[botandbang]

Fixes four bugs the new coverage tests turned up.

core: releases without files. A release in index.json with no files key crashed core with Cannot convert undefined or null to object, because files.available fell back to undefined and the links loop called Object.keys on it. It now falls back to [], so the release gets available: [] and empty links. Adds core/test/files.js.

parsefiles: source tarballs. The src case assigned files[0] twice, so the .tar.gz name was overwritten and only .tar.xz came back. It now lists both, the same way headers does. Updates test/data/expected.json. Core still depends on @nodevu/parsefiles@^0.0.3, so core's output won't change until that range is bumped.

core: now.json. updateStaticNow.js stringified the DateTime and then write() stringified it again, so the file held a quoted string inside a string. Every reader undid that with JSON.parse. The script now passes the DateTime straight to write(). The snapshot is re-encoded, and combos.js, dynamic-values.js and ranges' emptyFields.test.js read it directly.

static: undeclared dependency. The build scripts require @nodevu/core, but static's package.json never listed it, so they only worked after installing every workspace (as the nightly build does). It's now a devDependency, and npm install -w static links it.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​fast-check@​4.10.2

View full report