chore(deps): bump nock from 13.5.4 to 14.0.17 - #981
Conversation
Bumps [nock](https://github.com/nock/nock) from 13.5.4 to 14.0.17. - [Release notes](https://github.com/nock/nock/releases) - [Changelog](https://github.com/nock/nock/blob/main/CHANGELOG.md) - [Commits](nock/nock@v13.5.4...v14.0.17) --- updated-dependencies: - dependency-name: nock dependency-version: 14.0.17 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
![ev-vaultkeeper[bot]](https://avatars.githubusercontent.com/u/47702631?s=60&v=4){kind=small}
There was a problem hiding this comment.
Dependabot review: nock 13.5.4 -> 14.0.17
Verdict: safe to merge. ✅
Usage in this repo
I searched the entire tree (and git history). nock is declared as a dev dependency in two places — the root package.json and packages/browser/package.json (both via the shared catalog: entry in pnpm-workspace.yaml) — but it is not imported or referenced by any source or test file. There is no import nock / require('nock') / nock(...) anywhere in the codebase. The browser package's tests do their HTTP mocking with msw (msw, msw/node setupServer), not nock. In short, nock is an orphaned/unused dev dependency.
Breaking changes in nock 14 (major)
nock 14 was rewritten on top of @mswjs/interceptors, drops the debug dependency, and raises its Node engine floor to >=18.20.0 <20 || >=20.12.1. None of the breaking API/behaviour changes matter here because nock is never invoked. The repo targets Node 24 (.nvmrc, packages/browser engines: ~24), which satisfies the new floor.
Security / supply chain
- nock 14 pulls in
@mswjs/interceptors@0.41.9. That exact version is already in the dependency tree viamsw, so this bump introduces no new distinct transitive dependency. - nock is dev-only and is not listed in any published package's
dependencies, so it never ships to consumers. - The PR's
Socket SecurityandCodeQLchecks pass.
Build & tests
pnpm install --frozen-lockfileresolves cleanly andpnpm buildsucceeds (exit 0). No source changes were needed.- CI on this PR is green for the relevant jobs:
lint-and-test / Lint and Test, alle2e-testshards,CodeQL, andSocket Security(only the unrelated native iOS/Android example builds were still in progress).
No code changes required.
Bumps nock from 13.5.4 to 14.0.17.
Release notes
Sourced from nock's releases.
... (truncated)
Commits
1ee467cfix: remove interceptor from scope.interceptors on nock.removeInterceptor (#2...da20f4bchore(deps): bump actions/checkout from 6 to 7 (#2987)2d68e8afix: guard against AbortSignal-aborted requests in response handler (#2977)de5450cfix: Revert "fix(backport): apply body delay before the response end" (#2973)215cd2afix(backport): apply body delay before the response end (#2969)07fbfabfix(types): align Definition with runtime; add rawHeaders, drop headers (#2955)fe2c3eachore(deps-dev): bump lodash-es from 4.17.23 to 4.18.1 (#2961)ee49b4fchore(deps-dev): bump flatted from 3.2.5 to 3.4.211bf183chore(deps-dev): bump undici from 6.23.0 to 6.24.1 (#2954)6b80154chore(deps-dev): bump handlebars from 4.7.8 to 4.7.9 (#2960)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for nock since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)