Modernize dependencies and fix vulnerabilities

.all-contributorsrc

@@ -3,9 +3,7 @@
   "projectOwner": "openapi-library",
   "repoType": "github",
   "repoHost": "https://github.com",
-  "files": [
-    "README.md"
-  ],
+  "files": ["README.md"],
   "imageSize": 100,
   "commit": true,
   "commitConvention": "angular",
@@ -15,108 +13,77 @@
       "name": "Richard Waller",
       "avatar_url": "https://avatars1.githubusercontent.com/u/18170169?v=4",
       "profile": "https://github.com/rwalle61",
-      "contributions": [
-        "maintenance",
-        "code",
-        "doc",
-        "review"
-      ]
+      "contributions": ["maintenance", "code", "doc", "review"]
     },
     {
       "login": "JonnySpruce",
       "name": "Jonny Spruce",
       "avatar_url": "https://avatars3.githubusercontent.com/u/30812276?v=4",
       "profile": "https://github.com/JonnySpruce",
-      "contributions": [
-        "code",
-        "doc",
-        "review"
-      ]
+      "contributions": ["code", "doc", "review"]
     },
     {
       "login": "AlexDobeck",
       "name": "Alex Dobeck",
       "avatar_url": "https://avatars2.githubusercontent.com/u/10519388?v=4",
       "profile": "https://github.com/AlexDobeck",
-      "contributions": [
-        "code",
-        "bug"
-      ]
+      "contributions": ["code", "bug"]
     },
     {
       "login": "BenGu3",
       "name": "Ben Guthrie",
       "avatar_url": "https://avatars2.githubusercontent.com/u/7105857?v=4",
       "profile": "https://github.com/BenGu3",
-      "contributions": [
-        "code",
-        "bug"
-      ]
+      "contributions": ["code", "bug"]
     },
     {
       "login": "mvegter",
       "name": "Martijn Vegter",
       "avatar_url": "https://avatars3.githubusercontent.com/u/25134477?v=4",
       "profile": "https://martijnvegter.com/",
-      "contributions": [
-        "code"
-      ]
+      "contributions": ["code"]
     },
     {
       "login": "ludeknovy",
       "name": "Ludek",
       "avatar_url": "https://avatars1.githubusercontent.com/u/13610612?v=4",
       "profile": "https://github.com/ludeknovy",
-      "contributions": [
-        "code",
-        "bug"
-      ]
+      "contributions": ["code", "bug"]
     },
     {
       "login": "tgiardina",
       "name": "Tommy Giardina",
       "avatar_url": "https://avatars1.githubusercontent.com/u/37459104?v=4",
       "profile": "https://github.com/tgiardina",
-      "contributions": [
-        "code",
-        "bug"
-      ]
+      "contributions": ["code", "bug"]
     },
     {
       "login": "Xotabu4",
       "name": "Oleksandr Khotemskyi",
       "avatar_url": "https://avatars3.githubusercontent.com/u/3033972?v=4",
       "profile": "https://xotabu4.github.io/",
-      "contributions": [
-        "doc"
-      ]
+      "contributions": ["doc"]
     },
     {
       "login": "amitkeinan9",
       "name": "Amit Keinan",
       "avatar_url": "https://avatars.githubusercontent.com/u/16577335?v=4",
       "profile": "https://github.com/amitkeinan9",
-      "contributions": [
-        "code"
-      ]
+      "contributions": ["code"]
     },
     {
       "login": "kristofferkarlsson93",
       "name": "Kristoffer Karlsson",
       "avatar_url": "https://avatars.githubusercontent.com/u/20490202?v=4",
       "profile": "http://karlssonkristoffer.com/",
-      "contributions": [
-        "doc"
-      ]
+      "contributions": ["doc"]
     },
     {
       "login": "DetachHead",
       "name": "DetachHead",
       "avatar_url": "https://avatars.githubusercontent.com/u/57028336?v=4",
       "profile": "https://github.com/DetachHead",
-      "contributions": [
-        "bug"
-      ]
+      "contributions": ["bug"]
     }
   ],
   "contributorsPerLine": 7,

.eslintrc.yml

@@ -24,5 +24,13 @@ rules:
   require-await: error
   '@typescript-eslint/no-use-before-define': off
 
+overrides:
+  - files:
+      - '*.config.ts'
+    rules:
+      import/no-extraneous-dependencies:
+        - error
+        - devDependencies: true
+
 ignorePatterns:
   - dist

.github/ISSUE_TEMPLATE/bug_report.md

@@ -4,19 +4,16 @@ about: Report a reproducible bug
 title: ''
 labels: bug
 assignees: ''
-
 ---
 
 **Are you using jest or chai**?
 
-
 **Are you using OpenAPI 2, 3.0.X, or 3.1.0?**
 
-
 **Describe the bug clearly**
 
-
 **Steps to reproduce the bug:**
+
 1. ...
 2. ...
 3. See error (please paste error output or a screenshot)
@@ -25,5 +22,4 @@ assignees: ''
 
 **What did you expect to happen instead?**
 
-
 **Are you going to resolve the issue?**

.github/ISSUE_TEMPLATE/feature_request.md

@@ -4,22 +4,16 @@ about: Suggest an idea for this project
 title: ''
 labels: enhancement
 assignees: ''
-
 ---
 
 **Are you using OpenAPI 2, 3.0.X, or 3.1.0?**
 
-
 **Would this solve a problem or make something easier?**
 
-
 **What would you like to happen?**
 
-
 **Describe alternatives you've considered**
 
-
 **Additional context or screenshots**
 
-
 **Are you going to resolve the issue?**

.github/dependabot.yml

@@ -0,0 +1,15 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: 'npm' # See documentation for possible values
+    directory: '/' # Location of package manifests
+    schedule:
+      interval: 'weekly'
+  - package-ecosystem: 'github-actions' # See documentation for possible values
+    directory: '/' # Location of package manifests
+    schedule:
+      interval: 'weekly'

.github/workflows/ci.yml

@@ -1,5 +1,8 @@
 name: CI
 
+permissions:
+  contents: read
+
 on:
   push:
     paths-ignore:
@@ -15,16 +18,17 @@ jobs:
   Test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v6
 
-      - uses: actions/setup-node@v2.1.5
+      - uses: actions/setup-node@v6
         with:
-          node-version: 12
+          node-version: 20
+
+      - run: corepack enable
 
-      - name: Use yarn cache
-        uses: c-hive/gha-yarn-cache@v1
+      - run: yarn --version
 
-      - run: yarn install --frozen-lockfile
+      - run: yarn install --immutable
 
       - run: yarn test:ci
 

.github/workflows/publish-npm.yml

@@ -0,0 +1,73 @@
+name: Publish to npm
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: publish-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Enable Corepack
+        run: corepack enable
+
+      - name: Install dependencies (workspaces)
+        run: yarn install --immutable
+
+      - name: Build all packages
+        run: yarn build
+
+      - name: Assert tag matches package versions
+        run: |
+          export TAG="${GITHUB_REF_NAME#v}"
+          node -e "
+            const fs = require('fs');
+            const pkgs = [
+              'packages/openapi-validator/package.json',
+              'packages/jest-openapi/package.json',
+              'packages/chai-openapi-response-validator/package.json',
+            ];
+            for (const p of pkgs) {
+              const v = JSON.parse(fs.readFileSync(p, 'utf8')).version;
+              if (v !== process.env.TAG) {
+                console.error(p + ' version ' + v + ' does not match tag ' + process.env.TAG);
+                process.exit(1);
+              }
+            }
+          "
+
+      - name: Publish @${{ github.repository_owner }}/openapi-validator
+        working-directory: packages/openapi-validator
+        run: npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Publish @${{ github.repository_owner }}/jest-openapi
+        working-directory: packages/jest-openapi
+        run: npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Publish @${{ github.repository_owner }}/chai-openapi-response-validator
+        working-directory: packages/chai-openapi-response-validator
+        run: npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.gitignore

@@ -4,3 +4,9 @@ coverage/
 packages/**/commonTestResources
 .DS_STORE
 dist
+
+# Yarn Berry
+.yarn/cache
+.yarn/unplugged
+.yarn/build-state.yml
+.yarn/install-state.gz

.vscode/launch.json

@@ -9,11 +9,15 @@
       "type": "node",
       "request": "launch",
       "name": "Test chai-openapi-response-validator (Mocha)",
-      "program": "${workspaceFolder}/node_modules/ts-mocha/bin/ts-mocha",
+      "program": "${workspaceFolder}/node_modules/mocha/bin/mocha.js",
       "args": [
         "--timeout",
         "999999", // timeout length. Required since while debugging we may pause for longer than Mocha's test timeout
         "--colors",
+        "--require",
+        "ts-node/register",
+        "--extension",
+        "ts",
         "${workspaceFolder}/packages/chai-openapi-response-validator/test",
         "--recursive",
         "--exit",

.yarnrc.yml

@@ -0,0 +1 @@
+nodeLinker: node-modules

CONTRIBUTING.md

@@ -62,6 +62,13 @@ git checkout -b <topic-branch-name>
 
 ### 4. Test that your code works
 
+Before running any commands, ensure you have [Corepack](https://yarnpkg.com/corepack) enabled so the pinned Yarn version is used automatically:
+
+```bash
+corepack enable
+yarn install
+```
+
 To test changes to a particular package, you can run these from within the `package/<packageName>` dir (e.g. `package/jest-openapi`):
 
 ```bash