Skip to content

Bump dev-tooling dependencies to clear 15 Dependabot advisories - #361

Merged
ffumero2003 merged 3 commits into
mainfrom
fix-tssdk-issue-360-devdep-vuln-bumps
Nov 5, 2026
Merged

Bump dev-tooling dependencies to clear 15 Dependabot advisories#361
ffumero2003 merged 3 commits into
mainfrom
fix-tssdk-issue-360-devdep-vuln-bumps

Conversation

@ffumero2003

@ffumero2003 ffumero2003 commented Nov 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Context

The Security tab showed 15 open Dependabot alerts, all in development and build tooling. The published SDK has zero runtime dependencies.

The dependency audit also identified markdown-it advisories fixed in 14.3.3. The initial 14.3.2 override was insufficient for those findings.

Changes

  • Override fast-uri at 3.1.9 and markdown-it at 14.3.3.
  • Bump the Vitest family to 4.1.12 and Vite to 8.2.4.
  • Regenerate pnpm-lock.yaml. A follow-up removed the minimatch 11 override and TypeDoc patch because the trusted PR audit checks out only dependency manifests and could not install a referenced patch file.

Result

  • fast-uri resolves to 3.1.9 (4 Dependabot alerts).
  • markdown-it resolves to 14.3.3 (the original markdown-it alerts and the additional audit-policy findings).
  • @vitest/mocker resolves to 4.1.12 (2 alerts).
  • vite resolves to 8.2.4 (6 alerts).
  • A pre-existing dependency audit finding remains outside this PR's scope. The dependency audit still fails; this PR does not claim an audit-clean result.

No runtime dependency changes.

Verification

pnpm install --frozen-lockfile, pnpm lint, pnpm build, pnpm test (85 files, 2,520 passed, 9 skipped), and pnpm verify pass locally. The trusted audit wrapper still reports the existing dependency finding noted above.

Closes #360

@ffumero2003 ffumero2003 self-assigned this Nov 4, 2026
@quality-keeper

quality-keeper Bot commented Nov 4, 2026 •
edited
Loading

Copy link
Copy Markdown

Quality Keeper — Advisory Review

Source: backblaze-labs/b2-sdk-typescript

Advisory only — this is not a required status check. Quality Keeper reviewed this repository snapshot and is reporting what it found. It changes no status and merges nothing; suggested scaffolds are starting points, not proof.

Quality Keeper assessed the repository, executed checks, and collected results, covering 19 quality expectations.

Five repository-quality areas

Hard expectations keep their exact Evidence State. Advisory applicability questions are separate. Implementation or suite presence is not proof of a trusted run.

Area Hard expectations Evidence States Implementation status Advisory questions
Observability 0 — not_evaluated 1 0
Product Analytics 0 — not_evaluated 1 0
User Feedback 0 — not_evaluated 1 0
Reliability 3 pending_run 3 not_evaluated 3 0
Security 4 pending_run 2, verified 2 not_evaluated 4 0
Other registered quality 12 pending_run 10, verified 2 not_evaluated 12 0
Observability — 0 hard, 0 advisory

Can operators understand and diagnose repository-owned runtime behavior?

Hard expectations

None selected.

Applicability Review Gaps (advisory)

None.

Product Analytics — 0 hard, 0 advisory

Does repository-owned product analytics instrumentation behave safely and as declared?

Hard expectations

None selected.

Applicability Review Gaps (advisory)

None.

User Feedback — 0 hard, 0 advisory

Do repository-owned feedback and support-intake flows behave safely and accessibly?

Hard expectations

None selected.

Applicability Review Gaps (advisory)

None.

Reliability — 3 hard, 0 advisory

Does repository-owned software fail, recover, time out, and report health predictably?

Hard expectations

  • Cancellation or idempotency controls need behavior testing — Testing Type reliability_resilience_testing — Evidence State pending_run
    • Why it applies: Production source declares a cancellation primitive or idempotency control, so its externally observable behavior needs repository-owned verification.
    • Implementation presence: not_evaluated
    • Implementation explanation: Implementation detection was not evaluated because no applicable standards-owned detection contract was available. Evidence State remains pending_run; if verified, that verdict still comes only from Evaluate's accepted evidence.
    • Applicability signals: none recorded
    • Behavior suite / source: not required by the selected criteria
    • Native GitHub result: not observed
    • Structured summary: not_observed
    • Trusted run: not required by the selected criteria
    • Revision / freshness: 16ca9713570f51ca950c0b5c9838e536e764d913 / unknown
    • Partial/unbound proof: implementation detection not evaluated; Evidence State remains pending_run
    • Owner / target: backblaze-labs/b2-sdk-typescript / src:8857bd5276228487
    • Next: No seed proposal — an operator must design acceptable evidence for this expectation.
  • Outbound calling assets need timeout testing — Testing Type reliability_resilience_testing — Evidence State pending_run
    • Why it applies: Production source contains a recognized outbound network-client call site, so explicit timeout behavior needs repository-owned verification.
    • Implementation presence: not_evaluated
    • Implementation explanation: Implementation detection was not evaluated because no applicable standards-owned detection contract was available. Evidence State remains pending_run; if verified, that verdict still comes only from Evaluate's accepted evidence.
    • Applicability signals: none recorded
    • Behavior suite / source: not required by the selected criteria
    • Native GitHub result: not observed
    • Structured summary: not_observed
    • Trusted run: not required by the selected criteria
    • Revision / freshness: 16ca9713570f51ca950c0b5c9838e536e764d913 / unknown
    • Partial/unbound proof: implementation detection not evaluated; Evidence State remains pending_run
    • Owner / target: backblaze-labs/b2-sdk-typescript / src:8857bd5276228487
    • Next: No seed proposal — an operator must design acceptable evidence for this expectation.
  • Published sdk packages need reliability testing — Testing Type reliability_resilience_testing — Evidence State pending_run
    • Why it applies: The interpreted asset is a published package or library with a detected external service or network boundary — consumers depend on predictable error classification and failure-path behavior, so those paths need verification against the declared public contract. Timeout and retry expectations are selected separately when their owned call sites or policies are detected.
    • Implementation presence: not_evaluated
    • Implementation explanation: Implementation detection was not evaluated because no applicable standards-owned detection contract was available. Evidence State remains pending_run; if verified, that verdict still comes only from Evaluate's accepted evidence.
    • Applicability signals: none recorded
    • Behavior suite / source: not required by the selected criteria
    • Native GitHub result: not observed
    • Structured summary: not_observed
    • Trusted run: not required by the selected criteria
    • Revision / freshness: 16ca9713570f51ca950c0b5c9838e536e764d913 / unknown
    • Partial/unbound proof: implementation detection not evaluated; Evidence State remains pending_run
    • Owner / target: backblaze-labs/b2-sdk-typescript / src:8857bd5276228487
    • Next: No seed proposal — an operator must design acceptable evidence for this expectation.

Applicability Review Gaps (advisory)

None.

Security — 4 hard, 0 advisory

Do static controls and repository-owned security behaviors protect the intended boundaries?

Hard expectations

  • Authorization boundaries need permission behavior testing — Testing Type dynamic_security_testing — Evidence State pending_run
    • Why it applies: The interpreted asset contains a production authorization, role, permission, tenant, resource, or ownership boundary, so repository-owned tests must prove forbidden cross-boundary access is denied.
    • Implementation presence: not_evaluated
    • Implementation explanation: Implementation detection was not evaluated because no applicable standards-owned detection contract was available. Evidence State remains pending_run; if verified, that verdict still comes only from Evaluate's accepted evidence.
    • Applicability signals: none recorded
    • Behavior suite / source: not required by the selected criteria
    • Native GitHub result: not observed
    • Structured summary: not_observed
    • Trusted run: not required by the selected criteria
    • Revision / freshness: 16ca9713570f51ca950c0b5c9838e536e764d913 / unknown
    • Partial/unbound proof: implementation detection not evaluated; Evidence State remains pending_run
    • Owner / target: backblaze-labs/b2-sdk-typescript / src:8857bd5276228487
    • Next: No seed proposal — an operator must design acceptable evidence for this expectation.
  • Credential handling assets need non exposure testing — Testing Type dynamic_security_testing — Evidence State pending_run
    • Why it applies: The interpreted asset contains production credential, token, password, API-key, redaction, or sanitization handling, so repository-owned tests must prove sensitive values are not logged, returned, or durably exposed.
    • Implementation presence: not_evaluated
    • Implementation explanation: Implementation detection was not evaluated because no applicable standards-owned detection contract was available. Evidence State remains pending_run; if verified, that verdict still comes only from Evaluate's accepted evidence.
    • Applicability signals: none recorded
    • Behavior suite / source: not required by the selected criteria
    • Native GitHub result: not observed
    • Structured summary: not_observed
    • Trusted run: not required by the selected criteria
    • Revision / freshness: 16ca9713570f51ca950c0b5c9838e536e764d913 / unknown
    • Partial/unbound proof: implementation detection not evaluated; Evidence State remains pending_run
    • Owner / target: backblaze-labs/b2-sdk-typescript / src:8857bd5276228487
    • Next: No seed proposal — an operator must design acceptable evidence for this expectation.
  • Code and configuration assets need static security analysis — Testing Type static_security_analysis — Evidence State verified
    • Why it applies: The interpreted asset contains code, configuration, dependencies, secrets coordinates, infrastructure-as-code, or service boundaries, so static security analysis is required before runtime evidence is trusted.
    • Implementation presence: not_evaluated
    • Implementation explanation: Implementation detection was not evaluated because no applicable standards-owned detection contract was available. Evidence State remains verified; if verified, that verdict still comes only from Evaluate's accepted evidence.
    • Applicability signals: none recorded
    • Behavior suite / source: not required by the selected criteria
    • Native GitHub result: not observed
    • Structured summary: not_observed
    • Trusted run: not required by the selected criteria
    • Revision / freshness: 16ca9713570f51ca950c0b5c9838e536e764d913 / current
    • Partial/unbound proof: implementation detection not evaluated
    • Owner / target: backblaze-labs/b2-sdk-typescript / src:8857bd5276228487
    • Next: None — already verified before this run.
  • Published packages need provenance proof — Testing Type static_security_analysis — Evidence State verified
    • Why it applies: The interpreted asset is a published package with source code, so published release artifacts should carry provenance metadata (npm provenance, SLSA attestation, or sigstore signature) to protect the supply chain.
    • Implementation presence: not_evaluated
    • Implementation explanation: Implementation detection was not evaluated because no applicable standards-owned detection contract was available. Evidence State remains verified; if verified, that verdict still comes only from Evaluate's accepted evidence.
    • Applicability signals: none recorded
    • Behavior suite / source: not required by the selected criteria
    • Native GitHub result: not observed
    • Structured summary: not_observed
    • Trusted run: not required by the selected criteria
    • Revision / freshness: 16ca9713570f51ca950c0b5c9838e536e764d913 / current
    • Partial/unbound proof: implementation detection not evaluated
    • Owner / target: backblaze-labs/b2-sdk-typescript / src:8857bd5276228487
    • Next: None — already verified before this run.

Applicability Review Gaps (advisory)

None.

Other registered quality — 12 hard, 0 advisory

Registered Testing Types not assigned to one of the five focused areas.

Hard expectations

  • Packaged or runnable assets need build verification — Testing Type build_verification — Evidence State pending_run
    • Why it applies: The interpreted asset has package, script, workflow, UI, service, CLI, edge-runtime, or game-runtime signals, so it needs a reproducible build or equivalent construction check.
    • Implementation presence: not_evaluated
    • Implementation explanation: Implementation detection was not evaluated because no applicable standards-owned detection contract was available. Evidence State remains pending_run; if verified, that verdict still comes only from Evaluate's accepted evidence.
    • Applicability signals: none recorded
    • Behavior suite / source: not required by the selected criteria
    • Native GitHub result: not observed
    • Structured summary: not_observed
    • Trusted run: not required by the selected criteria
    • Revision / freshness: 16ca9713570f51ca950c0b5c9838e536e764d913 / unknown
    • Partial/unbound proof: implementation detection not evaluated; Evidence State remains pending_run
    • Owner / target: backblaze-labs/b2-sdk-typescript / src:8857bd5276228487
    • Next: None — exercised this run.
  • Published packages need sdk build artifact review — Testing Type build_verification — Evidence State pending_run
    • Why it applies: The interpreted asset is a published package with source code, so the distribution manifest completeness, pack tarball integrity, and declared file list need verification as part of the release artifact.
    • Implementation presence: not_evaluated
    • Implementation explanation: Implementation detection was not evaluated because no applicable standards-owned detection contract was available. Evidence State remains pending_run; if verified, that verdict still comes only from Evaluate's accepted evidence.
    • Applicability signals: none recorded
    • Behavior suite / source: not required by the selected criteria
    • Native GitHub result: not observed
    • Structured summary: not_observed
    • Trusted run: not required by the selected criteria
    • Revision / freshness: 16ca9713570f51ca950c0b5c9838e536e764d913 / unknown
    • Partial/unbound proof: implementation detection not evaluated; Evidence State remains pending_run
    • Owner / target: backblaze-labs/b2-sdk-typescript / src:8857bd5276228487
    • Next: None — exercised this run.
  • Consumer or platform boundaries need compatibility testing — Testing Type compatibility_testing — Evidence State pending_run
    • Why it applies: The interpreted asset is published or consumed across environments (published package, exported API, command-line tool, or edge target), so compatibility across platforms, versions, and consumers needs verification.
    • Implementation presence: not_evaluated
    • Implementation explanation: Implementation detection was not evaluated because no applicable standards-owned detection contract was available. Evidence State remains pending_run; if verified, that verdict still comes only from Evaluate's accepted evidence.
    • Applicability signals: none recorded
    • Behavior suite / source: not required by the selected criteria
    • Native GitHub result: not observed
    • Structured summary: not_observed
    • Trusted run: not required by the selected criteria
    • Revision / freshness: 16ca9713570f51ca950c0b5c9838e536e764d913 / unknown
    • Partial/unbound proof: implementation detection not evaluated; Evidence State remains pending_run
    • Owner / target: backblaze-labs/b2-sdk-typescript / src:8857bd5276228487
    • Next: None — exercised this run.
  • Published typescript packages need type declaration check — Testing Type compatibility_testing — Evidence State pending_run
    • Why it applies: The interpreted asset is a published TypeScript package (tsconfig.json or has_types in package.json detected), so generated .d.ts declaration files and type resolution must be verified from a consumer project's perspective.
    • Implementation presence: not_evaluated
    • Implementation explanation: Implementation detection was not evaluated because no applicable standards-owned detection contract was available. Evidence State remains pending_run; if verified, that verdict still comes only from Evaluate's accepted evidence.
    • Applicability signals: none recorded
    • Behavior suite / source: not required by the selected criteria
    • Native GitHub result: not observed
    • Structured summary: not_observed
    • Trusted run: not required by the selected criteria
    • Revision / freshness: 16ca9713570f51ca950c0b5c9838e536e764d913 / unknown
    • Partial/unbound proof: implementation detection not evaluated; Evidence State remains pending_run
    • Owner / target: backblaze-labs/b2-sdk-typescript / src:8857bd5276228487
    • Next: None — exercised this run.
  • Every asset needs configuration review — Testing Type configuration_artifact_review — Evidence State verified
    • Why it applies: Every interpreted asset needs a static review of its declared files, manifests, configuration, and artifacts so Quality Keeper can explain its shape before evidence is harvested.
    • Implementation presence: not_evaluated
    • Implementation explanation: Implementation detection was not evaluated because no applicable standards-owned detection contract was available. Evidence State remains verified; if verified, that verdict still comes only from Evaluate's accepted evidence.
    • Applicability signals: none recorded
    • Behavior suite / source: not required by the selected criteria
    • Native GitHub result: not observed
    • Structured summary: not_observed
    • Trusted run: not required by the selected criteria
    • Revision / freshness: 16ca9713570f51ca950c0b5c9838e536e764d913 / current
    • Partial/unbound proof: implementation detection not evaluated
    • Owner / target: backblaze-labs/b2-sdk-typescript / src:8857bd5276228487
    • Next: None — already verified before this run.
  • Public or network boundaries need contract testing — Testing Type contract_testing — Evidence State pending_run
    • Why it applies: The interpreted asset publishes or exposes a boundary that other software depends on (network API, CLI, package exports, or an importable Go external client), so the public interface contract needs verification.
    • Implementation presence: not_evaluated
    • Implementation explanation: Implementation detection was not evaluated because no applicable standards-owned detection contract was available. Evidence State remains pending_run; if verified, that verdict still comes only from Evaluate's accepted evidence.
    • Applicability signals: none recorded
    • Behavior suite / source: not required by the selected criteria
    • Native GitHub result: not observed
    • Structured summary: not_observed
    • Trusted run: not required by the selected criteria
    • Revision / freshness: 16ca9713570f51ca950c0b5c9838e536e764d913 / unknown
    • Partial/unbound proof: implementation detection not evaluated; Evidence State remains pending_run
    • Owner / target: backblaze-labs/b2-sdk-typescript / src:8857bd5276228487
    • Next: It was selected but produced no result — opt in (e.g. --include-expensive) or fix the command; do not just re-select it.
  • Published sdk packages need integration testing — Testing Type integration_testing — Evidence State pending_run
    • Why it applies: The interpreted asset is a published package or library that creates an integration boundary for consumers, so the package's integration paths, API contracts, and external service behaviors need integration-level verification.
    • Implementation presence: not_evaluated
    • Implementation explanation: Implementation detection was not evaluated because no applicable standards-owned detection contract was available. Evidence State remains pending_run; if verified, that verdict still comes only from Evaluate's accepted evidence.
    • Applicability signals: none recorded
    • Behavior suite / source: not required by the selected criteria
    • Native GitHub result: not observed
    • Structured summary: not_observed
    • Trusted run: not required by the selected criteria
    • Revision / freshness: 16ca9713570f51ca950c0b5c9838e536e764d913 / unknown
    • Partial/unbound proof: implementation detection not evaluated; Evidence State remains pending_run
    • Owner / target: backblaze-labs/b2-sdk-typescript / src:8857bd5276228487
    • Next: It was selected but produced no result — opt in (e.g. --include-expensive) or fix the command; do not just re-select it.
  • Every asset needs discoverability review — Testing Type metadata_discoverability_review — Evidence State verified
    • Why it applies: Every interpreted asset needs enough metadata and documentation for humans and systems to identify what it is and how to work with it.
    • Implementation presence: not_evaluated
    • Implementation explanation: Implementation detection was not evaluated because no applicable standards-owned detection contract was available. Evidence State remains verified; if verified, that verdict still comes only from Evaluate's accepted evidence.
    • Applicability signals: none recorded
    • Behavior suite / source: not required by the selected criteria
    • Native GitHub result: not observed
    • Structured summary: not_observed
    • Trusted run: not required by the selected criteria
    • Revision / freshness: 16ca9713570f51ca950c0b5c9838e536e764d913 / current
    • Partial/unbound proof: implementation detection not evaluated
    • Owner / target: backblaze-labs/b2-sdk-typescript / src:8857bd5276228487
    • Next: None — already verified before this run.
  • Documented assets need specification conformity review — Testing Type specification_conformity_review — Evidence State pending_run
    • Why it applies: The asset carries documentation, so documented commands, setup instructions, examples, and claims need to stay aligned with the implementation.
    • Implementation presence: not_evaluated
    • Implementation explanation: Implementation detection was not evaluated because no applicable standards-owned detection contract was available. Evidence State remains pending_run; if verified, that verdict still comes only from Evaluate's accepted evidence.
    • Applicability signals: none recorded
    • Behavior suite / source: not required by the selected criteria
    • Native GitHub result: not observed
    • Structured summary: not_observed
    • Trusted run: not required by the selected criteria
    • Revision / freshness: 16ca9713570f51ca950c0b5c9838e536e764d913 / unknown
    • Partial/unbound proof: implementation detection not evaluated; Evidence State remains pending_run
    • Owner / target: backblaze-labs/b2-sdk-typescript / src:8857bd5276228487
    • Next: None — exercised this run.
  • Published packages with docs need example validation — Testing Type specification_conformity_review — Evidence State pending_run
    • Why it applies: The interpreted asset is a published package with detected documentation, so code examples in README, docs, or examples directories should be compiled or type-checked to confirm they match the actual public API.
    • Implementation presence: not_evaluated
    • Implementation explanation: Implementation detection was not evaluated because no applicable standards-owned detection contract was available. Evidence State remains pending_run; if verified, that verdict still comes only from Evaluate's accepted evidence.
    • Applicability signals: none recorded
    • Behavior suite / source: not required by the selected criteria
    • Native GitHub result: not observed
    • Structured summary: not_observed
    • Trusted run: not required by the selected criteria
    • Revision / freshness: 16ca9713570f51ca950c0b5c9838e536e764d913 / unknown
    • Partial/unbound proof: implementation detection not evaluated; Evidence State remains pending_run
    • Owner / target: backblaze-labs/b2-sdk-typescript / src:8857bd5276228487
    • Next: None — exercised this run.
  • Cli sdk iac assets need system testing — Testing Type system_testing — Evidence State pending_run
    • Why it applies: The interpreted asset is a CLI, published package/SDK, or IaC provider that makes outbound calls to a real external dependency, so its own entry point needs an end-to-end test of that real flow — not just unit or integration coverage of individual pieces.
    • Implementation presence: not_evaluated
    • Implementation explanation: Implementation detection was not evaluated because no applicable standards-owned detection contract was available. Evidence State remains pending_run; if verified, that verdict still comes only from Evaluate's accepted evidence.
    • Applicability signals: none recorded
    • Behavior suite / source: not required by the selected criteria
    • Native GitHub result: not observed
    • Structured summary: not_observed
    • Trusted run: not required by the selected criteria
    • Revision / freshness: 16ca9713570f51ca950c0b5c9838e536e764d913 / unknown
    • Partial/unbound proof: implementation detection not evaluated; Evidence State remains pending_run
    • Owner / target: backblaze-labs/b2-sdk-typescript / src:8857bd5276228487
    • Next: It was selected but produced no result — opt in (e.g. --include-expensive) or fix the command; do not just re-select it.
  • Code assets need unit testing — Testing Type unit_testing — Evidence State pending_run
    • Why it applies: The interpreted asset contains runnable or reusable source code, so the smallest testable units need isolated verification.
    • Implementation presence: not_evaluated
    • Implementation explanation: Implementation detection was not evaluated because no applicable standards-owned detection contract was available. Evidence State remains pending_run; if verified, that verdict still comes only from Evaluate's accepted evidence.
    • Applicability signals: none recorded
    • Behavior suite / source: not required by the selected criteria
    • Native GitHub result: not observed
    • Structured summary: not_observed
    • Trusted run: not required by the selected criteria
    • Revision / freshness: 16ca9713570f51ca950c0b5c9838e536e764d913 / unknown
    • Partial/unbound proof: implementation detection not evaluated; Evidence State remains pending_run
    • Owner / target: backblaze-labs/b2-sdk-typescript / src:8857bd5276228487
    • Next: None — exercised this run.

Applicability Review Gaps (advisory)

None.

Result

  • 11 expectations are covered by acceptable evidence.
  • 8 still need attention — Quality Keeper cannot count them as covered yet.

Covered

Quality Keeper found acceptable evidence for one or more expectations in these Testing Types.

  • Build Verification — 2 expectations covered (Ran and passed).
    Confirms the software actually builds/packages into a runnable or publishable artifact.
    • What Quality Keeper ran:
      • pnpm run build → passed @. (asset scope) — declared in package.json
      • pnpm run typecheck → passed @. (asset scope) — declared in package.json
      • Full command output/logs are in the run artifacts (see Proof below).
  • Compatibility Testing — 2 expectations covered (Ran and passed).
    Checks the software works across the consumers, platforms, or versions it claims to support.
    • What Quality Keeper ran:
      • pnpm run verify:release → passed @. (asset scope) — declared in package.json
      • Full command output/logs are in the run artifacts (see Proof below).
  • Configuration & Artifact Review — 1 expectation covered (Verified before execution).
    Checks that config files, manifests, and build artifacts are present, well-formed, and say what they should.
  • Metadata & Discoverability Review — 1 expectation covered (Verified before execution).
    Checks that a repository or package is findable and understandable — description, topics, README, keywords.
  • Specification Conformity Review — 2 expectations covered (Ran and passed).
    Checks that documented assets actually match the specification or documented behavior they claim.
    • What Quality Keeper ran:
      • pnpm run lint:docs → passed @. (asset scope) — declared in package.json
      • Full command output/logs are in the run artifacts (see Proof below).
  • Static Security Analysis — 2 expectations covered (Verified before execution).
    Scans code and configuration for security problems without running it — secrets, unsafe patterns, misconfigurations.
    • What Quality Keeper ran:
      • pnpm run audit:deps → passed @. (asset scope) — declared in package.json
      • pnpm run test:audit:deps → passed — 7 passed @. (asset scope) — declared in package.json
      • Full command output/logs are in the run artifacts (see Proof below).
  • Unit Testing — 1 expectation covered (Ran and passed).
    Exercises individual functions or modules in isolation.
    • What Quality Keeper ran:
      • pnpm run test → passed — 2527 passed, 2 skipped @. (asset scope) — declared in package.json
      • pnpm run test:all → passed — 2527 passed, 2 skipped @. (asset scope) — declared in package.json
      • Full command output/logs are in the run artifacts (see Proof below).

Needs attention

Quality Keeper does not yet have acceptable evidence for these Testing Types.

Some have partial checks that need to run, be fixed, or be connected. Others need new proof or seeded tests. In both cases, Quality Keeper cannot count them as covered yet.

  • Contract Testing
    Checks that a public or network boundary (API, SDK surface, schema) matches its agreed shape.
    • Blocked before execution: expensive/invasive check gated for safety; opt in explicitly with --include-expensive to run it
  • Dynamic Security Testing
    Exercises security behavior before release or against a staged runtime, including access controls, secret safety, secure defaults, and sanitized audit records.
  • Integration Testing
    Checks that two or more components work together — a module plus a real dependency, service, or datastore.
    • Blocked before execution: expensive/invasive check gated for safety; opt in explicitly with --include-expensive to run it
  • Reliability & Resilience Testing
    Checks that the software behaves predictably when dependencies fail, time out, degrade, or recover — without mistaking retry libraries, health routes, or alert files for proof.
  • System / End-to-End Testing
    Drives a real user or system flow through the whole application, end to end.
    • Blocked before execution: expensive/invasive check gated for safety; opt in explicitly with --include-expensive to run it

Quality Keeper changes no Evidence State. Pending, missing, executed-but-not-exercised, and review items are not passing, and seeded scaffolds are next actions, not evidence, until applied and re-evaluated.

Full breakdown (19 expectations)
Area Status Expectation Why it applies
Build Verification Ran and passed packaged_or_runnable_assets_need_build_verification The interpreted asset has package, script, workflow, UI, service, CLI, edge-runtime, or game-runtime signals, so it needs a reproducible build or equivalent construction check.
Build Verification Ran and passed published_packages_need_sdk_build_artifact_review The interpreted asset is a published package with source code, so the distribution manifest completeness, pack tarball integrity, and declared file list need verification as part of the release artifact.
Compatibility Testing Ran and passed consumer_or_platform_boundaries_need_compatibility_testing The interpreted asset is published or consumed across environments (published package, exported API, command-line tool, or edge target), so compatibility across platforms, versions, and consumers needs verification.
Compatibility Testing Ran and passed published_typescript_packages_need_type_declaration_check The interpreted asset is a published TypeScript package (tsconfig.json or has_types in package.json detected), so generated .d.ts declaration files and type resolution must be verified from a consumer project's perspective.
Configuration & Artifact Review Verified before execution every_asset_needs_configuration_review Every interpreted asset needs a static review of its declared files, manifests, configuration, and artifacts so Quality Keeper can explain its shape before evidence is harvested.
Contract Testing Selected but not executed public_or_network_boundaries_need_contract_testing The interpreted asset publishes or exposes a boundary that other software depends on (network API, CLI, package exports, or an importable Go external client), so the public interface contract needs verification.
Dynamic Security Testing Missing — no proof yet authorization_boundaries_need_permission_behavior_testing The interpreted asset contains a production authorization, role, permission, tenant, resource, or ownership boundary, so repository-owned tests must prove forbidden cross-boundary access is denied.
Dynamic Security Testing Missing — no proof yet credential_handling_assets_need_non_exposure_testing The interpreted asset contains production credential, token, password, API-key, redaction, or sanitization handling, so repository-owned tests must prove sensitive values are not logged, returned, or durably exposed.
Integration Testing Selected but not executed published_sdk_packages_need_integration_testing The interpreted asset is a published package or library that creates an integration boundary for consumers, so the package's integration paths, API contracts, and external service behaviors need integration-level verification.
Metadata & Discoverability Review Verified before execution every_asset_needs_discoverability_review Every interpreted asset needs enough metadata and documentation for humans and systems to identify what it is and how to work with it.
Reliability & Resilience Testing Missing — no proof yet outbound_calling_assets_need_timeout_testing Production source contains a recognized outbound network-client call site, so explicit timeout behavior needs repository-owned verification.
Reliability & Resilience Testing Missing — no proof yet cancellation_or_idempotency_controls_need_behavior_testing Production source declares a cancellation primitive or idempotency control, so its externally observable behavior needs repository-owned verification.
Reliability & Resilience Testing Missing — no proof yet published_sdk_packages_need_reliability_testing The interpreted asset is a published package or library with a detected external service or network boundary — consumers depend on predictable error classification and failure-path behavior, so those paths need verification against the declared public contract. Timeout and retry expectations are selected separately when their owned call sites or policies are detected.
Specification Conformity Review Ran and passed documented_assets_need_specification_conformity_review The asset carries documentation, so documented commands, setup instructions, examples, and claims need to stay aligned with the implementation.
Specification Conformity Review Ran and passed published_packages_with_docs_need_example_validation The interpreted asset is a published package with detected documentation, so code examples in README, docs, or examples directories should be compiled or type-checked to confirm they match the actual public API.
Static Security Analysis Verified before execution code_and_configuration_assets_need_static_security_analysis The interpreted asset contains code, configuration, dependencies, secrets coordinates, infrastructure-as-code, or service boundaries, so static security analysis is required before runtime evidence is trusted.
Static Security Analysis Verified before execution published_packages_need_provenance_proof The interpreted asset is a published package with source code, so published release artifacts should carry provenance metadata (npm provenance, SLSA attestation, or sigstore signature) to protect the supply chain.
System / End-to-End Testing Selected but not executed cli_sdk_iac_assets_need_system_testing The interpreted asset is a CLI, published package/SDK, or IaC provider that makes outbound calls to a real external dependency, so its own entry point needs an end-to-end test of that real flow — not just unit or integration coverage of individual pieces.
Unit Testing Ran and passed code_assets_need_unit_testing The interpreted asset contains runnable or reusable source code, so the smallest testable units need isolated verification.

New to these terms? Start with the Quality Keeper Standards Wiki to learn what each testing type means, why it applies, and what counts as evidence.

@ffumero2003
ffumero2003 force-pushed the fix-tssdk-issue-360-devdep-vuln-bumps branch from 4d833eb to b14266e Compare November 4, 2026 22:52
This was referenced Nov 5, 2026
Closed
Merged
@ffumero2003
ffumero2003 merged commit 2def2ba into main Nov 5, 2026
41 checks passed
@ffumero2003
ffumero2003 deleted the fix-tssdk-issue-360-devdep-vuln-bumps branch November 5, 2026 15:12
This was referenced Nov 5, 2026
Closed
Merged
ffumero2003 added a commit that referenced this pull request Nov 10, 2026
@ffumero2003 @sophiecarreras
Release 0.5.0 (#366)
a75d352 
* fix(upload): record large-file SHA-1 and support resume (#354)

* fix(upload): retry upload POST connection failures by default (#344)

* fix(upload): preserve SHA-1 integrity during large-file resume (#365)

* chore: update vulnerable transitive dependencies (#340)

* chore: update development tooling for dependency audit (#361)

* chore: allowlist minimatch audit advisory (#363)

* chore(release): prepare isolated v0.5.0

* test(upload): verify connection-failure phases and SHA-1

* docs: make the upload retry migration example self-contained

* fix(client): redact credentials from SDK object diagnostics (#351) (#375)

* test: cover credential redaction in SDK object diagnostics

Assert that util.inspect, console.log, JSON.stringify and object spread of
clients, bucket and file handles, auth stores and upload URL pools never
contain the application key or authorization tokens, and that getAuth(),
authorize() and file auth caches still carry the real token.

* fix(client): redact credentials from SDK object diagnostics

Hold the application key, stored authorization and upload URL pools in
private fields, give B2Client and the account-info stores a redacted
toJSON/inspect summary, and expose accountInfo through a getter, mirroring
the Partner client.

* docs: note credential redaction and the accountInfo accessor change

* feat(upload): add single-file connection-fault retry opt-out (#376)

* feat(upload): add single-file connection-fault retry opt-out

* refactor(upload): resolve connection-fault retry options

---------

Co-authored-by: Sophie <49928680+sophiecarreras@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@ffumero2003 ffumero2003

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Bump dev-tooling dependencies to clear 15 Dependabot advisories

1 participant

@ffumero2003