd) to head (d49f927).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1652   +/-   ##
=======================================
  Coverage   86.10%   86.10%           
=======================================
  Files          87       87           
  Lines        8621     8621           
  Branches     1492     1492           
=======================================
  Hits         7423     7423           
  Misses       1168     1168           
  Partials       30       30           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[jescalada]

@finos/git-proxy-maintainers Ready for review!

[kriswest]

LGTM - although are you breaking the CLI by removing yargs and axios? If not please clarify in the desciption, if so, is it possible not to?

[jescalada]

@kriswest I figured that the dependencies were okay to remove since we aren't publishing @finos/git-proxy-cli to NPM (so it's just inheriting the yargs and axios from the parent). Right now, we update those two dependencies on both package.jsons each time.

I also figured that since the tests were passing, there aren't any issues as the deps are resolving to the @finos/git-proxy versions.

Should we keep them around for good dependency hygiene?

[jescalada]

I looked at this in more detail: it turns out the CLI was never actually published; up until 2.0.0-rc.5 it was included in the source on NPM so the dependencies weren't needed.

Since rc.6, and our current 2.0.0 there is no way for users to reach the CLI package other than from the source code. I'll add back those two deps since it does matter after publishing a separate package, and make a separate PR for publishing the CLI.

Tracking this in #1653.

[jescalada]

Made #1654 to solve the CLI publish issue - will add the missing dependencies back in that PR so we can merge this one ASAP 👍🏼

[jescalada]

Looks like this bumped our scorecard to 9.6 - though a few new vulnerabilities popped up overnight...

https://api.securityscorecards.dev/projects/github.com/finos/git-proxy