Repository navigation
R11DT-4222 Remove EOL node-domexception from the dependency tree - #208
Merged
Merged
Conversation
OS-thiagosiqueira
marked this pull request as ready for review
September 7, 2026 15:21
OS-thiagosiqueira
requested review from
OS-joaomurgeiro,
OS-josecunha,
OS-luisvendrame,
OS-miguelfreitas,
OS-rodrigolopes,
mvios and
osjlopes
and removed request for
a team
September 7, 2026 15:21
OS-rodrigolopes
approved these changes
Sep 8, 2026
rmb-guerra
approved these changes
Sep 8, 2026
OS-joaomurgeiro
approved these changes
Sep 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Jira Issue
R11DT-4222
The problem
Wiz flags
node-domexception@1.0.0against theb11branch as an End-of-Life Version of Library(Medium). It is not a CVE: the package was abandoned by its author and ships a deprecation notice.
On Node 20 the branch is skipped and it re-exports the native class — verified,
require('node-domexception') === globalThis.DOMExceptionistrue. We are carrying a dependency, anda security finding, for a polyfill that polyfills nothing.
Proposed solution
Remove the importer, not the import. Nothing in this repo references the polyfill —
src/,webpack/,config/,test/andflavors/are all clean — so the fix is entirely in the manifest.Upstream reached the same conclusion and did exactly this.
swagger-api/swagger-js@67e9e5b8a("chore: drop Support for Node.js EOL releases", 2026-04-30, shipped in3.38.0)deleted
src/helpers/fetch-polyfill.node.jsandsrc/helpers/fetch-ponyfill-node-fetch.node.js— the onlyimporters of
node-fetch-commonjs— on the grounds that Node>=18provides nativefetch/Blob/FormData/File.swagger-api/swagger-ui@be2e4b00dthen took the bump as aone-line
package.jsonchange with no source edits. Upstream'smainlockfile today has zerooccurrences of
node-domexception,node-fetchandfetch-blob.