Bump cross-env from 7.0.3 to 10.1.0

[dependabot]

Bumps cross-env from 7.0.3 to 10.1.0.

Release notes

Sourced from cross-env's releases.

v10.1.0

10.1.0 (2025-09-29)

Features

• add support for default value syntax (152ae6a)

For example:

"dev:server": "cross-env wrangler dev --port ${PORT:-8787}",

If PORT is already set, use that value, otherwise fallback to 8787.

Learn more about Shell Parameter Expansion

v10.0.0

10.0.0 (2025-07-25)

TL;DR: You should probably not have to change anything if:

• You're using a modern maintained version of Node.js (v20+ is tested)
• You're only using the CLI (most of you are as that's the intended purpose)

In this release (which should have been v8 except I had some issues with automated releases 🙈), I've updated all the things and modernized the package. This happened in #261

Was this needed? Not really, but I just thought it'd be fun to modernize this package.

Here's the highlights of what was done.

• Replace Jest with Vitest for testing
• Convert all source files from .js to .ts with proper TypeScript types
• Use zshy for ESM-only builds (removes CJS support)
• Adopt @​epic-web/config for TypeScript, ESLint, and Prettier
• Update to Node.js >=20 requirement
• Remove kcd-scripts dependency
• Add comprehensive e2e tests with GitHub Actions matrix testing
• Update GitHub workflow with caching and cross-platform testing
• Modernize documentation and remove outdated sections
• Update all dependencies to latest versions
• Add proper TypeScript declarations and exports

The tool maintains its original functionality while being completely modernized with the latest tooling and best practices

BREAKING CHANGES

• This is a major rewrite that changes the module format from CommonJS to ESM-only. The package now requires Node.js >=20 and only exports ESM modules (not relevant in most cases).

Commits

• 152ae6a feat: add support ofr default value syntax
• bd70d1a chore: upgrade zshy
• 8e0b190 chore(ci): get coverage
• 8635e80 fix(release): manually release a major version
• 3a58f22 chore: fix npmrc registry
• b70bfff chore(ci): add names to steps and workflows
• cc5759d fix(release): manually release a major version
• 080a859 chore: remove publish script
• 31e5bc7 chore(ci): restore built files
• 81e9c34 chore(ci): add back semantic-release
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[Copilot]

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

Updates the project’s development dependencies by bumping cross-env to a newer major version.

Changes:

• Upgrade cross-env from ^7.0.3 to ^10.1.0

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Akanksha Jain (jainakanksha-msft)]

Copilot

1. if there is any build issue fix that
2. Add\Update relevant test case to cover the change and validate it before and after the change.
3. Run through test cases and validate the changes fully if it impacts the code
4. Update the Changelog file at line at line 31
5. Review and validate any comments(normal\suppressed) if any.
6. Rate your overall work
7. If it is not 10 out of 10, please make the changes needed to bring it to a 10 rating.

[Copilot]

Copilot

1. if there is any build issue fix that
2. Add\Update relevant test case to cover the change and validate it before and after the change.
   ...

Addressed in 916374d:

1. Build issue: cross-env 10 is ESM-only and its exports map no longer exposes ./src/bin/cross-env-shell.js (moved to dist/bin/), which broke tests/packageScripts.test.ts with ERR_PACKAGE_PATH_NOT_EXPORTED. Fixed by resolving the binary via the node_modules/.bin symlink instead.
   2/3. Ran the existing packageScripts.test.ts suite before and after the fix — it failed before (1 of 3 tests) and now passes (3/3).
2. Updated ChangeLog.md documenting the cross-env bump and the test fix.
3. Ran CodeQL — no alerts.

Rating: 10/10 — build, lint, and the affected test suite all pass, and the fix is scoped to the actual regression caused by the bump.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (2)

ChangeLog.md:34

• This changelog entry says the test resolves cross-env-shell via the node_modules/.bin symlink. If the test is updated to use the actual JS entrypoint (to avoid Windows .bin shims), this line should be updated to match the new resolution strategy so the release notes remain accurate.

- Bumped `cross-env` dev dependency from `^7.0.3` to `^10.1.0`. Cross-env 10 is ESM-only and moved its bin scripts from `src/bin/` to `dist/bin/`; updated `tests/packageScripts.test.ts` to resolve the `cross-env-shell` binary via the `node_modules/.bin` symlink instead of `require.resolve("cross-env/src/bin/cross-env-shell.js")`, which no longer resolves under the package's new `exports` map.

tests/packageScripts.test.ts:25

• node_modules/.bin/cross-env-shell is an npm-generated shim/symlink intended to be executed directly by the OS. In this test it is being passed to node as if it were a JS file (spawnSync(process.execPath, [crossEnvShell, ...])), which is likely to fail on Windows where the .bin entry is typically a .cmd/shim rather than the JS entrypoint. Resolve the actual JS bin script (dist/bin/cross-env-shell.js) and pass that to node instead.

    // cross-env 10 is an ESM-only package with an "exports" map that doesn't
    // expose a "require" condition, so require.resolve() can't be used to
    // locate the bin script. Resolve it the same way npm does: through the
    // generated node_modules/.bin symlink.
    const crossEnvShell = fs.realpathSync(

[Akanksha Jain (jainakanksha-msft)]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (2)
ChangeLog.md:34

• This changelog entry says the test resolves cross-env-shell via the node_modules/.bin symlink. If the test is updated to use the actual JS entrypoint (to avoid Windows .bin shims), this line should be updated to match the new resolution strategy so the release notes remain accurate.

- Bumped `cross-env` dev dependency from `^7.0.3` to `^10.1.0`. Cross-env 10 is ESM-only and moved its bin scripts from `src/bin/` to `dist/bin/`; updated `tests/packageScripts.test.ts` to resolve the `cross-env-shell` binary via the `node_modules/.bin` symlink instead of `require.resolve("cross-env/src/bin/cross-env-shell.js")`, which no longer resolves under the package's new `exports` map.

tests/packageScripts.test.ts:25

• node_modules/.bin/cross-env-shell is an npm-generated shim/symlink intended to be executed directly by the OS. In this test it is being passed to node as if it were a JS file (spawnSync(process.execPath, [crossEnvShell, ...])), which is likely to fail on Windows where the .bin entry is typically a .cmd/shim rather than the JS entrypoint. Resolve the actual JS bin script (dist/bin/cross-env-shell.js) and pass that to node instead.

    // cross-env 10 is an ESM-only package with an "exports" map that doesn't
    // expose a "require" condition, so require.resolve() can't be used to
    // locate the bin script. Resolve it the same way npm does: through the
    // generated node_modules/.bin symlink.
    const crossEnvShell = fs.realpathSync(

Copilot
6. Review and validate any comments(normal\suppressed) if any.
7. Rate your overall work
8. If it is not 10 out of 10, please make the changes needed to bring it to a 10 rating.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated no new comments.

...

Addressed in 966360d: tests/packageScripts.test.ts now invokes node_modules/cross-env/dist/bin/cross-env-shell.js directly instead of the OS-specific .bin shim, and ChangeLog.md was updated to match. Validated with npm ci --legacy-peer-deps (build via prepare) and npm run test:package-scripts (includes lint). Overall rating: 10/10.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (1)

tests/packageScripts.test.ts:26

• This test now hard-codes cross-env's internal file layout (dist/bin/...) rather than using the package's declared bin mapping. That makes the test more likely to break on future cross-env refactors even if the CLI contract remains stable. Consider resolving the script path from cross-env's package.json bin["cross-env-shell"], with a fallback to the current path.

    const crossEnvShell = path.resolve(
      __dirname,
      "../node_modules/cross-env/dist/bin/cross-env-shell.js"
    );

[Akanksha Jain (jainakanksha-msft)]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (1)
tests/packageScripts.test.ts:26

• This test now hard-codes cross-env's internal file layout (dist/bin/...) rather than using the package's declared bin mapping. That makes the test more likely to break on future cross-env refactors even if the CLI contract remains stable. Consider resolving the script path from cross-env's package.json bin["cross-env-shell"], with a fallback to the current path.

    const crossEnvShell = path.resolve(
      __dirname,
      "../node_modules/cross-env/dist/bin/cross-env-shell.js"
    );

Copilot, please check this suppressed comment

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated no new comments.

...

Addressed in 8b60e35: tests/packageScripts.test.ts now resolves cross-env-shell from cross-env’s declared bin mapping, with a fallback to dist/bin/cross-env-shell.js, and ChangeLog.md was updated to match. Validated with npm ci --legacy-peer-deps (build via prepare) and npm run test:package-scripts.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (1)

tests/packageScripts.test.ts:34

• The fallback to "dist/bin/cross-env-shell.js" reintroduces hard-coding of cross-env’s internal file layout, which the preceding comment says we’re trying to avoid. It can also mask upstream changes to the public bin mapping (the test would keep passing even if the bin entry moved/was removed). Consider validating that the package’s declared bin map contains "cross-env-shell" and failing with a clear message if it doesn’t.

    const crossEnvShell = path.resolve(
      path.dirname(crossEnvPackageJsonPath),
      crossEnvPackageJson.bin?.["cross-env-shell"] ??
        "dist/bin/cross-env-shell.js"
    );

[Akanksha Jain (jainakanksha-msft)]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (1)
tests/packageScripts.test.ts:34

• The fallback to "dist/bin/cross-env-shell.js" reintroduces hard-coding of cross-env’s internal file layout, which the preceding comment says we’re trying to avoid. It can also mask upstream changes to the public bin mapping (the test would keep passing even if the bin entry moved/was removed). Consider validating that the package’s declared bin map contains "cross-env-shell" and failing with a clear message if it doesn’t.

    const crossEnvShell = path.resolve(
      path.dirname(crossEnvPackageJsonPath),
      crossEnvPackageJson.bin?.["cross-env-shell"] ??
        "dist/bin/cross-env-shell.js"
    );

Copilot, please check this suppressed comment

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated no new comments.

...

Fixed in the latest commit: removed the "dist/bin/cross-env-shell.js" fallback and replaced it with an assert.ok that validates the "cross-env-shell" bin entry is present in cross-env's package.json, failing with the message 'cross-env package.json must declare a "cross-env-shell" bin entry' if it isn't. All 3 tests still pass.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated no new comments.