Update sinon package in preparation for fixing GHSA-73rr-hh4g-fpgx

[hlovdal]

The sinon package is really old and depends on a version of mocha that depends on a vulnerable version of diff. The diff package has been updated to fix this, but mocha has not made a new release yet.

Eventually mocha will, and sinon should also eventually update to use that version, but until then there is no reason to wait to update sinon to the latest version in the mean time. I read though the changelog and found no issues. I updated the package in multiple intermediate steps and none of them had any problems. Let me know if you rather want to have them squashes into just one commit that updates directly to the latest version.

Instead of passively waiting for new releases of mocha and sinon, it is possible to override directly and the last commit does exactly that so that then npm audit reports no issues with this repository.

If you want to have any changes to the branch, let me know and I'll update it.

[hlovdal]

Anything more needed?

All commits¹ pass using git test:

git test add -t test "npm ci && npm run test"
git test run -t test e75e2877..sinon_update

Footnotes

1. Since adding the lock file so npm ci can work. ↩

[hlovdal]

Branch updated with newest sinon release, removed the mocha override, links to changeslog entriess in commit messages plus test updated to also run npm run examples (all passing).

[hlovdal]

Updated branch to have a github action to verify that it tests properly. This is sorely needed since the current master branch is too out of date and will NOT run test successfully out of the box:

$ git clone https://github.com/node-red/node-red-node-test-helper
...
$ cd node-red-node-test-helper
$ npm install
...
$ npm --version
11.16.0
$ npm run test

> node-red-node-test-helper@0.3.6 test
> mocha "test/**/*_spec.js"

todo


  _spec.js
    1) should have credentials

  add custom settings on init
    2) should merge custom settings with RED.settings defaults

  helper.settings() usage
    3) should return a settings Object
    4) should not maintain settings state across multiple invocations


  0 passing (4ms)
  4 failing

  1) _spec.js
       should have credentials:
     AssertionError: expected NodeTestHelper {
  _events: {},
  _eventsCount: 0,
  _maxListeners: undefined,
  _sandbox: Sandbox {
    leakThreshold: 10000,
    assert: Object {
      failException: 'AssertError',
      fail: Function { name: 'fail' },
      pass: Function { name: 'pass' },
      callOrder: Function { name: 'assertCallOrder' },
      callCount: Function { name: 'assertCallCount' },
      expose: Function { name: 'expose' },
      match: Function { name: 'match' },
      called: Function { name: '' },
      notCalled: Function { name: '' },
      calledOnce: Function { name: '' },
      calledTwice: Function { name: '' },
      calledThrice: Function { name: '' },
      calledOn: Function { name: '' },
      alwaysCalledOn: Function { name: '' },
      calledWithNew: Function { name: '' },
      alwaysCalledWithNew: Function { name: '' },
      calledWith: Function { name: '' },
      calledWithMatch: Function { name: '' },
      alwaysCalledWith: Function { name: '' },
      alwaysCalledWithMatch: Function { name: '' },
      calledWithExactly: Function { name: '' },
      calledOnceWithExactly: Function { name: '' },
      calledOnceWithMatch: Function { name: '' },
      alwaysCalledWithExactly: Function { name: '' },
      neverCalledWith: Function { name: '' },
      neverCalledWithMatch: Function { name: '' },
      threw: Function { name: '' },
      alwaysThrew: Function { name: '' }
    },
    serverPrototype: Object {
      create: Function { name: 'create' },
      configure: Function { name: 'configure' },
      addRequest: Function { name: 'addRequest' },
      getHTTPMethod: Function { name: 'getHTTPMethod' },
      handleRequest: Function { name: 'handleRequest' },
      logger: Function { name: 'logger' },
      logError: Function { name: 'logError' },
      log: Function { name: 'log' },
      respondWith: Function { name: 'respondWith' },
      respond: Function { name: 'respond' },
      respondAll: Function { name: 'respondAll' },
      processRequest: Function { name: 'processRequest' },
      restore: Function { name: 'restore' },
      getRequest: Function { name: 'getRequest' },
      reset: Function { name: 'reset' },
      resetBehavior: Function { name: 'resetBehavior' },
      resetHistory: Function { name: 'resetHistory' }
    },
    getFakes: Function { name: 'getFakes' },
    getRestorers: Function { name: '' },
    createStubInstance: Function { name: 'createStubInstance' },
    inject: Function { name: 'inject' },
    mock: Function { name: 'mock' },
    reset: Function { name: 'reset' },
    resetBehavior: Function { name: 'resetBehavior' },
    resetHistory: Function { name: 'resetHistory' },
    restore: Function { name: 'restore' },
    restoreContext: Function { name: 'restoreContext' },
    replace: Function { name: 'replace' },
    replaceGetter: Function { name: 'replaceGetter' },
    replaceSetter: Function { name: 'replaceSetter' },
    spy: Function { name: 'spy' },
    stub: Function { name: 'stub' },
    fake: Function {
      returns: Function { name: '' },
      throws: Function { name: '' },
      resolves: Function { name: '' },
      rejects: Function { name: '' },
      usingPromise: Function { name: '' },
      yields: Function { name: '' },
      yieldsAsync: Function { name: '' },
      name: 'fake'
    },
    useFakeTimers: Function { name: 'useFakeTimers' },
    verify: Function { name: 'verify' },
    verifyAndRestore: Function { name: 'verifyAndRestore' },
    useFakeServer: Function { name: 'useFakeServer' },
    useFakeXMLHttpRequest: Function { name: 'useFakeXMLHttpRequest' },
    usingPromise: Function { name: 'usingPromise' }
  },
  _address: '127.0.0.1',
  _listenPort: 0,
  NodeTestHelper: Function { name: 'NodeTestHelper' }
} to have property credentials
      at Assertion.fail (node_modules/should/cjs/should.js:275:17)
      at Assertion.value [as property] (node_modules/should/cjs/should.js:356:19)
      at Context.<anonymous> (test/_spec.js:8:24)
      at process.processImmediate (node:internal/timers:504:21)

  2) add custom settings on init
       should merge custom settings with RED.settings defaults:
     TypeError: Cannot read properties of undefined (reading 'should')
      at Context.<anonymous> (test/settings_spec.js:12:22)
      at process.processImmediate (node:internal/timers:504:21)

  3) helper.settings() usage
       should return a settings Object:
     AssertionError: expected undefined to exist
      at Context.<anonymous> (test/settings_spec.js:21:14)
      at process.processImmediate (node:internal/timers:504:21)

  4) helper.settings() usage
       should not maintain settings state across multiple invocations:
     TypeError: Cannot read properties of undefined (reading 'settings')
      at NodeTestHelper.settings (index.js:190:58)
      at Context.<anonymous> (test/settings_spec.js:25:14)
      at process.processImmediate (node:internal/timers:504:21)

[dceejay]

I don't think we want to pin this to Node-RED v4

[hlovdal]

That is a fair point however I chose the node-red version that would be picked by tools in any case, and there really is no v5.x specific functionality here at all in this repo (that there most likely ought to be is a different case).

But v4.x scheduled for EOL so this is something to think of.