fix: comprehensive quality scan fixes across codebase#111
Merged
Conversation
Critical fixes:
- process-lock: atomic mkdir without recursive to prevent TOCTOU race
- http-request: add res.on('error') handler to prevent hanging promises
- dlx/manifest: atomic writes via renameSync in all write paths
- promise-queue: clear() rejects pending tasks, event-driven onIdle()
Security fixes:
- json-parser: deep prototype pollution check via JSON.parse reviver
- esbuild-config: bundle shared deps inline (no extraneous devDeps in dist)
Bug fixes:
- abort: use AbortSignal.timeout() to prevent timer leaks
- cache-with-ttl: guard JSON.parse for corrupted cache entries
- isolation: wrap JSON.parse with file-path context in error
- memoization: fix expired entry cleanup, implement clearAllCaches,
prevent thundering herd in memoizeAsync, fix memoizeWeak undefined
- ansi: fix ST pattern to correctly separate BEL|ESC\|0x9C
- argv/parse: remove ambiguous short-flag inference from hasFlag
- progress: guard division by zero when total=0
- promise-queue: maxQueueLength check uses !== undefined
- promises: pRetry captures latest error instead of first
- github: remove double JSON.stringify/parse in cacheFetchGhsa
- ipc: unref waitForIpc timer to prevent blocking exit
Script fixes:
- fix/commonjs-exports, fix/path-aliases, test/filter: fix parent
directory traversal (off-by-one in __dirname resolution)
- test/main: deduplicate NODE_OPTIONS in runIsolatedTests
- test/cover: clean exit on build failure
- validate/no-extraneous-deps: add .catch() on main()
- orchestrator: use logger instead of console.log
- esbuild-config: remove console from drop list, add node18 comment
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Test plan
pnpm run fix— lint passespnpm build— build succeeds, all validations passpnpm run check— all checks pass (including no extraneous deps)pnpm test— 6537 tests pass, 0 failures🤖 Generated with Claude Code