fix: consolidate Dependabot upgrades and in-range security fixes

[jonaslagoni]

Consolidates four open Dependabot PRs plus the in-range security fixes that npm audit surfaced but Dependabot did not open PRs for.

Note

Dependabot alerts are disabled on this repository. gh api repos/the-codegen-project/cli/dependabot/alerts returns 403, and security_and_analysis.dependabot_security_updates.status is disabled. The security analysis behind this PR came from npm audit instead, so findings are identified by GHSA rather than alert number. Worth enabling alerts.

Dependabot PRs consolidated

PR	Package	From	To
#445	@oclif/plugin-autocomplete	3.2.45	3.2.54
#444	yaml	2.8.0	2.9.0
#441	@oclif/plugin-version	2.1.2	2.2.53
#442	ts-jest	29.4.1	removed — see below

Two PR titles were stale: #441 proposed 2.2.52 (2.2.53 is current) and #443 proposed 15.5.0 (15.5.1 is current).

Additional security fixes

All within the existing semver ranges, so these are manifest-tightening plus lockfile refreshes:

Package	From	To	Severity	Advisory
simple-git (dev)	3.24.0	3.36.0	critical	RCE via blockUnsafeOperationsPlugin bypass — GHSA-r275-fr43-pm7q, plus two high
@asyncapi/protobuf-schema-parser	3.5.1	3.8.2	critical	Parent bump; protobufjs now 8.7.1, clearing GHSA-xq3m-2v4x-88gg
@asyncapi/parser	3.6.0	3.6.1	—
minimatch	9.0.5	9.0.9	high	Three ReDoS advisories
uuid	11.1.0	11.1.1	moderate	Missing buffer bounds check

simple-git was twelve minors behind its range, which is how a critical sat unfixed without a Dependabot PR.

Why ts-jest was removed rather than bumped

ts-jest was unused at the repo root — jest.config.js declares '^.+\\.(t|j)sx?$': '@swc/jest' as its sole transform, and the only other reference is the out-of-scope runtime fixture. PR #442's value was entirely indirect: 29.4.12 requires handlebars ^4.7.9, clearing seven advisories including two criticals. Removing the dependency achieves that same outcome and drops the whole handlebars subtree.

One thing this surfaced: jest itself was never declared in package.json. It was only present as ts-jest's auto-installed peer dependency, so removing ts-jest silently took the test runner with it and broke both npm test and eslint-plugin-jest. jest is now an explicit devDependency, pinned to ^29.7.0 — the exact version already resolved in the lockfile, so nothing about the test run changes. Jest 30 was left alone as an unanalysed major (@types/jest is still ^29).

Not included: #443, @apidevtools/json-schema-ref-parser 14 → 15

Recommend closing #443. Its CI is red on every job, and the cause is structural rather than incidental:

1. v15 is ESM-only — "type": "module", no exports map, no CJS build. This package compiles to CommonJS (module: Node16, no "type": "module"), so the static import at src/codegen/inputs/openapi/parser.ts:2 fails with error TS1479. The fix is a dynamic await import(), which the same file already does at line 76.
2. A dynamic import alone is not enough. @readme/openapi-parser@5.0.1 pins ref-parser ^14.1.1, so moving the root to 15.x forks the tree and leaves the two dereference paths inside the same function running different majors. Deduping requires @readme/openapi-parser 6.3.1 — a second user-visible major.
3. v15 changes dereferenced output. Strict RFC 6901 pointer encoding (v14 over-escaped segments) and a new mergeKeys option defaulting to true, which deep-merges keys sitting alongside a $ref — common in OpenAPI. Both feed Modelina and therefore the generated models. Nothing in the current suite covers that delta.

Separately, the v15.3.6 / v15.5.1 "safe URL resolver hardening" touches exactly the path where this repo deliberately sets safeUrlResolver: false (src/utils/refResolvers.ts:35,87), and the hand-written browser shim mirrors the v14 surface.

Verified not breaking: the $RefParser class, .parse()/.resolve()/.bundle()/.dereference(), the {order, canRead, read} resolver contract, the error classes, and engines.node (>=20 in both majors). @asyncapi/parser does not depend on ref-parser, so the AsyncAPI path is unaffected. This is a dedicated PR with a reviewed snapshot delta, not a batch-sweep item.

Validation

Tier	Result
npm run build	pass
npm run typecheck / typecheck:test	pass
npm run lint:fix	clean at --max-warnings 0
npm run generate:assets	pass — one real diff, committed separately
npm test	887 passed, 89 snapshots passed, 0 churn
npm run test:blackbox	220 passed
Runtime tier	not run — see below

No snapshot updates were needed: the @asyncapi/parser bump did not move generated output. The only regenerated asset is docs/usage.md, where two "See code" links pick up the new plugin versions — link targets only, no change to any command's flags or help output.

The runtime tier was skipped deliberately. It is gated on a broker client (nats, kafkajs, mqtt, amqplib) or Modelina changing, and none did. Running it would regenerate test/runtime/typescript/src, overwriting hand-written expected-output surfaces for no coverage gain.

prepare:pr was not run as a single shot: its runtime:typescript:generate step runs npm ci inside test/runtime/typescript and fails on pre-existing lockfile drift unrelated to this change. Its constituent steps were run directly, as listed above.

Audit delta

45 findings → 40. Criticals 9 → 6.

Manual review / follow-ups

• jsonpath-plus@7.2.0 (critical RCE) is not fixable from here. The vulnerable copies come via @asyncapi/modelina → @asyncapi/multi-parser@2.3.0 → the parserapiv1/parserapiv2 aliases, which pin old @asyncapi/parser releases. Bumping our own @asyncapi/parser to 3.6.1 does not reach them. Needs an upstream fix in @asyncapi/multi-parser; deliberately not papered over with an overrides entry.
• esbuild 0.20.2 → ^0.28 (moderate, dev-server advisory that this repo never triggers). Needs a manifest change across eight 0.x minors, and the browser bundle is a shipped artifact — deserves its own PR with a bundle diff review.
• concurrently 9 → 10 for a shell-quote critical. Dev-only, used by test:blackbox. Major bump.
• eslint 8 → 9. A flatted high sits under the EOL eslint 8 chain; the real fix is the flat-config migration (this repo still runs ESLINT_USE_FLAT_CONFIG=false). Significant standalone work.
• fast-xml-parser (critical) arrives via @aws-sdk/core under the oclif packaging tooling and via Modelina. Both are parent bumps.
• ajv / ramldt2jsonschema chain — accepted, not fixable. It sits under @asyncapi/raml-dt-schema-parser@4.0.24, which is the latest release; npm audit's only proposed "fix" is a major downgrade of the parent, i.e. dropping RAML support.

package.json has no overrides block, and none was added.

Closes #445
Closes #444
Closes #441
Closes #442

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
the-codegen-project	Ready	Preview	Aug 1, 2026 8:15pm
the-codegen-project-mcp	Ready	Preview	Aug 1, 2026 8:15pm

[jonaslagoni]

🎉 This PR is included in version 0.82.1 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀