chore(deps): clear all 11 critical Dependabot alerts (vitest, protobufjs, shell-quote, baileys)#456
Merged
Merged
Conversation
Resolves dev-only test-tooling advisories: - vitest GHSA-5xrq-8626-4rwp (UI server arbitrary file read, fix >=4.1.0) - @vitest/browser GHSA-2h32-95rg-cppp (unsanitized otelCarrier, fix >=4.1.6) Bumps root vitest + @vitest/coverage-v8 (^4.0.18 -> ^4.1.9) and ui vitest + @vitest/browser-playwright (4.0.18 -> 4.1.9). Workspace lock reconciled so no 4.0.x vitest/@vitest remains in root or ui locks. Dev dependency only — not shipped to the gateway runtime. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ependabot criticals) Transitive runtime/dev advisories, fixed via overrides (no source change): - protobufjs GHSA-xq3m-2v4x-88gg (arbitrary code execution): protobufjs@7 -> 7.5.8 (was 7.5.4 via @larksuiteoapi/node-sdk) protobufjs@8 -> 8.0.1 (was 8.0.0 via @opentelemetry/otlp-transformer) - shell-quote GHSA-w7jw-789q-3m8p (quote() newline escaping, fix 1.8.4): root pnpm.overrides + dashboard npm overrides (was 1.8.3 via concurrently) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…bot critical) GHSA-qvv5-jq5g-4cgg: message upsert / hist sync spoofing + app-state manipulation (fix >=7.0.0-rc12). Direct runtime dep (WhatsApp transport). tsgo unchanged (189 pre-existing errors, 0 new; none in src/web/* baileys surface). Live WhatsApp send/receive smoke deferred to deploy (out of scope on this branch). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
vitest 4.1 throws on accessing a named export the vi.mock factory didn't return (4.0 returned undefined silently). These mocks went stale when new exports were added to the real modules: - fast-coding-tools/fast-core-tools: web-tools.js mock missing createTinyFishAgentTool (added with TinyFish) — fixes ~85 tests - async-service-key-tools: service-keys.js mock missing resolveServiceKey - run.overflow-compaction: pi-embedded-helpers.js mock missing isModelUnavailableErrorMessage Full suite: 135 failed -> ~57 failed. Remaining are genuine pre-existing debt (real assertion/TypeError/env-dependent failures), not mock-strictness. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
… mocks - isolated-agent: makeJob() omitted required CronJob.name → trim() of undefined (13 tests) - doctor.*: tests spied @clack/prompts.note but doctor code calls terminal/note.js.note; added the missing vi.mock so note assertions capture (6 tests across 3 files) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes all 11 open critical Dependabot alerts (5 packages) + fixes the stale test mocks that the vitest bump surfaced.
Commits
vitestGHSA-5xrq-8626-4rwp,@vitest/browserGHSA-2h32-95rg-cppp.protobufjsGHSA-xq3m-2v4x-88gg (@7→7.5.8,@8→8.0.1);shell-quoteGHSA-w7jw-789q-3m8p (1.8.4, root pnpm + dashboard npm).vi.mockvalidation —web-tools.jsmock missingcreateTinyFishAgentTool,service-keys.jsmissingresolveServiceKey,pi-embedded-helpers.jsmissingisModelUnavailableErrorMessage.Test-suite reality (important)
undefined-mock cascades into explicit "mock missing export X" errors.vitest.unit.config.ts) now: 56 failed / 7740 passed. These 56 are genuine pre-existing debt (assertion /TypeError/ env-dependentENOENT/404), present on the old version too, unrelated to these dep changes. CI does not run vitest, so dev already carries them.Deferred (owned, not in scope)
tsgoerrors +oxlint-tsgolintpeer mismatch → pre-existing.🤖 Generated with Claude Code