deer-flow/frontend/tests/unit/scripts/xmldom-security.test.ts

21 lines
615 B
TypeScript

import { readFileSync } from "node:fs";
import { resolve } from "node:path";
import { expect, test } from "@rstest/core";
test("the lockfile excludes xmldom versions affected by GHSA-965w-775f-mr7g", () => {
const lockfile = readFileSync(
resolve(process.cwd(), "pnpm-lock.yaml"),
"utf8",
);
const versions = Array.from(
lockfile.matchAll(/^ '@xmldom\/xmldom@([^']+)':/gm),
(match) => match[1]!,
);
// The dependency can disappear entirely if Nextra drops its XML parser.
for (const version of versions) {
expect(version).not.toMatch(/^0\.9\.(?:[0-9]|10|11)(?:$|[(-])/);
}
});