Replaces Webpack/Babel/Mocha with Vite/Vitest (#485)

.github/workflows/ci.yml

@@ -7,17 +7,32 @@ on:
   workflow_dispatch: ~
 
 jobs:
+  # build checks that the app can build and runs tests on the latest node version
   build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - run: EASYPOST_TEST_API_KEY=123 EASYPOST_PROD_API_KEY=123 make install install-styleguide build test
+  # node-compatibility checks that the build version of the app can be imported
+  # and used on older versions of node
+  node-compatibility:
     runs-on: ubuntu-latest
     strategy:
       matrix:
         node-version: [12.x, 13.x, 14.x, 15.x, 16.x, 17.x, 18.x, 19.x, 20.x, 21.x, 22.x]
     steps:
       - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - run: EASYPOST_TEST_API_KEY=123 EASYPOST_PROD_API_KEY=123 make install install-styleguide build
       - uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node-version }}
-      - run: EASYPOST_TEST_API_KEY=123 EASYPOST_PROD_API_KEY=123 make install install-styleguide build test
+      - run: EASYPOST_TEST_API_KEY=123 EASYPOST_PROD_API_KEY=123 make test-node-compatibility
   lint:
     runs-on: ubuntu-latest
     steps:

Makefile

@@ -75,6 +75,10 @@ scan:
 test:
 	npm run test
 
+## test-node-compatibility - Check the built project works for older versions of Node
+test-node-compatibility:
+	npm run test:node-compatibility
+
 ## update - Update dependencies (Unix only)
 update: | update-examples-submodule
 	npm update

audit-ci.jsonc

@@ -2,25 +2,5 @@
   "$schema": "https://github.com/IBM/audit-ci/raw/main/docs/schema.json",
   "critical": true,
   // Only fail the audit if there are critical vulnerabilities.
-  "allowlist": [
-    {
-      "GHSA-8cp3-66vr-3r4c": {
-        "active": true,
-        "expiry": "2024-10-22",
-        // Re-evaluate this vulnerability after this date.
-        "notes": "Transitive dependency of `superagent`, awaiting new `superagent` release."
-        // https://github.com/ladjs/superagent/issues/1799
-        // Vulnerability fix only available in `[email protected]+`: Please upgrade to v9.0.0+ as we have fixed a public vulnerability with formidable dependency. Note that v9.0.0+ requires Node.js v14.18.0+. See https://github.com/ladjs/superagent/pull/1800 for insight.
-      }
-    },
-    {
-      "GHSA-grv7-fg5c-xmjg|braces": {
-        "active": true,
-        "expiry": "2024-12-22", // Re-evaluate this vulnerability after this date.
-        "notes": "Transitive dependency of `chokidar` and `micromatch`"
-        // (`braces` -> `chokidar` -> `mocha`), chokidar unlikely to get patched: https://github.com/paulmillr/chokidar/issues/1301, mocha maintenance questionable: https://github.com/mochajs/mocha/issues/5027
-        // (`braces` -> `micromatch` -> `fast-glob` -> `globby` -> `typescript-eslint/typescript-estree`), micromatch is patched, but fast-glob not maintained: https://github.com/mrmlnc/fast-glob/issues/443
-      }
-    }
-  ]
+  "allowlist": []
 }