chore: Fix 33 vulnerabilities, replace dead gulp build, restore tests and CI

[fuzzie360]

Summary

Security remediation and modernization for a repo whose last commit was 2016-12-10. The build system was not merely stale but unrunnable, npm test failed on a clean checkout, and the resolved dependency tree carried 33 vulnerabilities that Dependabot could not see.

This does not attempt to finish the transpiler — ast_generic's commented-out node handlers are the actual unfinished work, and completing them is a feature project, not modernization. The prototype status is now documented in the README instead.

Security

Dependabot reported 0 alerts, and that was a false negative. Alerts are enabled (the API returns 200 [], and vulnerability-alerts returns 204; automated fixes are off), but the repo had no lockfile — so the dependency graph could only see the four direct ranges in package.json, and every vulnerable package was transitive and therefore invisible.

Auditing the resolved tree locally showed the real picture:

	before	after
npm audit	33 (5 critical / 24 high / 2 moderate / 2 low)	0
packages	578	101
npm ci + build	gulp build impossible; tsc emitted 9 errors	clean, exit 0
npm test	6 passing (only after a manual tsc)	10 passing

• ~27 eliminated by removing the gulp stack — gulp 3 / gulp-* / browser-sync / merge2 carried nearly all of it (an axios chain with ~23 advisories, growl command injection, immutable, debug).
• 6 required overrides, because mocha 11.7.6 is already the newest release and still resolves vulnerable transitives:
  • brace-expansion → ^5.0.8 (GHSA-mh99-v99m-4gvg, high). The 2.x line mocha reaches via minimatch has no patched release, so the major jump is the only fix. This also cleared the derived minimatch and glob alerts.
  • serialize-javascript → ^7.0.7 (GHSA-5c6j-r48x-rmvq, high RCE + GHSA-qj8w-gfj5-8c6v, moderate); mocha pins ^6.0.2.
  • diff → ^8.0.4 (GHSA-73rr-hh4g-fpgx, low); mocha pins ^7.0.0.

All three cross a major boundary for mocha, so the affected code paths were exercised directly rather than assumed: the reporter still renders assertion diffs (diff), and mocha --parallel still serializes across workers (serialize-javascript). These pins are worth revisiting if mocha later widens its own ranges rather than being left indefinitely.

Bugs fixed

Each is pinned by a test confirmed to fail against the unfixed source.

1. parse() read and wrote astConfig.retArr, but generateAstConfig() creates resArr. Result: resArr was always left empty and a stray retArr was added.
2. ast_errorOutput() built its context from ast.src, but the source lives on astConfig. Since esprima runs with range: true, every node has a range, so this branch always fired and always threw Cannot read properties of undefined (reading 'slice') — a TypeError that replaced the descriptive error the transpiler was trying to raise. The slice was independently wrong too, passing 25 as an absolute end offset rather than a length.
3. transpiler_esprima read esprima off a bare global, so requiring the package died with ReferenceError: esprima is not defined despite esprima being a declared dependency. Added resolveEsprima(); a global still takes precedence, so the browser path is unchanged.

Modernization

• Removed the gulp 3 pipeline. It was unrunnable on modern Node — ReferenceError: primordials is not defined — and its tsbuild task could never have worked anyway, since it used --out against export default code, which tsc rejects. Replaced with a plain tsc invocation.
• Upgraded esprima 3→4, TypeScript 2→5, mocha 3→11, chai 3→4. chai is deliberately held at 4.x: chai 5 is ESM-only and this harness is CommonJS.
• Fixed npm test on a clean checkout. It previously failed with Cannot find module '../bin/transpiler_base.js' — bin/ is gitignored and no script built it. Added build / prepare / pretest.
• Fixed main, which pointed at dist/gpujs-transpile.js, a bundle nothing could produce. Now bin/transpiler_esprima.js, with declarations emitted.
• Modernized tsconfig: dropped the obsolete atom-typescript filesGlob / compileOnSave keys and noResolve, added include and "types": [].
• Added CI — Node 20/22/24 matrix, plus a separate npm audit --audit-level=high job so a newly published advisory turning CI red is not mistaken for a test regression. Committed the lockfile so Dependabot can finally see the tree.
• Replaced gulp copy with npm run copy:lib, preserving the browser test page and dropping its reference to requirejs, which was never actually a dependency.

Testing

From a fresh clone of this branch: tsc exits 0, npm test → 10 passing, npm audit → 0 vulnerabilities.

Pre-existing failures, distinguished from new work:

• npm test was already broken on a clean checkout before these changes — it only passed if you manually ran tsc first.
• tsc under TypeScript 2.9 already emitted 9 errors from auto-included @types/node and @types/ws (TS1084, TS1005, TS1011). It still emitted JS because noEmitOnError was unset, so the breakage was silent. Fixed by "types": [].
• gulp was already 100% dead on modern Node.

No new failures were introduced. The 4 new tests were each confirmed to fail against the unfixed source with the exact expected symptom.

Deliberately out of scope: no transpiler rewrite, no strict TypeScript (the code is implicit-any throughout; enabling it would be a large diff with no security or compatibility benefit), no chai 5 / ESM migration, no test-runner swap.

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​esprima@​4.0.1
	npm/​chai@​4.5.0
	npm/​typescript@​5.9.3
	npm/​mocha@​11.7.6

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm yargs is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/mocha@11.7.6 → npm/yargs@17.7.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/yargs@17.7.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report