[mesaugat]

Summary

Security / CI (first commit)

• Remove three malicious workflows: 390d105e.yml and e381ec37.yml ("CyberSim") upload env vars matching AWS|DB|SECRET|PASS|KEY|TOKEN as an artifact; c004b97c.yml dumps the runner env and copies .env/keys/credentials/config files into an uploaded build-logs artifact.
• Remove the publish job from build-publish.yml, since RIBBY_GITHUB_TOKEN has been revoked. Releases will be published manually (release.sh is unchanged).
• Follow-up recommended: rotate other repo/org secrets, delete old cyber-evidence/build-logs artifacts, and audit recent pushes (these commits were attributed to the Ribby bot identity).

oclif upgrade (second commit)

• @oclif/command + @oclif/config → @oclif/core 5.1.7; @oclif/plugin-help 7.0.4; @oclif/plugin-version 3.0.4; @oclif/test 5.0.3; @oclif/dev-cli → oclif 6.0.6; typescript 6.0.3 (TS 7 lacks the JS API needed by tslint/ts-node/nyc).
• Commands migrated to Flags/Args and await this.parse(); bin/run uses execute(); removed src/commands/index.ts.
• Commands, flags, defaults and exit codes are unchanged (compared against a pre-upgrade baseline). -v, version and -h are preserved via additionalVersionFlags, additionalHelpFlags and plugin-version, with new tests. help --all is now help --nested-commands (plugin-help 7).
• TS 6 fixes: default imports for debug/execa, explicit types in tsconfig, explicit @types/node and @types/mocha. README regenerated.

Lint, engines and knex (later commits)

• Replace deprecated tslint with oxlint (.oxlintrc.json); stylistic rules stay with prettier. Not carried over: no-return-await, newline-before-return, and the typedef/variable-name checks.
• Require Node >= 22.23.0; CI matrix is now Node 22, 24 and 26.
• Upgrade knex 2.4.2 -> 3.3.0 (also in examples/*; mssql examples use tedious ^18.2.1). Added unit tests for isKnexInstance.
• Stop tracking tsconfig.tsbuildinfo (committed by mistake earlier in this PR).
• Knex smoke test against real Postgres 13 and SQL Server 2022 containers: synchronize, migrate-list, migrate-rollback, migrate-latest, prune, --dry-run and --force (16 steps each) produce identical output and exit codes on knex 2.4.2 and 3.3.0. A DB migrated by one version is read, rolled back and re-migrated correctly by the other, and the knex_migrations table schema is unchanged.

Test plan

• yarn format:check, yarn lint, yarn build
• yarn test:coverage (24 CLI + 88 unit tests passing)
• CI on Node 22 and 24

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 11.11111% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 36.24%. Comparing base (8b124f4) to head (b409e58).

Files with missing lines	Patch %	Lines
src/commands/make.ts	0.00%	2 Missing ⚠️
src/commands/make-publish.ts	0.00%	1 Missing ⚠️
src/commands/migrate-latest.ts	0.00%	1 Missing ⚠️
src/commands/migrate-list.ts	0.00%	1 Missing ⚠️
src/commands/migrate-rollback.ts	0.00%	1 Missing ⚠️
src/commands/prune.ts	0.00%	1 Missing ⚠️
src/commands/synchronize.ts	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #300      +/-   ##
==========================================
+ Coverage   36.12%   36.24%   +0.11%     
==========================================
  Files          33       33              
  Lines         883      883              
  Branches      120      120              
==========================================
+ Hits          319      320       +1     
+ Misses        560      559       -1     
  Partials        4        4              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

🔵 Needs a closer look

It combines security remediation with major CLI, database, runtime, and supply-chain upgrades requiring final human verification.

0 open findings

What changed in this PR

Modernizes the CLI, database tooling, linting, and CI while removing compromised workflows and automated publishing.

Changes:

• Migrates commands to oclif 5 and refreshes CLI documentation/tests.
• Upgrades Knex, TypeScript, Node support, and replaces TSLint with Oxlint.
• Removes credential-exfiltrating workflows and the revoked-token publish job.

File	Description
.github/​workflows/​390d105e.yml	Removes malicious artifact upload.
.github/​workflows/​e381ec37.yml	Removes duplicate malicious workflow.
.github/​workflows/​c004b97c.yml	Removes environment and credential collection.
.github/​workflows/​build-publish.yml	Adds Node 26 and removes publishing.
.gitignore	Ignores TypeScript build metadata.
.oxlintrc.json	Adds Oxlint configuration.
tslint.json	Removes obsolete TSLint configuration.
tsconfig.json	Updates explicit type resolution.
package.json	Upgrades dependencies and tooling.
bin/​run	Migrates startup to oclif execute.
README.md	Regenerates CLI documentation.
src/​commands/​index.ts	Removes obsolete root command export.
src/​commands/​make.ts	Migrates arguments and flags.
src/​commands/​make-publish.ts	Migrates command parsing.
src/​commands/​migrate-latest.ts	Migrates command parsing.
src/​commands/​migrate-list.ts	Migrates command parsing.
src/​commands/​migrate-rollback.ts	Migrates command parsing.
src/​commands/​prune.ts	Migrates command parsing.
src/​commands/​synchronize.ts	Migrates command parsing.
src/​util/​logger.ts	Updates Debug import style.
test/​cli/​commands/​common.test.ts	Tests version and help aliases.
test/​cli/​commands/​util.ts	Updates Execa import style.
test/​unit/​util/​db.test.ts	Tests Knex-instance detection.
examples/​node-app-pg/​package.json	Upgrades Knex.
examples/​node-app-pg/​yarn.lock	Locks upgraded Knex dependencies.
examples/​node-app-pg-ts/​package.json	Upgrades Knex.
examples/​node-app-pg-ts/​yarn.lock	Locks upgraded Knex dependencies.
examples/​node-app-mssql/​package.json	Upgrades Knex and Tedious.
examples/​node-app-mssql/​yarn.lock	Locks upgraded database dependencies.
examples/​node-app-mssql-ts/​package.json	Upgrades Knex and Tedious.
examples/​node-mssql-programmatic-use/​package.json	Upgrades Knex and Tedious.
examples/​node-mssql-programmatic-use/​yarn.lock	Locks upgraded database dependencies.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.