Prepare for next version of node/ocean.js

[alexcos20]

Fixes # .

Changes proposed in this PR:

Summary by CodeRabbit

• Chores
  • Updated a core library dependency to a newer pre-release version, which may include compatibility improvements and upcoming fixes.
• Tests
  • Adjusted system-test CI settings by pinning the Barge checkout reference and setting environment variables to use specific contract and node versions.

[coderabbitai]

📝 Walkthrough

Walkthrough

The @oceanprotocol/lib dependency is upgraded, and system tests now use a specified Barge branch with pinned contracts and node versions.

Changes

Dependency and system test updates

Layer / File(s)	Summary
Update library dependency package.json	Updates @oceanprotocol/lib from ^8.0.6 to ^9.0.0-next.1.
Pin Barge system-test configuration .github/workflows/ci.yml	Checks out Barge from feature/node-v4 and pins CONTRACTS_VERSION to 2.9.0 and NODE_VERSION to pr-1408.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Suggested reviewers: andreip136, bogdanfazakas, giurgiur99

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and generally matches the Node.js/ocean.js version bump work in the PR.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/next-node-4

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install timed out. The project may have too many dependencies for the sandbox.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/ci.yml (1)

73-78: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Do not expose the GitHub token to the checked-out Barge code.

actions/checkout persists credentials by default, and this workflow then executes start_ocean.sh from that repository. Set persist-credentials: false; also prefer a commit SHA over the mutable branch ref for reproducible and safer CI.

Proposed fix

       - name: Checkout Barge
         uses: actions/checkout@v3
         with:
           repository: 'oceanprotocol/barge'
           path: 'barge'
-          ref: "feature/node-v4"
+          ref: "<immutable-commit-sha>"
+          persist-credentials: false

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 73 - 78, Update the “Checkout Barge”
actions/checkout step to set persist-credentials to false, preventing the
checked-out code from accessing the GitHub token. Replace the mutable
feature/node-v4 ref with the intended pinned commit SHA while preserving the
existing repository and path.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In @.github/workflows/ci.yml:
- Around line 73-78: Update the “Checkout Barge” actions/checkout step to set
persist-credentials to false, preventing the checked-out code from accessing the
GitHub token. Replace the mutable feature/node-v4 ref with the intended pinned
commit SHA while preserving the existing repository and path.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 4c534c59-1d38-4126-b662-76084f5986ab

📥 Commits

Reviewing files that changed from the base of the PR and between 1596062 and f461a86.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (2)

• .github/workflows/ci.yml
• package.json

🚧 Files skipped from review as they are similar to previous changes (1)

• package.json