Fix ejs and cipher-base CVEs; remove unused browserify/babelify

[dwertheimer]

Summary

Replaces bot PRs #755 and #754, which added ejs and cipher-base as new direct dependencies to force a version bump. Neither package is actually used anywhere in our own source — both are transitive dependencies of dev tooling:

• ejs — pulled in by @codedungeon/gunner → @codedungeon/utils (our npc CLI tooling)
• cipher-base — pulled in by browserify → crypto-browserify → create-hash/create-hmac

Worse, #755's fix didn't even work: adding ejs: ^3.1.7 as a direct dependency only bumped the top-level hoisted copy. The actually-flagged nested copy at @codedungeon/utils/node_modules/ejs@2.6.1 was left untouched because npm couldn't dedupe across that package's pinned range.

What ejs is actually used for

Our real EJS template engine, used by np.Templating, is a hand-vendored/browserified bundle at np.Templating/lib/support/ejs.js (embeds version 3.1.6) — completely separate from node_modules/ejs, and untouched by either bot PR. Nothing in our own code ever does require('ejs').

The npm ejs package only enters the tree via @codedungeon/gunner's dependency @codedungeon/utils, which exposes a generic utils.render(template, data) helper wrapping ejs.render(). Gunner's own template scaffolding (template.js, template-eta.js) actually uses Mustache and eta, not ejs — and neither gunner nor any of our own CLI code ever calls utils.render(). So the ejs code path is fully dead in our dependency tree; it just can't be deleted outright because @codedungeon/utils's module does an unconditional require('ejs') at load time; removing the package would break require('@codedungeon/gunner') itself. An overrides entry patches the version everywhere without needing to touch that.

CVE-2022-29078 also requires outputFunctionName to be set from user input when calling ejs.render() — we never set that option anywhere, so it wasn't reachable through our actual usage regardless of version.

Do we need gunner?

Yes — it's not a peripheral dependency, it's the framework running the whole npc/noteplan-cli tool. index.js builds the CLI off gunner's CLI class, and every command module (PluginCreate, PluginDevelop, PluginTest, PluginRelease, PluginPullRequest, plus their support/ helpers — 18 files total) pulls colors, helpers, print, path, filesystem, system, strings, and interactive prompts straight from gunner's toolbox. Dropping it would mean rewriting the dev CLI's arg parsing, prompts, and colored output from scratch.

browserify/babelify — actually removed

Unlike ejs, browserify had no reason to still be here at all: it's not required by any other package in the tree (an orphaned root dependency), not invoked by any of our scripts (scripts/rollup.js handles all bundling now), and not referenced anywhere in our own code. git log -S'"browserify"' package.json traces it back to a 2023 React-in-webview experiment (dwertheimer.React) that predates the project's move to Rollup. babelify is a browserify-only Babel transform, so it was dead weight without browserify too.

Removed both outright. This drops the crypto-browserify → create-hash/create-hmac → cipher-base chain from the tree entirely — so the cipher-base override is no longer needed either; the package isn't installed at all now, not just pinned to a patched version.

Fix

• Added an overrides block to package.json:

  "overrides": {
    "ejs": "^3.1.7"
  }

  This forces every remaining copy of ejs in the tree to a patched version (resolves to 3.1.10) without adding an unused package to our direct dependency list.
• Removed browserify and babelify from dependencies entirely, which also removes cipher-base from the tree (no override needed for it anymore).

Verification

• npm install --legacy-peer-deps resolves cleanly (matches CI's install flags)
• Confirmed single deduped copy of ejs post-install (3.1.10), no leftover nested vulnerable copies
• Confirmed browserify, babelify, crypto-browserify, and cipher-base are fully absent from package-lock.json after removal
• Full np.Templating test suite passes (65 suites, 1270 tests)
• npc CLI (the actual consumer of the ejs/@codedungeon chain) still runs
• scripts/rollup.js (the project's actual bundler) still runs

🤖 Generated with Claude Code