Dependency security upgrades and modernization

.github/workflows/ci.yml

@@ -3,17 +3,25 @@ name: Lint and test
 on: push
 
 jobs:
-  lint:
+  build-and-lint:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-node@v6
         with:
           cache: yarn
       - run: yarn
+      - run: echo "SHORT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
+      - run: yarn pack -o appmap-node-${{ env.SHORT_SHA }}.tgz
+      - uses: actions/upload-artifact@v6
+        with:
+          name: appmap-node-${{ env.SHORT_SHA }}
+          path: appmap-node-${{ env.SHORT_SHA }}.tgz
+      - run: yarn pkg-pr-new publish --commentWithDev --yarn
       - run: yarn lint
 
   test:
+    needs: build-and-lint
     strategy:
       matrix:
         node-version: [18, 20, 22, 24]
@@ -43,12 +51,6 @@ jobs:
           node-version: ${{matrix.node-version}}
           cache: yarn
       - run: yarn
-      - uses: actions/cache@v4
-        with:
-          path: |
-            test/pnpm-compat/.yarn/cache
-            test/pnpm-compat/.yarn/global
-          key: pnpm-compat-yarn-${{ runner.os }}-${{ hashFiles('test/pnpm-compat/yarn.lock') }}
       - run: node test/smoketest.mjs
       - run: yarn test
         env:
@@ -57,43 +59,29 @@ jobs:
 
   windows-test:
     runs-on: windows-latest
+    # Force Yarn's cache and global folder to live on the same volume (drive D:) as the workspace.
+    # On Windows runners, the default global directories live on C:, which causes
+    # hard-linking errors (EXDEV: cross-device link not permitted) during the
+    # pnpm-compat test installation because the workspace is located on D:.
+    env:
+      YARN_ENABLE_GLOBAL_CACHE: "false"
+      YARN_CACHE_FOLDER: "${{ github.workspace }}/.yarn/cache"
+      YARN_GLOBAL_FOLDER: "${{ github.workspace }}/.yarn/global"
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-node@v6
         with:
           cache: yarn
       - run: yarn
-      - uses: actions/cache@v4
-        with:
-          path: |
-            test/pnpm-compat/.yarn/cache
-            test/pnpm-compat/.yarn/global
-          key: pnpm-compat-yarn-${{ runner.os }}-${{ hashFiles('test/pnpm-compat/yarn.lock') }}
       - run: yarn prepack
       - run: yarn test || yarn jest --no-silent --verbose --onlyFailures
       - run: node test/smoketest.mjs
 
-  pack:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
-        with:
-          cache: yarn
-      - run: yarn
-      - run: echo "SHORT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
-      - run: yarn pack -o appmap-node-${{ env.SHORT_SHA }}.tgz
-      - uses: actions/upload-artifact@v6
-        with:
-          name: appmap-node-${{ env.SHORT_SHA }}
-          path: appmap-node-${{ env.SHORT_SHA }}.tgz
-      - run: npx pkg-pr-new publish
-
   release:
     runs-on: ubuntu-latest
     permissions: {}
     if: github.ref_name == 'main'
-    needs: [lint, test, windows-test]
+    needs: [build-and-lint, test, windows-test]
     steps:
       - uses: actions/create-github-app-token@v1
         id: app-token

package.json

@@ -51,8 +51,8 @@
   "devDependencies": {
     "@eslint/js": "^9.0.0",
     "@jest/types": "^29.6.3",
-    "@semantic-release/changelog": "^6.0.3",
-    "@semantic-release/git": "^10.0.1",
+    "@semantic-release/changelog": "^7.0.0",
+    "@semantic-release/git": "^11.0.1",
     "@swc/core": "^1.15.13",
     "@swc/jest": "^0.2.29",
     "@tsconfig/node18": "^18.2.2",
@@ -73,10 +73,11 @@
     "globals": "^15.0.0",
     "jest": "^29.6.2",
     "mongodb": "^6.3.0",
+    "pkg-pr-new": "^0.0.87",
     "prettier": "^3.0.2",
     "react": "^18",
     "react-dom": "^18",
-    "semantic-release": "^22.0.5",
+    "semantic-release": "^25.0.9",
     "tmp": "^0.2.5",
     "ts-node": "^10.9.2",
     "type-fest": "^4.3.2",
@@ -98,7 +99,7 @@
   },
   "resolutions": {
     "rollup": "^4.59.0",
-    "tar": "7.5.11"
+    "tar": "7.5.22"
   },
   "workspaces": [
     "test/httpClient",

test/pnpm-compat/.yarnrc.yml

@@ -1,9 +1,3 @@
 nodeLinker: pnpm
 
-enableGlobalCache: false
-
-cacheFolder: ./.yarn/cache
-
-globalFolder: ./.yarn/global
-
 yarnPath: ../../.yarn/releases/yarn-4.13.0.cjs

test/pnpm-compat/package.json

@@ -3,6 +3,6 @@
   "packageManager": "yarn@4.13.0",
   "private": true,
   "dependencies": {
-    "vitest": "^0.34.6"
+    "vitest": "^3.2.6"
   }
 }