From 71c5f2f1075965621cd894533dc94fc59aa5bc21 Mon Sep 17 00:00:00 2001
From: Rich Trott <rtrott@gmail.com>
Date: Mon, 21 Sep 2026 19:16:36 -0700
Subject: [PATCH] build(deps): bump basic-auth from 2.0.1 to 3.0.0

---
 lib/auth-middleware.js            |  4 +--
 package-lock.json                 | 21 ++++----------
 package.json                      |  4 +--
 test/unit/auth-middleware.test.js | 46 +++++++++++++++++++++++++++++++
 4 files changed, 56 insertions(+), 19 deletions(-)
 create mode 100644 test/unit/auth-middleware.test.js

diff --git a/lib/auth-middleware.js b/lib/auth-middleware.js
index 81d7b550..4b99fa53 100644
--- a/lib/auth-middleware.js
+++ b/lib/auth-middleware.js
@@ -5,12 +5,12 @@
  * in the follow format: "username:password"
  */
 
-import auth from 'basic-auth'
+import { parse } from 'basic-auth'
 
 const [username, password] = (process.env.LOGIN_CREDENTIALS || '').split(':')
 
 export default function authMiddleware (req, res, next) {
-  const user = auth(req)
+  const user = parse(req.headers.authorization || '')
 
   if (user === undefined || user.name !== username || user.pass !== password) {
     res.statusCode = 401
diff --git a/package-lock.json b/package-lock.json
index 95a95b95..77e7c5f3 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -11,7 +11,7 @@
       "dependencies": {
         "@octokit/rest": "^22.0.1",
         "aigle": "^1.14.1",
-        "basic-auth": "^2.0.1",
+        "basic-auth": "^3.0.0",
         "body-parser": "^2.3.0",
         "bunyan": "^1.8.1",
         "codeowners-utils": "^1.0.2",
@@ -30,7 +30,7 @@
         "supertest": "^7.2.2"
       },
       "engines": {
-        "node": ">= 20.11.0"
+        "node": ">= 22.0.0"
       }
     },
     "node_modules/@eslint-community/eslint-utils": {
@@ -838,15 +838,12 @@
       }
     },
     "node_modules/basic-auth": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/basic-auth/-/basic-auth-2.0.1.tgz",
-      "integrity": "sha512-NF+epuEdnUYVlGuhaxbbq+dvJttwLnGY+YixlXlME5KpQ5W3CnXA5cVTneY3SPbPDRkcjMbifrwmFYcClgOZeg==",
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/basic-auth/-/basic-auth-3.0.0.tgz",
+      "integrity": "sha512-B63UKsSJ2atgiSuCJvzAjpfAdFY6mYT3C0vZFlLV/81Rw2/VCs6Tp29UzkpKETB3qA2cHwuU1LjBnhUQ0WkPKw==",
       "license": "MIT",
-      "dependencies": {
-        "safe-buffer": "5.1.2"
-      },
       "engines": {
-        "node": ">= 0.8"
+        "node": ">=22"
       }
     },
     "node_modules/before-after-hook": {
@@ -4963,12 +4960,6 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/safe-buffer": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
-      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
-      "license": "MIT"
-    },
     "node_modules/safe-json-stringify": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/safe-json-stringify/-/safe-json-stringify-1.2.0.tgz",
diff --git a/package.json b/package.json
index 4f3a8009..1a53848f 100644
--- a/package.json
+++ b/package.json
@@ -9,14 +9,14 @@
     "test:watch": "nodemon -q -x 'npm test'"
   },
   "engines": {
-    "node": ">= 20.11.0"
+    "node": ">= 22.0.0"
   },
   "private": true,
   "license": "MIT",
   "dependencies": {
     "@octokit/rest": "^22.0.1",
     "aigle": "^1.14.1",
-    "basic-auth": "^2.0.1",
+    "basic-auth": "^3.0.0",
     "body-parser": "^2.3.0",
     "bunyan": "^1.8.1",
     "codeowners-utils": "^1.0.2",
diff --git a/test/unit/auth-middleware.test.js b/test/unit/auth-middleware.test.js
new file mode 100644
index 00000000..af17fa6f
--- /dev/null
+++ b/test/unit/auth-middleware.test.js
@@ -0,0 +1,46 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+
+process.env.LOGIN_CREDENTIALS = 'admin:secret'
+const { default: authMiddleware } = await import('../../lib/auth-middleware.js')
+
+function request (authorization) {
+  return { headers: { authorization } }
+}
+
+function response () {
+  return {
+    headers: {},
+    setHeader (name, value) {
+      this.headers[name] = value
+    },
+    end (body) {
+      this.body = body
+    }
+  }
+}
+
+test('accepts the configured credentials', () => {
+  const req = request('Basic ' + Buffer.from('admin:secret').toString('base64'))
+  const res = response()
+  let nextCalled = false
+
+  authMiddleware(req, res, () => { nextCalled = true })
+
+  assert.equal(nextCalled, true)
+  assert.equal(res.statusCode, undefined)
+})
+
+test('rejects missing or incorrect credentials', () => {
+  for (const authorization of [undefined, 'Basic invalid', 'Bearer token']) {
+    const res = response()
+    let nextCalled = false
+
+    authMiddleware(request(authorization), res, () => { nextCalled = true })
+
+    assert.equal(nextCalled, false)
+    assert.equal(res.statusCode, 401)
+    assert.equal(res.headers['WWW-Authenticate'], 'Basic realm="nodejs-github-bot"')
+    assert.equal(res.body, 'Unauthorized')
+  }
+})