Skip to content

Commit 3333d45

Browse files
thomasrockhu-codecovcursoragent
thomasrockhu-codecov
and
cursoragent
authored
fix(deps): bump vitest to ^3.2.6 (CVE-2026-47429) (#352)
Co-authored-by: Cursor <cursoragent@cursor.com>
1 parent 8bb7825 commit 3333d45

17 files changed

Lines changed: 800 additions & 444 deletions

File tree

‎package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@
4646
"typedoc": "^0.27.5",
4747
"typescript": "^5.3.3",
4848
"vite": "6.3.5",
49-
"vitest": "^2.1.9"
49+
"vitest": "^3.2.6"
5050
},
5151
"lint-staged": {
5252
"*.{js,jsx,ts,tsx,json,css,scss,md,json}": [

‎packages/astro-plugin/package.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@
5858
"devDependencies": {
5959
"@rollup/plugin-replace": "^5.0.5",
6060
"@types/node": "^20.11.15",
61-
"@vitest/coverage-v8": "^2.1.9",
61+
"@vitest/coverage-v8": "^3.2.6",
6262
"astro": "^5.0.9",
6363
"codecovProdRollupPlugin": "npm:@codecov/rollup-plugin@1.5.0",
6464
"msw": "^2.7.0",
@@ -67,7 +67,7 @@
6767
"typescript": "^5.3.3",
6868
"unbuild": "^2.0.0",
6969
"vite": "6.3.5",
70-
"vitest": "^2.1.9"
70+
"vitest": "^3.2.6"
7171
},
7272
"peerDependencies": {
7373
"astro": "4.x || 5.x"

‎packages/bundle-analyzer/package.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@
4949
"format:check": "prettier '**/*.{cjs,mjs,ts,tsx,md,json}' --ignore-path ../.gitignore --ignore-unknown --no-error-on-unmatched-pattern --check",
5050
"test:unit": "vitest run",
5151
"test:unit:watch": "vitest watch",
52-
"test:unit:ci": "vitest --coverage --reporter=junit --outputFile=./bundle-analyzer.junit.xml run",
52+
"test:unit:ci": "vitest --coverage --reporter=default --reporter=junit --outputFile=./bundle-analyzer.junit.xml run",
5353
"test:unit:update": "vitest -u run",
5454
"generate:typedoc": "typedoc --options ./typedoc.json"
5555
},
@@ -63,14 +63,14 @@
6363
"@types/micromatch": "^4.0.9",
6464
"@types/node": "^20.11.15",
6565
"@types/yargs": "^17.0.33",
66-
"@vitest/coverage-v8": "^2.1.9",
66+
"@vitest/coverage-v8": "^3.2.6",
6767
"codecovProdRollupPlugin": "npm:@codecov/rollup-plugin@1.5.0",
6868
"msw": "^2.7.0",
6969
"ts-node": "^10.9.2",
7070
"typedoc": "^0.27.5",
7171
"unbuild": "^2.0.0",
7272
"vite": "6.3.5",
73-
"vitest": "^2.1.9"
73+
"vitest": "^3.2.6"
7474
},
7575
"volta": {
7676
"extends": "../../package.json"

‎packages/bundle-analyzer/src/cli.test.ts‎

Lines changed: 41 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -7,22 +7,29 @@ import {
77
afterEach,
88
beforeEach,
99
} from "vitest";
10-
import { execSync, execFileSync } from "node:child_process";
10+
import { exec, execFile } from "node:child_process";
11+
import { promisify } from "node:util";
1112
import path from "node:path";
1213
import * as url from "node:url";
1314
import fs from "node:fs";
1415

15-
export const runCLI = (args: string[]): string | undefined => {
16+
const execAsync = promisify(exec);
17+
const execFileAsync = promisify(execFile);
18+
19+
// Spawn the CLI asynchronously: a synchronous spawn blocks the vitest worker
20+
// thread, which under vitest 3.2 trips the "onTaskUpdate" RPC timeout on slower
21+
// machines (e.g. CI) even though the test itself passes.
22+
export const runCLI = async (args: string[]): Promise<string | undefined> => {
1623
const cliPath = path.resolve(
1724
path.dirname(url.fileURLToPath(import.meta.url)),
1825
"../src/cli.ts",
1926
);
2027

2128
try {
22-
const cmd = "npx";
23-
const allArgs = ["tsx", cliPath, ...args];
24-
25-
return execFileSync(cmd, allArgs, { encoding: "utf-8" });
29+
const { stdout } = await execFileAsync("npx", ["tsx", cliPath, ...args], {
30+
encoding: "utf-8",
31+
});
32+
return stdout;
2633
} catch (error) {
2734
if (error instanceof Error) {
2835
return JSON.stringify(error);
@@ -32,9 +39,9 @@ export const runCLI = (args: string[]): string | undefined => {
3239
};
3340

3441
describe("CLI script", () => {
35-
beforeAll(() => {
42+
beforeAll(async () => {
3643
// Ensure the build completes before tests
37-
execSync("pnpm run build", { stdio: "inherit" });
44+
await execAsync("pnpm run build");
3845

3946
// Verify that the build directory exists
4047
const thisBuildPath = path.resolve(
@@ -53,18 +60,18 @@ describe("CLI script", () => {
5360
vi.clearAllMocks();
5461
});
5562

56-
it("should exit with an error if build directory paths are missing", () => {
57-
const output = runCLI([]);
63+
it("should exit with an error if build directory paths are missing", async () => {
64+
const output = await runCLI([]);
5865
expect(output).toContain(
5966
"Not enough non-option arguments: got 0, need at least 1",
6067
);
6168
});
6269

63-
it("should exit with success if upload token is in an env var", () => {
70+
it("should exit with success if upload token is in an env var", async () => {
6471
const originalToken = process.env.CODECOV_UPLOAD_TOKEN;
6572
process.env.CODECOV_UPLOAD_TOKEN = "token123";
6673

67-
const output = runCLI([
74+
const output = await runCLI([
6875
"./src",
6976
"../bundle-analyzer",
7077
"--bundle-name=someName",
@@ -80,8 +87,8 @@ describe("CLI script", () => {
8087
);
8188
});
8289

83-
it("should exit with success when valid inputs are provided", () => {
84-
const output = runCLI([
90+
it("should exit with success when valid inputs are provided", async () => {
91+
const output = await runCLI([
8592
"./src",
8693
"../bundle-analyzer",
8794
"--bundle-name=someName",
@@ -96,8 +103,8 @@ describe("CLI script", () => {
96103
);
97104
});
98105

99-
it("should log an error message if the directory doesn't exist", () => {
100-
const output = runCLI([
106+
it("should log an error message if the directory doesn't exist", async () => {
107+
const output = await runCLI([
101108
"./doesnt-exist",
102109
"--bundle-name=someName",
103110
"--upload-token=token123",
@@ -106,8 +113,8 @@ describe("CLI script", () => {
106113
expect(output).toContain("An error occurred:");
107114
});
108115

109-
it("should handle multiple ignore patterns correctly", () => {
110-
const output = runCLI([
116+
it("should handle multiple ignore patterns correctly", async () => {
117+
const output = await runCLI([
111118
"./src",
112119
"../bundle-analyzer",
113120
"--bundle-name=someName",
@@ -125,8 +132,8 @@ describe("CLI script", () => {
125132
expect(output).not.toContain(".test.js");
126133
});
127134

128-
it("should log an error for invalid CLI arguments", () => {
129-
const output = runCLI([
135+
it("should log an error for invalid CLI arguments", async () => {
136+
const output = await runCLI([
130137
"./src",
131138
"../bundle-analyzer",
132139
"--bundle-name=someName",
@@ -223,10 +230,20 @@ describe("test CLI functions directly", () => {
223230
fs.unlinkSync(configFilePath); // Clean up after test
224231

225232
expect(consoleSpy).toHaveBeenCalled();
226-
// the CLI argument should override anything supplied in the config file
227-
expect(consoleSpy.mock.calls[0]?.[0]).toContain(
228-
`bundleName":"this-is-the-name"`,
229-
);
233+
// the CLI argument should override anything supplied in the config file.
234+
// Importing ./cli triggers a stray top-level runCli invocation, so match
235+
// the report this test produced rather than assuming a call index.
236+
const loggedReports = consoleSpy.mock.calls.map((call) => String(call[0]));
237+
expect(
238+
loggedReports.some((report) =>
239+
report.includes(`bundleName":"this-is-the-name"`),
240+
),
241+
).toBe(true);
242+
expect(
243+
loggedReports.some((report) =>
244+
report.includes(`bundleName":"this-name-should-be-ignored"`),
245+
),
246+
).toBe(false);
230247
});
231248

232249
it("should load options from a configuration file with error if file does not exist", async () => {

‎packages/bundle-analyzer/vitest.config.ts‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,14 @@ const packageJson = await import("./package.json", {
1212

1313
export default defineConfig({
1414
...config,
15+
test: {
16+
...config.test,
17+
// CLI tests spawn `npx tsx` subprocesses (the first invocation downloads
18+
// tsx); vitest 3.2 enforces timeouts on synchronous test bodies, so the
19+
// default 5s is not enough for these process spawns and the build hook.
20+
testTimeout: 60_000,
21+
hookTimeout: 60_000,
22+
},
1523
files: ["./setup.ts"],
1624
transformMode: {
1725
web: [/\.tsx?$/],

‎packages/bundler-plugin-core/package.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@
5151
"@sentry/core": "^8.42.0",
5252
"@types/node": "^20.11.15",
5353
"@types/semver": "^7.5.6",
54-
"@vitest/coverage-v8": "^2.1.9",
54+
"@vitest/coverage-v8": "^3.2.6",
5555
"codecovProdRollupPlugin": "npm:@codecov/rollup-plugin@1.5.0",
5656
"msw": "^2.7.0",
5757
"testdouble": "^3.20.1",
@@ -60,7 +60,7 @@
6060
"typedoc": "^0.27.5",
6161
"typescript": "^5.3.3",
6262
"unbuild": "^2.0.0",
63-
"vitest": "^2.1.9"
63+
"vitest": "^3.2.6"
6464
},
6565
"volta": {
6666
"extends": "../../package.json"

‎packages/bundler-plugin-core/src/utils/__tests__/Output.test.ts‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ import chalk from "chalk";
1515

1616
import { detectProvider } from "../provider";
1717
import { Output } from "../Output";
18+
import { FailedFetchError } from "../../errors/FailedFetchError";
1819

1920
vi.mock("../provider");
2021

@@ -654,7 +655,11 @@ describe("Output", () => {
654655
expect(sentryScope.addBreadcrumb).toHaveBeenCalledWith({
655656
category: "output.write.getPreSignedURL",
656657
level: "error",
657-
data: { error: Error("Failed to fetch pre-signed URL") },
658+
data: {
659+
error: new FailedFetchError("Failed to fetch pre-signed URL", {
660+
cause: new Error("Failed to fetch pre-signed URL"),
661+
}),
662+
},
658663
});
659664
});
660665
});
@@ -848,7 +853,7 @@ describe("Output", () => {
848853
expect(sentryScope.addBreadcrumb).toHaveBeenCalledWith({
849854
category: "output.write.uploadStats",
850855
level: "error",
851-
data: { error: Error("Failed to upload stats") },
856+
data: { error: new FailedFetchError("Failed to upload stats") },
852857
});
853858
});
854859
});

‎packages/nextjs-webpack-plugin/package.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,15 +54,15 @@
5454
"@rollup/plugin-replace": "^5.0.5",
5555
"@types/node": "^20.10.0",
5656
"@types/webpack": "^5.28.5",
57-
"@vitest/coverage-v8": "^2.1.9",
57+
"@vitest/coverage-v8": "^3.2.6",
5858
"codecovProdRollupPlugin": "npm:@codecov/rollup-plugin@1.5.0",
5959
"msw": "^2.7.0",
6060
"next": "^14.2.25",
6161
"ts-node": "^10.9.2",
6262
"typedoc": "^0.27.5",
6363
"typescript": "^5.3.3",
6464
"unbuild": "^2.0.0",
65-
"vitest": "^2.1.9",
65+
"vitest": "^3.2.6",
6666
"webpack": "^5.96.1"
6767
},
6868
"peerDependencies": {

‎packages/nuxt-plugin/package.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@
5353
"devDependencies": {
5454
"@rollup/plugin-replace": "^5.0.5",
5555
"@types/node": "^20.11.15",
56-
"@vitest/coverage-v8": "^2.1.9",
56+
"@vitest/coverage-v8": "^3.2.6",
5757
"codecovProdRollupPlugin": "npm:@codecov/rollup-plugin@1.5.0",
5858
"msw": "^2.7.0",
5959
"ts-node": "^10.9.2",
@@ -62,7 +62,7 @@
6262
"nuxt": "^3.16.0",
6363
"unbuild": "^2.0.0",
6464
"vite": "6.3.5",
65-
"vitest": "^2.1.9"
65+
"vitest": "^3.2.6"
6666
},
6767
"peerDependencies": {
6868
"nuxt": "3.x"

‎packages/remix-vite-plugin/package.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,15 +52,15 @@
5252
"devDependencies": {
5353
"@rollup/plugin-replace": "^5.0.5",
5454
"@types/node": "^20.11.15",
55-
"@vitest/coverage-v8": "^2.1.9",
55+
"@vitest/coverage-v8": "^3.2.6",
5656
"codecovProdRollupPlugin": "npm:@codecov/rollup-plugin@1.5.0",
5757
"msw": "^2.7.0",
5858
"ts-node": "^10.9.2",
5959
"typedoc": "^0.27.5",
6060
"typescript": "^5.3.3",
6161
"unbuild": "^2.0.0",
6262
"vite": "6.3.5",
63-
"vitest": "^2.1.9"
63+
"vitest": "^3.2.6"
6464
},
6565
"peerDependencies": {
6666
"remix": "2.x"

0 commit comments

Comments
 (0)