[prx-my]

What changed and why

Part of #1491 (the backlog does not go to zero here): the test type-check gate reports 113 pre-existing errors on main today, and this removes 54 of them (113 -> 59).

• tests/scanner-npm-advisory.test.ts (31 errors): type the three shared mocks (queryBatchMock, getVulnMock, queryNpmAdvisoryGapsMock) and the remediation module stubs, add the required incompletePolicy to the ParsedOptions fixture, and drop the versions/references properties that OsvVuln does not declare (they were ignored at runtime and never asserted).
• tests/local-advisory-source.test.ts (12 errors): derive the range-event type from OsvVuln instead of Record<string, string>, so the { introduced } / { fixed } / { last_affected } literals no longer widen to optional-undefined records.
• tests/scripts/pr-scan-delta.test.ts (11 errors): add scripts/pr-scan-delta.d.mts so the .mjs helper is typed; the callback parameters become contextually typed instead of implicitly any.

Only test files and one type declaration change; no runtime behaviour.

Checks

• node scripts/typecheck-changed-tests.mjs upstream/main: 2 changed test file(s) clean, no new errors. 59 pre-existing error(s) carried over.
• npx tsc -p tsconfig.test.json --noEmit: 113 -> 59 errors.
• npm test -- tests/local-advisory-source.test.ts tests/scanner-npm-advisory.test.ts tests/scripts/pr-scan-delta.test.ts: 3 suites, 58 tests passed.
• npm run lint:tests: passed.
• npm run build: clean.

Refs #1491

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

[coderabbitai]

Automatic approval withheld

Automatic approval is disabled by the configured approval policy for this pull request. Review comments and requests for changes continue normally.

Commit: 3f294073ba1e.

No actionable comments were generated in the recent review.

Summary

Summary by CodeRabbit

• Tests
  • Expanded advisory range coverage for prerelease versions, fixed versions, and inclusive upper bounds.
  • Improved test coverage for npm advisory scanning and remediation behavior.
• Documentation
  • Added TypeScript declarations for dependency-delta results and comment-rendering helpers.

The PR adds TypeScript declarations for the dependency-delta helper. It also updates advisory test types, shared options, and npm advisory fixtures.

Changes: Dependency Delta Declarations

Layer / File(s)	Summary
Dependency delta declarations scripts/pr-scan-delta.d.mts	The module declares the dependency-delta row and result types, function signatures, and marker constant.

Advisory Test Updates

Layer / File(s)	Summary
Advisory test types and fixtures tests/local-advisory-source.test.ts, tests/scanner-npm-advisory.test.ts	The tests use OSV-derived event types and typed advisory mocks. Shared options include incompletePolicy: "warn", and two npm-only fixtures omit empty versions and references fields.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Possibly related issues

• test: clear the pre-existing test type errors so the gate can require a clean tree #1491: The test changes align with the issue’s goal of reducing test type errors by typing mocks and correcting fixture fields. The issue remains only partially addressed according to the supplied summary.

Merge Risk: Minimal · previous review 40aef

The changes update test typing and helper declarations without an established runtime regression. No actionable merge-blocking issue remains; merge after normal checks pass.

Pre-merge checks: 7

Check name	Status	Explanation
Title check		The title follows the required "type: short description" form with the allowed type "test", lowercase after the colon, and no trailing period. It matches the main change, which types the npm-advisory …
Description check		The description follows the template's "What changed and why" section and explains the change clearly. It lists the affected test files, the reduction from 113 to 59 type errors, and the checks that w…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Linked Issue		I found Refs #1491 in the pull request body. The pull request references a GitHub issue as required.
Closes Keyword Matches Scope		I found no issue-closing keyword in the PR body. It uses Refs #1491, so merging will not auto-close the issue through that reference.
No New Runtime Dependency		Users get no new runtime dependency. I confirmed that the PR does not change any package.json file.

Full details: Title check

Explanation

The title follows the required "type: short description" form with the allowed type "test", lowercase after the colon, and no trailing period. It matches the main change, which types the npm-advisory test mocks and range-event helpers. The "(part of #1491)" suffix is extra context and does not affect the check.

Full details: Description check

Explanation

The description follows the template's "What changed and why" section and explains the change clearly. It lists the affected test files, the reduction from 113 to 59 type errors, and the checks that were run. The template's "Closes #" line is missing. The PR uses "Part of #1491" and "Refs #1491" instead, which is reasonable because the change only partly resolves that issue. The description is mostly complete, so the check passes.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Automatic approval policy

Commit: 3f294073ba1e.

Setting	Effective value	Source
Automatic approvals	Disabled	Override 1
Merge risk	Moderate	Global configuration
Security risk	Not set	Global configuration

Matching overrides (numbered as in the resolved configuration):

• Override 1 — any author; paths: .github/**, action.yml, package.json, package-lock.json, tsconfig*.json, jest.config.*, scripts/**; automatic approvals: disabled.

Any matching disabled override withholds approval, regardless of risk. Otherwise, the strictest explicitly set limit wins for each score. Limits omitted by all matching overrides inherit the global configuration.

Not set means no limit was configured after inheritance. Use @coderabbitai configuration to inspect the resolved settings and their sources.

Run configuration

• Source mode: Auto
• Repository: OWASP/cve-lite-cli
• Branch: main
• File: .coderabbit.yaml
• Commit: c98c080
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 22a647bc-b05e-4ffd-b9ab-0b962ca5ab89

Commits

Reviewing files that changed from the base of the PR and between c98c080 and 40aefc8.

Files selected for processing: 3

• scripts/pr-scan-delta.d.mts
• tests/local-advisory-source.test.ts
• tests/scanner-npm-advisory.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

[sonukapoor]

Thanks @prx-my. This clears 54 of the test type errors (112 on main to 58 merged), with the same number of tests and assertions in every file it touches. The two fixture tweaks don't change behaviour, and the declaration file matches what pr-scan-delta.mjs actually exports. Refs #1491 is right since the backlog isn't at zero yet.

[prx-my]

@sonukapoor gentle ping on this one. All four #1491 slices are green and waiting on a merge:

• test: type the npm-advisory mocks and range events (part of #1491) #1559 (this PR) - approved, all checks pass
• test: type the CLI, JSON-output and usage fixtures (part of #1491) #1564 - CodeRabbit approved, all checks pass
• test: complete the override context fixtures (part of #1491) #1565 - CodeRabbit approved, all checks pass
• test: clear the remaining scattered test type errors (part of #1491) #1566 - CodeRabbit change request addressed, checks running

Together they take the test type-check backlog from 112 errors to 0, with no runtime changes. Would you be able to merge them with the website-check override? Once they land I'll open the small follow-up that drops the backlog allowance from scripts/typecheck-changed-tests.mjs and updates CONTRIBUTING.md, which is the last item in #1491.

[sonukapoor]

Merged - thank you @prx-my!