[Snyk] Upgrade mocha from 9.2.2 to 11.0.1

[nerdy-tech-com-gitub]

Snyk has created this PR to upgrade mocha from 9.2.2 to 11.0.1.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

• The recommended version is 19 versions ahead of your current version.

• The recommended version was released a month ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Regular Expression Denial of Service (ReDoS) SNYK-JS-MOCHA-2863123	154	No Known Exploit
	Improper Input Validation SNYK-JS-NANOID-8492085	154	No Known Exploit
	Cross-site Scripting (XSS) SNYK-JS-SERIALIZEJAVASCRIPT-6147607	154	Proof of Concept

Release notes

Package name: mocha

• 11.0.1 - 2024-12-02
  

  11.0.1 (2024-12-02)

  🌟 Features

  • bumped glob dependency from 8 to 10 (#5250) (43c3157)

  📚 Documentation

  • fix examples for linkPartialObjects methods (#5255) (34e0e52)
• 11.0.0 - 2024-11-11
  

  11.0.0 (2024-11-11)

  ⚠ BREAKING CHANGES

  • adapt new engine range for Mocha 11 (#5216)

  🌟 Features

  • allow calling hook methods (#5231) (e3da641)

  🩹 Fixes

  • adapt new engine range for Mocha 11 (#5216) (80da25a)

  📚 Documentation

  • downgrade example/tests chai to 4.5.0 (#5245) (eac87e1)
• 11.0.0-beta - 2024-11-23
• 10.8.2 - 2024-10-30
  

  10.8.2 (2024-10-30)

  🩹 Fixes

  • support errors with circular dependencies in object values with --parallel (#5212) (ba0fefe)
  • test link in html reporter (#5224) (f054acc)

  📚 Documentation

  • indicate 'exports' interface does not work in browsers (#5181) (14e640e)

  🧹 Chores

  • fix docs builds by re-adding eleventy and ignoring gitignore again (#5240) (881e3b0)

  🤖 Automation

  • deps: bump the github-actions group with 1 update (#5132) (e536ab2)
• 10.8.1 - 2024-10-29
  

  10.8.1 (2024-10-29)

  🩹 Fixes

  • handle case of invalid package.json with no explicit config (#5198) (f72bc17)
  • Typos on mochajs.org (#5237) (d8ca270)
  • use accurate test links in HTML reporter (#5228) (68803b6)
• 10.8.0 - 2024-10-29
  

  10.8.0 (2024-10-29)

  🌟 Features

  • highlight browser failures (#5222) (8ff4845)

  🩹 Fixes

  • remove :is() from mocha.css to support older browsers (#5225) (#5227) (0a24b58)

  📚 Documentation

  • add SECURITY.md pointing to Tidelift (#5210) (bd7e63a)
  • adopt Collective Funds Guidelines 0.1 (#5199) (2b03d86)
  • update README, LICENSE and fix outdated (#5197) (1203e0e)

  🧹 Chores

  • fix npm scripts on windows (#5219) (1173da0)
  • remove trailing whitespace in SECURITY.md (7563e59)
• 10.7.3 - 2024-08-09
  

  10.7.3 (2024-08-09)

  🩹 Fixes

  • make release-please build work (#5194) (afd66ef)
• 10.7.0 - 2024-07-20
  

  What's Changed

  • feat: add option to not fail on failing test suite by @ ilgonmic in #4771

  New Contributors

  • @ ilgonmic made their first contribution in #4771

  Full Changelog: v10.6.1...v10.7.0

• 10.6.1 - 2024-07-20
  

  What's Changed

  • fix: do not exit when only unref'd timer is present in test code by @ boneskull in #3825
  • fix: support canonical module by @ JacobLey in #5040

  Full Changelog: v10.6.0...v10.6.1

• 10.6.0 - 2024-07-02
• 10.5.2 - 2024-06-26
• 10.5.1 - 2024-06-25
• 10.5.0 - 2024-06-24
• 10.4.0 - 2024-03-26
• 10.3.0 - 2024-02-08
• 10.3.0-preminor.0 - 2024-01-30
• 10.2.0 - 2022-12-11
• 10.1.0 - 2022-10-15
• 10.0.0 - 2022-05-01
• 9.2.2 - 2022-03-11

from mocha GitHub release notes

---

Important

• Warning: This PR contains a major version upgrade, and may be a breaking change.
• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Summary by Sourcery

Upgrade Mocha from 9.2.2 to 11.0.1.

Bug Fixes:

• Fix a Regular Expression Denial of Service (ReDoS) vulnerability in Mocha.
• Fix an Improper Input Validation vulnerability.
• Fix a Cross-site Scripting (XSS) vulnerability.

Enhancements:

• Update glob dependency from 8 to 10.
• Adapt new engine range for Mocha 11.
• Allow calling hook methods.
• Support errors with circular dependencies in object values with --parallel.
• Handle case of invalid package.json with no explicit config.
• Highlight browser failures.
• Remove :is() from mocha.css to support older browsers.
• Add option to not fail on failing test suite.
• Support canonical module.
• Do not exit when only unref'd timer is present in test code.
• Make release-please build work.

Tests:

• Fix examples for linkPartialObjects methods.
• Downgrade example/tests chai to 4.5.0.
• Test link in html reporter.
• Use accurate test links in HTML reporter.
• Fix npm scripts on windows.

[sourcery-ai]

Reviewer's Guide by Sourcery

This pull request upgrades mocha from version 9.2.2 to 11.0.1. This addresses several security vulnerabilities, including a ReDoS vulnerability in mocha, improper input validation in nanoid, and an XSS vulnerability in serialize-javascript. The upgrade also includes several feature enhancements and bug fixes, such as improved browser failure highlighting and support for canonical modules. Note that this is a major version upgrade and may introduce breaking changes.

State diagram for mocha version upgrade

stateDiagram-v2
    [*] --> v9.2.2: Initial State
    v9.2.2 --> v10.x: Major Version Upgrade
    v10.x --> v11.0.1: Major Version Upgrade

    state v9.2.2 {
        [*] --> Vulnerable
        Vulnerable: Has Security Issues
        Vulnerable: - ReDoS
        Vulnerable: - Input Validation
        Vulnerable: - XSS
    }

    state v11.0.1 {
        [*] --> Secure
        Secure: Security Fixed
        Secure: + Node.js Engine Updates
        Secure: + New Features
        Secure: + Bug Fixes
    }

Loading

File-Level Changes

Change	Details	Files
Upgrade mocha dependency	Updated the mocha dependency from version 9.2.2 to 11.0.1.	deps/cjs-module-lexer/package.json

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time. You can also use
  this command to specify where the summary should be inserted.

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

We have skipped reviewing this pull request. Here's why:

• It seems to have been created by a bot ('[Snyk]' found in title). We assume it knows what it's doing!
• We don't review packaging changes - Let us know if you'd like us to change this.