Bump vitest to 3.2.7 and pin vite to 6.4.3, clearing security alerts - #8
Merged
Conversation
Fixes real, currently-open Dependabot alerts confirmed via `npm audit` against the actual installed tree (not just the advisory text): vitest/@vitest/coverage-v8 critical (<=3.2.5, we were on 1.6.1) and vite high (<=6.4.2, we were on 5.4.21 transitively). Deliberately does NOT take the dependabot-proposed vitest 4.1.11 — that pulls in vitest 4's new rolldown-based bundler, which imports node:util.styleText and breaks Node 18.x/20.x (confirmed via that PR's own failing CI checks). vitest 3.2.7 has no such dependency and still declares support for Node 18/20/22, matching this repo's CI matrix. vite is pinned via `overrides` rather than left to floating resolution, because vitest 3.2.7's peer range (^5 || ^6 || ^7-0) otherwise resolves to vite 7.x, which requires Node >=20.19/22.12 and would reintroduce the same CI break. vite 6.4.3 is the first patched 6.x release and keeps full Node 18/20/22 support. Remaining npm audit findings (extract-zip, @puppeteer/browsers, puppeteer-core, tsup's own esbuild) are a separate, pre-existing dependency chain unrelated to vite/vitest — extract-zip has no upstream patch available at all — out of scope here.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #3 in favor of a targeted fix. #3 (dependabot) proposed vitest/@vitest/coverage-v8 1.6.1 → 4.1.11, which broke CI on Node 18.x and 20.x — vitest 4's new
rolldownbundler importsnode:util.styleText, unavailable on those runtimes. Confirmed via #3's own failing checks before closing it.vitest/@vitest/coverage-v8to 3.2.7 (latest 3.x) instead — clears the critical CVE (advisory range<=3.2.5) without pulling inrolldown, and still declares support for Node 18/20/22.viteto 6.4.3 viaoverrides— the first patched 6.x release (advisory range<=6.4.2). Pinning is necessary: left to float, vitest 3.2.7's peer range (^5 || ^6 || ^7.0.0-0) resolves to vite 7.x by default, which requires Node^20.19.0 || >=22.12.0and would reintroduce the same CI break.viteitself drops out of being a direct concern here (it was never a direct dependency — always transitive via vitest) but the version genuinely matters for the vulnerability fix, hence the explicit pin.Verification
Went beyond CI — reproduced the exact regression first, then verified the fix directly:
build (18.x)andbuild (20.x)in its own CI run, passes only22.x— root-caused torolldown'snode:util.styleTextimport.npm auditbefore this PR: 2 critical/high findings for vitest+coverage-v8 (<=3.2.5) and vite (<=6.4.2), confirmed against the actually installed tree, not just advisory text.npm auditshows those two cleared. Confirmed resolved versions directly:vitest@3.2.7,@vitest/coverage-v8@3.2.7,vite@6.4.3(no nested 7.x, norolldownanywhere in the tree).npm run build,npm run lint,npm test(the exact CI commands) all pass locally.tests/integration/lib.test.tsstill fails locally with "API key required" — pre-existing, intentional (needsCI_ZENROWS_API_KEY, only set in real CI), not a regression.Out of scope, flagged not fixed
npm auditstill showsextract-zip/@puppeteer/browsers/puppeteer-core(high, runtime dependency chain via Puppeteer) andtsup's ownesbuild(low). Separate, pre-existing chain unrelated to vite/vitest —extract-zip's advisory has no upstream patch available at all (first_patched_version: null), so there's nothing to bump to yet. Worth its own look, not folded in here to keep this PR's diff scoped to the actual ask.https://claude.ai/code/session_01DTXXBERPGEnYiYP4Mt3FjF