fix(deps): upgrade vitest to ^4.1.0 to patch critical Vitest UI advisory (GHSA-5xrq-8626-4rwp)#4837
Conversation
…ory (GHSA-5xrq-8626-4rwp) - Bump vitest and @vitest/coverage-v8 to ^4.1.0 across all workspaces (only patched release for the critical 'Vitest UI server arbitrary file read/execute' advisory; no 3.x backport exists) - Widen @sim/testing peer range to ^3.0.0 || ^4.0.0 - Migrate constructor mocks to class expressions: vitest 4 uses Reflect.construct for mocks invoked with new, and arrow/function implementations are not constructable (function expressions also get reverted to arrows by biome's useArrowFunction) - Remove deprecated test.poolOptions from apps/sim/vitest.config.ts (options are now top-level in vitest 4)
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
PR SummaryLow Risk Overview Vitest 4 builds constructor mocks via
Reviewed by Cursor Bugbot for commit e8dc247. Configure here. |
Greptile SummaryThis PR patches the critical Vitest UI arbitrary-file-read/execute vulnerability (GHSA-5xrq-8626-4rwp) by upgrading
Confidence Score: 5/5Safe to merge; correctly patches the critical file-read/execute advisory across all workspaces with no functional regressions. The change is a well-scoped dependency upgrade with thorough mock migration. The Vitest 4 migration guide confirms that No files require special attention. Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A["vi.fn().mockImplementation(impl)"] --> B{Called with `new`?}
B -->|"Vitest 3 (arrow/fn return)"| C["Return value used directly\n✅ worked"]
B -->|"Vitest 4 (arrow fn)"| D["Reflect.construct(arrowFn, …)\n❌ TypeError: Not a constructor"]
B -->|"Vitest 4 (class expression)"| E["Reflect.construct(class, …)\n✅ constructable"]
E --> F{Constructor returns object?}
F -->|"return non-primitive"| G["Returned obj overrides `this`\n(used for identity passthrough)"]
F -->|"Object.assign(this, …)"| H["Methods copied onto `this`\n(spy refs preserved)"]
F -->|"Class field initializers"| I["Properties set directly on instance\n(cleanest pattern)"]
G --> J["✅ Tests pass under Vitest 4"]
H --> J
I --> J
Reviews (3): Last reviewed commit: "test(isolated-vm): de-flake queue-capaci..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Tighten the v4 arm of the peer range to >=4.1.0 <5.0.0 so the peer requirement cannot be satisfied by the unpatched 4.0.x builds that GHSA-5xrq-8626-4rwp affects.
- logging-session & mcp-oauth mocks: a class passed to mockImplementation has a construct signature that isn't assignable to its (...args) => any parameter, failing tsc. Use named function declarations instead (constructable via Reflect.construct, assignable to mockImplementation, and not rewritten to arrows by biome's useArrowFunction). - database.mock.ts: vitest 4's generic vi.fn typings no longer break the self-referential cycle on the transaction callback's tx param; loosen tx and annotate the callback's return type to resolve the implicit-any errors.
|
@greptile |
|
@cursor review |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 8b6fc53. Configure here.
The 'queue is full' and 'per-owner queued limit' tests relied on 'await sleep(1)' to assume the first request had reached the queue before submitting the overflow request. The first request only enqueues after an async spawn-failure chain (acquireWorker -> spawn exit -> resolve null -> enqueue), which isn't guaranteed within 1ms under CI load — the overflow request then found an empty queue and hit the 200ms queue-wait timeout instead of the capacity rejection. Replace the wall-clock barrier with a deterministic, event-driven one: hold the single global concurrency slot (IVM_MAX_CONCURRENT=1) with an active worker and await an explicit 'dispatched' signal (fired when the worker receives its execute message, after the scheduler counts it active). The follow-up requests then deterministically hit the synchronous enqueue path. Also drops the queue-wait timeout from 200ms to 50ms, so the tests run faster.
|
@greptile |
|
@cursor review |
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit e8dc247. Configure here.
1 participant
Summary
vitestand@vitest/coverage-v8to^4.1.0across all workspaces to resolve the critical Dependabot alert GHSA-5xrq-8626-4rwp ("When Vitest UI server is listening, arbitrary file can be read and executed").4.1.0is the only patched release — there is no 3.x backport.newviaReflect.construct, and arrow/function implementations aren't constructable (functionexpressions also get reverted to arrows by biome'suseArrowFunction, so classes are the stable fix).test.poolOptionsfromapps/sim/vitest.config.ts(options are now top-level in vitest 4).@sim/testingpeer range to^3.0.0 || ^4.0.0.Type of Change
Testing
apps/simsuite green under vitest 4.1.7: 7452 passed (484 files)bunx biome checkclean on all changed files (nouseArrowFunction/noConstructorReturndiagnostics)bun run check:api-validationpassesChecklist