Skip to content

R11DT-4222 Remove EOL node-domexception from the dependency tree - #208

Merged
OS-thiagosiqueira merged 1 commit into
b11from
R11DT-4222-node-domexception-eol
Sep 9, 2026
Merged

OS-thiagosiqueira merged 1 commit into
b11from
R11DT-4222-node-domexception-eol

Conversation

@OS-thiagosiqueira

@OS-thiagosiqueira OS-thiagosiqueira commented Sep 7, 2026 •

Copy link
Copy Markdown

Jira Issue

R11DT-4222

The problem

Wiz flags node-domexception@1.0.0 against the b11 branch as an End-of-Life Version of Library
(Medium). It is not a CVE: the package was abandoned by its author and ships a deprecation notice.

On Node 20 the branch is skipped and it re-exports the native class — verified,
require('node-domexception') === globalThis.DOMException is true. We are carrying a dependency, and
a security finding, for a polyfill that polyfills nothing.

Proposed solution

Remove the importer, not the import. Nothing in this repo references the polyfill — src/,
webpack/, config/, test/ and flavors/ are all clean — so the fix is entirely in the manifest.

Upstream reached the same conclusion and did exactly this.
swagger-api/swagger-js@67e9e5b8a ("chore: drop Support for Node.js EOL releases", 2026-04-30, shipped in 3.38.0)
deleted src/helpers/fetch-polyfill.node.js and src/helpers/fetch-ponyfill-node-fetch.node.js — the only
importers of node-fetch-commonjs — on the grounds that Node >=18 provides native
fetch/Blob/FormData/File. swagger-api/swagger-ui@be2e4b00d then took the bump as a
one-line package.json change with no source edits. Upstream's main lockfile today has zero
occurrences of node-domexception, node-fetch and fetch-blob.

@OS-thiagosiqueira OS-thiagosiqueira self-assigned this Sep 7, 2026
@OS-thiagosiqueira OS-thiagosiqueira added bug enhancement dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code docker Pull requests that update Docker code github_actions Pull requests that update GitHub Actions code and removed bug enhancement labels Sep 7, 2026
@OS-thiagosiqueira
OS-thiagosiqueira marked this pull request as ready for review September 7, 2026 15:21
@OS-thiagosiqueira
OS-thiagosiqueira requested a review from a team as a code owner September 7, 2026 15:21
@OS-thiagosiqueira OS-thiagosiqueira changed the title chore: update swagger-client to version 3.38.0 and release-it to version 17.11.0 R11DT-4222 Remove EOL node-domexception from the dependency tree Sep 8, 2026
@OS-thiagosiqueira
OS-thiagosiqueira merged commit 1676a71 into b11 Sep 9, 2026
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file docker Pull requests that update Docker code github_actions Pull requests that update GitHub Actions code javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants