Skip to content

Conversation

@jimmyfagan
Copy link
Contributor

@jimmyfagan jimmyfagan commented Jan 20, 2026

JIRA Ticket:
BB2-4361

What Does This PR Do?

Removes an unused dependency (which had a sub-dependency of inflight, and added an override for inflight since it was subdependency of another library which wasn't clear how to trivially remove/replace.

What Should Reviewers Watch For?

If you're reviewing this PR, please check for these things in particular:

  • I'm not too familiar with Node, does the override make sense, and does that actually resolve the vulnerability? It seems like it does, but I'm worried I'm being naive.

Validation

Run yarn test to test the sdk in isolation. Follow steps at https://github.com/CMSgov/cms-bb2-node-sdk/blob/0c19361e16e664df033a8ef56cdad8b0f51066b8/README-sdk-dev.md#:~:text=Consuming%20from%20the%20sample%20client to run a local sample client with this version of the SDK and confirm that everything works as expected.

What Security Implications Does This PR Have?

Please indicate if this PR does any of the following:

  • Adds any new software dependencies
  • Modifies any security controls
  • Adds new transmission or storage of data
  • Any other changes that could possibly affect security?
  • Yes, one or more of the above security implications apply. This PR must not be merged without the ISSO or team security engineer's approval.

@jimmyfagan jimmyfagan marked this pull request as ready for review January 22, 2026 14:38
Copy link
Contributor

@bwang-icf bwang-icf left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was able to locally verify that things work as expected and from this stack overflow answer (https://stackoverflow.com/questions/15806152/how-do-i-override-nested-npm-dependency-versions) it seems that this is the right way for overrides to be handled.

@bwang-icf bwang-icf merged commit 04dd151 into main Jan 22, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants