[SDK-731] Bump axios to 1.20.0 and adm-zip to ^0.6.1

[devtools-agent]

Linear: SDK-731

What changed

Dependency bump (package.json):

• axios: 1.15.0 → 1.20.0 (still an exact pin, like before)
• adm-zip: ^0.5.2 → ^0.6.1

Review follow-up (changes requested: light test coverage, missing CI):

• CI (.github/workflows/node.js.yml): the matrix key was node but setup-node read matrix.node-version, so every job ran on the runner's default Node. The "Node 18" job on the first commit actually ran v22.23.2. The workflow now uses matrix.node and installs the listed npm version, following rollbar.js's ci.yml. It also moves to actions/checkout@v4 / actions/setup-node@v4, adds a lint job (npm run lint was never run in CI), sets permissions: contents: read, and lets latest fail without blocking.
• Tests for the code the bump touches:
  • test/sourcemaps/signed-url-uploader.test.js: the old zip test asserted a 22-byte zip, which is an empty archive. It passed no requester, so addFile threw and the error was swallowed. The new tests read the archive back and compare the string manifest.json and every validated map to the source files, byte for byte. They also cover unvalidated and unreadable files, a missing manifest, non-200 and throwing uploads, and dry runs. Stubs are now restored.
  • test/sourcemaps/command.test.js: new tests for the --next handler path end to end (signed-URL request → zip → axios.put), a failed signed-URL request, and a dry run. This path had no tests before.
  • test/sourcemaps.test.js: the "via signed URL" case passed --signed-url, which isn't a flag. It now passes --next. Both for (let i; …) loops never ran; they're replaced with a real assertion.
• Fix: src/sourcemaps/signed-url-uploader.js shared one module-level AdmZip, so entries carried over between uploads in the same process. The archive is now created per zipFiles() call.

Why

The bump closes all 30 open Dependabot alerts on master:

• axios, 28 alerts (11 high, 16 medium, 1 low). The fixes land in 1.15.1, 1.15.2, 1.16.0 and 1.18.0. 1.20.0 is the current latest release.
• adm-zip, 2 high alerts (GHSA-xcpc-8h2w-3j85, GHSA-7q85-xj36-vmfc): memory exhaustion when reading crafted zips. The fix is in 0.6.1. A caret range on a 0.x version never crosses a minor version, so the range itself had to change.

The CLI only creates zips (addFile, addLocalFile, toBuffer). adm-zip 0.5.16 and 0.6.1 produce byte-identical archives for the same input, including the string manifest. This supersedes Dependabot PR #30 (axios 1.15.0 → 1.18.0).

Validation

• npm test + npm run lint on Node 18.20.8 (npm 9.9.4 and 10.8.2), 20.19.2, 22.23.3, 24.21.0: 46 passing, 1 pending (the existing skip), lint clean. Before this PR: 36 passing.
• Coverage: signed-url-uploader.js 85% → 94% lines (62.5% → 87.5% branches); sourcemaps/command.js 71% → 100%.
• Full suite also passes with adm-zip@0.5.16 swapped in, so the tests don't depend on 0.6-only behaviour.
• Mutation check: putting the module-level AdmZip back makes 4 of the new tests fail.
• npm audit --omit=dev: 0 vulnerabilities.

Follow-ups (not in this PR)

• Signed-URL (--next) uploads drop maps that aren't in the root of the target path. scanner.js sets file.mappedFile = path.join(this.targetPath, mapPath), not relative to the JS file's own directory (which loadMapData does use). For a CRA build (static/js/*.map) nothing but manifest.json gets zipped, and the CLI still prints "Zipped all the source map files successfully". The new tests use the angular9 fixture, whose maps sit at the root. Fixing it changes what gets uploaded, so it deserves its own PR.
• Merging clears the alerts on master only. The latest npm release is still 0.2.1 (Jan 2022, axios ^0.24.0), so users get the fix once a 0.2.2 is published.

🤖 Generated with Claude Code

[linear-code]

SDK-731

[rollbar-circleci-machine]

AI Agent Review (openai, openai-astra)

Review: bump axios 1.15.0 → 1.20.0 and adm-zip ^0.5.2 → ^0.6.1

The diff changes two lines, both in package.json (package.json:13-14). It keeps the existing style: axios stays pinned to an exact version and adm-zip keeps a caret range. For a 0.x package, ^0.6.1 only allows 0.6.x patch releases.

What uses these libraries (read in the checkout):

• axios: src/common/rollbar-api.js:16-32 builds an instance with axios.create and uses validateStatus, maxContentLength and maxBodyLength. It calls .post/.patch at :40, :43, :59 and :74, and sends a form-data buffer with manual multipart headers at :74-81. src/sourcemaps/signed-url-uploader.js:62 calls axios.put on the default export.
• adm-zip: src/sourcemaps/signed-url-uploader.js:3-5,25,32,39 uses only new AdmZip(), addFile(name, data), addLocalFile(path) and toBuffer(). addFile is passed a string (the JSON from src/sourcemaps/requester.js:57-58), not a Buffer.

Why there are no inline findings: Neither version can be checked here. There's no lockfile and no node_modules, and the dependency fact sheet only resolves axios==1.20.0 (package.json:14). So I can't say whether these APIs, adm-zip 0.6's handling of string content in addFile, or either package's engines range changed. Per the review rules, I'm not flagging anything that depends on library internals I can't see.

Suggested checks before merging (not blockers):

• adm-zip goes up a 0.x minor version, which semver allows to be breaking. The current tests barely exercise it: test/sourcemaps/signed-url-uploader.test.js:37-42 builds the uploader with no requester, so addFile('manifest.json', ...) throws and the error is swallowed (signed-url-uploader.js:24-28). The test then only checks that the result is a 22-byte empty zip. The path that adds real files and the string-manifest path are both untested. A manual rollbar-cli signed-URL sourcemap upload, or a test with a real Requester and validated files, would show whether 0.6.x still produces a correct archive.
• Check that axios 1.20.0 and adm-zip 0.6.x still support the oldest Node version you care about. package.json has no engines field.

Pre-existing issues outside this diff (not findings):

• The CI matrix doesn't run the Node versions it lists. .github/workflows/node.js.yml:18-28 defines node/npm keys, but :32-35 reads ${{ matrix.node-version }}, which is always empty. Every job runs the runner's default Node, so a green CI run here says nothing about Node 18–24 support for these upgrades.
• src/sourcemaps/signed-url-uploader.js:5 creates one module-level AdmZip instance that every SignedUrlUploader shares. Entries pile up across uploads in the same process.

This diff doesn't show that tests passed.

[brianr]

The review found some code quality issues - light test coverage, missing CI. Let's get those fixed as part of this PR.