APIGOV-33776 Security Updates

.github/workflows/build.yml

@@ -7,12 +7,12 @@ jobs:
   Lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@v1
+      - uses: actions/setup-node@v4
         with:
-          node-version: '16.x'
+          node-version: "24.x"
       - name: Install dependencies
         run: yarn
       - name: Lint
@@ -25,13 +25,13 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        nodeVersion: [ '14.17.1', '16.14.0', '17.6.0' ]
-        os: [ macos-latest, ubuntu-latest, windows-latest ]
+        nodeVersion: ["22.x", "24.x", "26.x"]
+        os: [macos-latest, ubuntu-latest, windows-latest]
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@v1
+      - uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.nodeVersion }}
       - name: Install dependencies

.npmignore

@@ -1,7 +1,7 @@
 ._*
 .babelrc
 .DS_Store
-.eslintrc
+eslint.config.js
 .git*
 .nyc_output
 .travis.yml

CHANGELOG.md

@@ -1,3 +1,13 @@
+# v3.0.0 (Oct 9, 2026)
+
+ * BREAKING CHANGE: Require Node.js 22.16.0 or newer.
+ * BREAKING CHANGE: `XMLStore` now throws when adding a second root element; XML documents may only have one.
+ * chore: Security updates, including `@xmldom/xmldom` 0.8.15.
+ * chore: Updated dependencies: `fs-extra`, `import-fresh`, `joi`, and dev dependencies `c8`, `chai`,
+   `chai-as-promised`, `sinon`, and `sinon-chai`.
+ * chore: Migrated ESLint to v10 with a flat config (`eslint.config.js`).
+ * chore: Updated GitHub workflow actions and test against Node.js 22, 24, and 26.
+
 # v2.1.0 (May 20, 2022)
 
  * fix: Added missing `src` directory.

eslint.config.js

@@ -0,0 +1,82 @@
+import chaiExpect from 'eslint-plugin-chai-expect';
+import globals from 'globals';
+import js from '@eslint/js';
+import mocha from 'eslint-plugin-mocha';
+import promise from 'eslint-plugin-promise';
+import security from 'eslint-plugin-security';
+
+export default [
+	{
+		ignores: [ 'test/fixtures/**' ]
+	},
+	js.configs.recommended,
+	{
+		files: [ '**/*.js' ],
+		languageOptions: {
+			ecmaVersion: 2022,
+			sourceType: 'module',
+			globals: {
+				...globals.es2021,
+				...globals.node
+			}
+		},
+		plugins: {
+			'chai-expect': chaiExpect,
+			mocha,
+			promise,
+			security
+		},
+		rules: {
+			'array-bracket-spacing': [ 'warn', 'always' ],
+			'brace-style': [ 'error', '1tbs', { allowSingleLine: true } ],
+			camelcase: 'off',
+			'chai-expect/missing-assertion': 'error',
+			'chai-expect/terminating-properties': 'warn',
+			curly: [ 'error', 'all' ],
+			'eol-last': 'error',
+			indent: [ 'error', 'tab', { SwitchCase: 1 } ],
+			'keyword-spacing': [ 'error' ],
+			'linebreak-style': [ 'error', 'unix' ],
+			'max-len': [ 'error', 200 ],
+			'no-case-declarations': 'off',
+			'no-cond-assign': 'off',
+			'no-console': 'off',
+			'no-control-regex': 'off',
+			'no-empty': 'warn',
+			'no-inner-declarations': 'off',
+			'no-mixed-spaces-and-tabs': 'error',
+			'no-multi-str': 'error',
+			'no-multiple-empty-lines': 'error',
+			'no-trailing-spaces': 'error',
+			'no-unused-vars': 'off',
+			'no-useless-escape': 'warn',
+			'promise/always-return': 'error',
+			'promise/no-return-wrap': 'error',
+			'promise/param-names': 'error',
+			'promise/catch-or-return': 'error',
+			'promise/no-native': 'off',
+			'promise/no-nesting': 'warn',
+			'promise/no-promise-in-callback': 'warn',
+			'promise/no-callback-in-promise': 'warn',
+			'promise/avoid-new': 'off',
+			'promise/no-new-statics': 'error',
+			'promise/no-return-in-finally': 'warn',
+			'promise/valid-params': 'warn',
+			quotes: [ 'error', 'single' ],
+			semi: [ 'error', 'always' ],
+			'space-before-blocks': [ 'error', 'always' ],
+			'space-before-function-paren': [ 'error', { anonymous: 'always', named: 'ignore', asyncArrow: 'always' } ],
+			'space-in-parens': [ 'error', 'never' ],
+			'space-infix-ops': 'error',
+			'space-unary-ops': [ 'error', { nonwords: false, overrides: {} } ]
+		}
+	},
+	{
+		files: [ 'test/**/*.js' ],
+		languageOptions: {
+			globals: {
+				...globals.mocha
+			}
+		}
+	}
+];

package.json

@@ -16,36 +16,38 @@
   ],
   "scripts": {
     "coverage": "c8 npm run test",
-    "lint": "eslint --ignore-pattern test/fixtures src test",
+    "lint": "eslint src test",
     "prepublishOnly": "npm run lint",
     "test": "npm run lint && mocha test/**/test-*.js --reporter spec"
   },
   "dependencies": {
-    "@xmldom/xmldom": "^0.8.2",
+    "@xmldom/xmldom": "^0.8.15",
     "detect-indent": "^7.0.0",
-    "fs-extra": "^10.1.0",
-    "import-fresh": "^3.3.0",
-    "joi": "^17.6.0",
-    "snooplogg": "^5.0.0"
+    "fs-extra": "^11.4.1",
+    "import-fresh": "^4.0.1",
+    "joi": "^18.2.9",
+    "snooplogg": "5.1.0"
   },
   "devDependencies": {
-    "c8": "^7.11.3",
-    "chai": "^4.3.6",
-    "chai-as-promised": "^7.1.1",
-    "eslint": "^8.15.0",
-    "eslint-plugin-chai-expect": "^3.0.0",
-    "eslint-plugin-mocha": "^10.0.4",
-    "eslint-plugin-promise": "^6.0.0",
-    "eslint-plugin-security": "^1.5.0",
-    "mocha": "^10.0.0",
-    "sinon": "^14.0.0",
-    "sinon-chai": "^3.7.0",
+    "@eslint/js": "^10.0.1",
+    "c8": "^12.0.0",
+    "chai": "^6.3.0",
+    "chai-as-promised": "^8.0.2",
+    "eslint": "^10.12.0",
+    "eslint-plugin-chai-expect": "^4.1.1",
+    "eslint-plugin-mocha": "^12.0.2",
+    "eslint-plugin-promise": "^7.3.0",
+    "eslint-plugin-security": "^4.2.0",
+    "globals": "^17.13.0",
+    "mocha": "^12.0.0",
+    "sinon": "^22.1.0",
+    "sinon-chai": "^4.0.1",
     "tmp": "^0.2.1"
   },
   "homepage": "https://github.com/appcelerator/config-kit",
   "bugs": "https://github.com/appcelerator/config-kit/issues",
   "repository": "https://github.com/appcelerator/config-kit",
   "engines": {
-    "node": ">=14.15.0"
+    "node": ">=22.16.0"
   }
 }

src/config.js

@@ -129,13 +129,13 @@ export default class Config {
 			this.stores.add(store);
 		}
 
-		let { store } = opts;
+		const { store } = opts;
 		if (store) {
 			// if we have an explicit `store`, then register it's class
 			this.stores.add(store instanceof Store ? Object.getPrototypeOf(store).constructor : store);
 		} else if (opts.file) {
 			const StoreClass = this.stores.get(path.extname(opts.file));
-			store = new StoreClass();
+			this.stores.get(path.extname(opts.file));
 		}
 
 		this.layers = await new LayerList().init({

src/layer.js

@@ -317,7 +317,7 @@ export default class Layer {
 				try {
 					schema = await fs.readJson(schema);
 				} catch (e) {
-					throw new Error(`Failed to parse schema json file: ${e.message}`);
+					throw new Error(`Failed to parse schema json file: ${e.message}`, { cause: e });
 				}
 			} else if (ext === '.js') {
 				try {
@@ -326,7 +326,7 @@ export default class Layer {
 						schema = schema.default;
 					}
 				} catch (e) {
-					throw new Error(`Failed to parse schema js file: ${e.message}`);
+					throw new Error(`Failed to parse schema js file: ${e.message}`, { cause: e });
 				}
 
 				if (typeof schema === 'function') {

src/node.js

@@ -210,7 +210,6 @@ export default class Node {
 				let result = true;
 
 				if (Object.prototype.hasOwnProperty.call(target, prop)) {
-					// eslint-disable-next-line no-unused-expressions
 					target[prop]?.[Node.Meta]?.parents.delete(node);
 					result = delete target[prop];
 
@@ -256,7 +255,6 @@ export default class Node {
 							const { hash } = internal;
 							const arr = Array.prototype.splice.call(target, start, deleteCount, ...items);
 							for (const item of arr) {
-								// eslint-disable-next-line no-unused-expressions
 								item?.[Node.Meta]?.parents.delete(node);
 							}
 
@@ -280,7 +278,7 @@ export default class Node {
 					throw new Error('Cannot set object property to itself');
 				}
 
-				let hash = null;
+				let hash;
 				const desc = Object.getOwnPropertyDescriptor(target, prop);
 
 				if (value && typeof value === 'object' && !(value instanceof Date) && value !== process.env && value !== JSON && value !== Math) {

src/stores/xml/util.js

@@ -68,6 +68,10 @@ export function cast(value, type) {
  */
 export function createDOMNode(name, value, parent) {
 	const doc = (parent.ownerDocument || parent);
+	if (parent === doc && doc.documentElement) {
+		throw new Error(`Cannot add <${name}>: XML documents may only have one root element`);
+	}
+
 	const parentIndent = parent.previousSibling?.nodeType === dom.TEXT_NODE && parent.previousSibling.textContent.match(/[ \t]*$/)?.[0] || '';
 	let postText;
 

test/test-js-store.js

@@ -1,4 +1,5 @@
-import chai, { expect } from 'chai';
+import * as chai from 'chai';
+import { expect } from 'chai';
 import chaiAsPromised from 'chai-as-promised';
 import Config, { JSStore } from '../src/index.js';
 import path from 'path';

test/test-json-store.js

@@ -1,4 +1,4 @@
-import chai from 'chai';
+import * as chai from 'chai';
 import Config, { JSONStore } from '../src/index.js';
 import path from 'path';
 import sinon from 'sinon';
@@ -47,7 +47,7 @@ describe('JSONStore', () => {
 			const cfg = await new Config().init();
 			await expect(
 				cfg.load(path.join(__dirname, 'fixtures', 'json', 'empty.json'))
-			).to.eventually.be.rejectedWith(Error, 'Failed to load config file: Unexpected end of JSON input');
+			).to.eventually.be.rejectedWith(Error, /Failed to load config file: (Unexpected end of JSON input|Expected property name or '}' in JSON)/);
 		});
 
 		it('should error if file is a directory', async () => {
@@ -68,7 +68,7 @@ describe('JSONStore', () => {
 			const cfg = await new Config().init();
 			await expect(
 				cfg.load(path.join(__dirname, 'fixtures', 'json', 'bad-syntax.json'))
-			).to.eventually.be.rejectedWith(Error, 'Failed to load config file: Unexpected end of JSON input');
+			).to.eventually.be.rejectedWith(Error, /Failed to load config file: (Unexpected end of JSON input|Expected property name or '}' in JSON)/);
 		});
 
 		it('should error if config does\'t contain an object', async () => {

test/test-schema.js

@@ -134,7 +134,7 @@ describe('Schema', () => {
 			new Config().init({
 				schema
 			})
-		).to.eventually.be.rejectedWith(Error, `Failed to parse schema json file: ${schema}: Unexpected token { in JSON at position 1`);
+		).to.eventually.be.rejectedWith(Error, /Failed to parse schema json file: .*bad2\.json: (Unexpected token \{|Expected property name or '\}') in JSON at position 1/);
 	});
 
 	it('should load a schema .js file', async () => {