Repository navigation
Build(deps): Bump vitest from 2.1.9 to 4.1.11 - #219
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/vitest-4.1.11
branch
from
October 10, 2026 05:15
631e6f0 to
edb4397
Compare
Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) from 2.1.9 to 4.1.11. - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest) --- updated-dependencies: - dependency-name: vitest dependency-version: 4.1.11 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/vitest-4.1.11
branch
from
October 10, 2026 18:14
edb4397 to
9c73898
Compare
ryanportfolio
added a commit
that referenced
this pull request
Oct 11, 2026
…LTS (#253) ## What Replaces the four open Dependabot pull requests (#148, #179, #180, #219) and lets future Dependabot updates pass CI without a hand-written change record. - **Change-record exemption for Dependabot.** A pull request opened by `dependabot[bot]` that changes only `package.json` files, `pnpm-lock.yaml`, `pnpm-workspace.yaml`, Dockerfiles or `.github/workflows/*.yml` passes "Verify pull-request change record" without the template. Every other pull request still needs the full record, and so does a Dependabot pull request that touches any other file or lists no files. The author login is set by GitHub and cannot be taken by another account. A new step lists the changed files with `git diff --name-only HEAD^1 HEAD` on the merge commit, so the verify job now checks out with `fetch-depth: 2`. Owner decision of 2026-10-11: NIST SP 800-53 Moderate (CM-3) requires change types to be defined and changes approved and recorded, not this template; the template mirrors PCI DSS 6.5.1. For Dependabot updates the pull request (diff, release notes, CI results) is the record and the owner's merge is the approval. `docs/compliance/pci/change-control.md` and `pitfalls.md` say so. - **Node 24 LTS** in both stages of `Dockerfile.railway` and in every workflow's `setup-node` (was 22). Replaces #179, which proposed Node 25: an odd-numbered release that never becomes LTS and reached end of life in June 2026, and whose image failed the Grype gate. `.github/dependabot.yml` now ignores Node 25.x, 27.x and 29.x for the Docker ecosystem. - **pnpm/action-setup v5.0.0** pinned by commit SHA (`fc06bc12…`) in `security.yml`, `evidence-watch.yml` and `dependency-scan.yml`. Two of the three used the floating `@v4` tag. v5's only change is running the action on Node 24 (release notes). Replaces #148. - **Unused `drizzle-kit` catalog entry removed** from `pnpm-workspace.yaml`. No package depends on it, it is absent from the lockfile, and the repository never runs drizzle-kit commands. Replaces #180. - **#219 (vitest 2 → 4) is not taken.** Tested locally: typecheck passed, rag-app tests failed at startup with `ERR_PACKAGE_PATH_NOT_EXPORTED` (`./module-runner`) because vitest 4 needs Vite 6 or later and the app is on Vite 5. No advisory requires it; Vite and Vitest are left for a planned upgrade. - `verify-pci-evidence.ts` checks the exact verifier command, so its expected command and test fixtures gain `--changed-files`. Not touched: `services/scanner/Dockerfile` keeps its digest-pinned `node:22-trixie-slim` stage (separate image, outside the root Dependabot directory). ## Product contracts - No change to retrieval, generation, citations, refusals or program scoping; the eval suite does not apply. ## Verification - `corepack pnpm -r run check`: zero errors. - `corepack pnpm -r run test`: rag-app 25 files passed, api-server 82 files passed, scripts 88 passed (3 new tests for the exemption: dependency-only Dependabot PRs pass; other authors, including a `dependabot` login without `[bot]`, fail; a Dependabot PR that also touches source, `.github/dependabot.yml`, a nested workflow path or a look-alike filename fails, as does an empty file list). - `verify:pci-evidence` locally: the workflow check passes. It reports two stale hashes (`threat-model.md`, `production-control-verification.sql`) that come from this Windows checkout's CRLF line endings: the LF content on `main` hashes to the recorded `EF275873…`. CI on Linux is the real check. - Node 24 image: built and Grype-scanned by CI in this pull request. Not run on the deployed service. ## Change identity - Change ID: `TN-CHG-2026-253` - Change type: `normal` - Author: `@ryanportfolio` - Target release/commit: `pull request head SHA` - Target environment: `Railway production web and worker services (image base); GitHub Actions` - Significant change: `yes` - Significant-change rationale: `Changes a CI security check (change-record gate) and the runtime base image's Node major version.` ## Purpose and scope - Purpose: `Owner request 2026-10-11: review the open Dependabot pull requests and stop the change-record gate from blocking automated dependency updates.` - Affected components and data boundaries: `CI workflows, change-record verifier and its PCI evidence check, Dockerfile.railway base image, pnpm catalog. No customer data path.` ## Security and PCI impact - CDE impact: `none` - CDE-impact rationale: `No payment data path; PCI scope is still undecided (OD-A27).` - Security impact and threat considered: `Bypass of the change-record gate by a non-Dependabot change (mitigated: the GitHub-set author login plus a file allowlist; anything else needs the full record). Node major upgrade breaking runtime or adding image findings (CI build, tests and Grype gate on this PR; production only after a separate approved deploy). Floating action tag replaced by a SHA pin.` ## PCI DSS 6.5 change controls - 6.5.1 bespoke/custom security testing: `completed` - 6.5.1 evidence or rationale: `Unit tests for the exemption rule; PCI evidence verifier updated with its fixtures.` - 6.5.2 completion revalidation: `planned` - 6.5.2 evidence owner and plan/result: `Owner @ryanportfolio. The next Dependabot pull request shows the exemption passing in CI; after the Node 24 deploy, /health and web and worker logs are checked.` - 6.5.3 pre-production separation: `not applicable` - 6.5.3 evidence or rationale: `Verified in CI and locally; there is no separate pre-production environment.` - 6.5.4 role/function separation: `not applicable` - 6.5.4 evidence or accountability rationale: `Single-owner repository has no truthful non-author reviewer identity. CI and the Codex review supply technical gates.` - 6.5.5 live PAN in pre-production: `no live PAN` - 6.5.5 evidence or rationale: `No data involved.` - 6.5.6 test data/accounts removal: `not applicable` - 6.5.6 evidence owner and plan/result: `No accounts or test data created.` ## Verification record - Commands and results: `pnpm -r run check pass; pnpm -r run test pass (rag-app 25 files, api-server 82 files, scripts 88).` - Negative/security tests: `Exemption refused for other authors, non-dependency files, look-alike paths and an empty file list.` - Runtime/integration verification: `Pending: Grype and build of the Node 24 image in CI; post-deploy /health and logs after the owner's go.` - Evidence not collected locally: `Docker image build and Grype scan (CI).` ## Vulnerabilities and dependencies - Dependency/SBOM impact: `Base image node:22-bookworm-slim to node:24-bookworm-slim; pnpm/action-setup v4 to v5.0.0; unused drizzle-kit catalog entry removed (no lockfile change).` - Finding/exception links: `Replaces Dependabot #148, #179, #180; declines #219 (vitest 4 needs Vite 6+).` ## Deployment and secure recovery - Deployment/configuration/DDL steps: `Deploy web and worker from main after merge, on the owner's go. No DDL, no variable changes.` - Post-deployment verification: `/health 200; railway logs for web and worker show a clean start; login and one question answered.` - Failure signal: `Services fail to start or crash on Node 24, or Grype fails on the new image.` - Secure recovery procedure: `Redeploy the previous Railway deployment (Node 22 image).` - Incident ID: `Not applicable: normal change` - Emergency authority: `Not applicable: normal change` - Retrospective review due: `Not applicable: normal change` ## Approval and closure - Non-author reviewer: `Unassigned: no truthful distinct reviewer identity exists in the repository; owner requested this change.` - Review evidence: `This pull request, its hosted checks, and the Codex review.` - Specialist approval: `Not applicable: no CDE control or compliance-status change.` - Release/change-authority decision: `pending` 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Owner
|
Not taken for now: vitest 4 requires Vite 6 or later and the app is on Vite 5, so rag-app tests fail at startup (ERR_PACKAGE_PATH_NOT_EXPORTED ./module-runner). Vite and Vitest will be upgraded together in a planned change. See #253. |
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
ryanportfolio
added a commit
that referenced
this pull request
Oct 11, 2026
…262) ## What The daily "Full dependency audit" (`.github/workflows/dependency-scan.yml`) failed on every run: 24 advisories, 3 critical and 6 high, all in development and build tooling. This upgrades that tooling together, because Vitest 4 and later need Vite 6 or newer (Dependabot PR #219 bumped Vitest alone and the rag-app tests crashed with `ERR_PACKAGE_PATH_NOT_EXPORTED "./module-runner"`). Catalog changes in `pnpm-workspace.yaml`: | Package | Before | After | Clears | |---|---|---|---| | vite | ^5.4.8 (5.4.21) | ^8.3.4 | `server.fs.deny` bypass on Windows (high), two moderates, esbuild dev-server moderate, source-map-js (high, through vite's postcss) | | vitest | ^2.1.1 (2.1.9) | ^5.0.3 | Vitest UI file read (critical), Tinypool prototype pollution x2 (critical; Vitest 4+ has no Tinypool), `@vitest/mocker` path traversal | | @vitejs/plugin-react | ^4.3.1 | ^6.1.2 | Browserslist x2 (high) and `@babel/core` (low): plugin-react 6 drops Babel | | postcss | ^8.4.47 (8.5.14) | ^8.5.29 | source-map path traversal (high) and its incomplete-fix follow-up (moderate) | | autoprefixer | ^10.4.20 | ^10.6.1 | pulls browserslist 4.29.3 | | @types/node | ^20.16.5 | ^24.0.0 | not an advisory: Vitest 5's peer range is `^22 \|\| >=24`, and the image runs Node 24 since #253 | Vite 8 is the newest major; `@vitejs/plugin-react` 6.1.2 requires it and Vitest 5.0.3 accepts it. All chosen versions are older than the repo's three-day `minimumReleaseAge`. Overrides: the old `"postcss@<8.5.18": ">=8.5.18"` override is removed, because the catalog floor and Vite 8 (`postcss ^8.5.29`) now reach a fixed PostCSS without it. No override was added. **braces, the one remaining high.** GHSA-vfj7-8cjw-p6xm (CVE-2026-93687, stack-exhaustion DoS) covers braces through 3.0.3, and no patched release exists: the advisory lists no first patched version, npm's latest is 3.0.3, and the upstream fix PRs (micromatch/braces#82, #87, #88) are open. It reaches this repo only through tailwindcss 3 (chokidar, micromatch, fast-glob), a rag-app devDependency that expands the content globs in `tailwind.config.ts`; no request input reaches it, and the runtime image drops development dependencies. With the owner's approval it is ignored through `auditConfig.ignoreGhsas` in `pnpm-workspace.yaml`, recorded as TN-VULN-2026-009 in `docs/compliance/pci/vulnerability-register.md` with a review date of 2026-11-10. Remove the ignore once braces 3.0.4 or later is in the lockfile. The retained JSON report's severity totals still count it (`high: 1`); the gate step prints `1 high (1 ignored)` and passes. Left as they are (below the High gate, and outside this tooling change): 4 moderate and 3 low in runtime dependencies or unreachable through Tailwind 3: `qs` and `body-parser` through express 4, `sprintf-js` through mammoth's argparse 1, `esbuild` 0.27 through tsx (Windows dev-server file read, low), `postcss-selector-parser` 6 through tailwindcss 3. Other changes: - `Dockerfile.railway`: the comment listing the dev tooling kept out of the runtime image names rolldown and lightningcss instead of esbuild 0.21. - Vite 8 bundles with Rolldown and minifies CSS with Lightning CSS instead of esbuild. The main stylesheet's rules are reordered and vendor prefixes follow Vite 8's default browser targets (102.0 KB to 103.6 KB). The screenshot comparison below found no visible change. - `pnpm-lock.yaml`: every new Linux gnu/musl binary (rolldown, lightningcss) keeps its `libc:` line; the rollup entries that carried the old ones are gone with Vite 5. - Vite 8 prints a warning that `vite.config.ts` uses `__dirname` and an extensionless import, which its future native config loader will not support. The build works; left for a later change. ## Change identity - Change ID: `TN-CHG-2026-262` - Change type: `normal` - Author: `@ryanportfolio` - Target release/commit: `Head of claude/upgrade-vite-vitest at merge` - Target environment: `GitHub Actions (daily full dependency audit) and the Railway production image build; production deploy only after the owner's approval` - Significant change: `no` - Significant-change rationale: `Build and test tooling versions only. The runtime image's production dependency set is unchanged apart from the SPA bundle that Vite 8 builds; no application code, provider, data store, credential or schema changes.` ## Purpose and scope - Purpose: `The daily full dependency audit fails every run on 3 critical and 6 high advisories in dev and build tooling, and the security reviewer sees a red daily audit. This brings it to zero unaccepted High or Critical.` - Affected components and data boundaries: `pnpm-workspace.yaml (catalog, overrides, auditConfig), pnpm-lock.yaml, Dockerfile.railway (comment only), docs/compliance/pci/vulnerability-register.md (TN-VULN-2026-009). Build of artifacts/rag-app (Vite 8, Rolldown, Lightning CSS) and the vitest runs of rag-app and api-server. No data path changes.` ## Security and PCI impact - CDE impact: `none` - CDE-impact rationale: `No payment data path; build and test tooling only.` - Security impact and threat considered: `Removes 3 critical and 5 high advisories in tooling that runs in CI and on the developer machine (Vitest UI file read and execution, Tinypool prototype pollution, Vite server.fs.deny bypass on Windows, PostCSS source-map path traversal, Browserslist, source-map-js). Accepts one high (braces DoS) as a documented, owner-approved exception with a review date, because no fix exists and the vulnerable code only expands repository-authored globs at build time. The built compliance pages are byte-identical, so the public security pages are unchanged.` ## PCI DSS 6.5 change controls - 6.5.1 bespoke/custom security testing: `not applicable` - 6.5.1 evidence or rationale: `No bespoke application code changed; dependency versions only, checked by the full test suites and the dependency audit.` - 6.5.2 completion revalidation: `completed` - 6.5.2 evidence owner and plan/result: `@ryanportfolio. The vulnerability register gains TN-VULN-2026-009; verify:vulnerabilities passes locally. After merge, the next scheduled Full dependency audit run must pass.` - 6.5.3 pre-production separation: `confirmed` - 6.5.3 evidence or rationale: `Built and checked locally against the fixture API; no production database, variable or deployment touched.` - 6.5.4 role/function separation: `not applicable` - 6.5.4 evidence or accountability rationale: `Single-owner repository has no truthful non-author reviewer identity. CI and the Codex review supply technical gates.` - 6.5.5 live PAN in pre-production: `no live PAN` - 6.5.5 evidence or rationale: `Fixture data only.` - 6.5.6 test data/accounts removal: `not applicable` - 6.5.6 evidence owner and plan/result: `No test data or accounts created outside in-memory fixtures.` ## Verification - Commands and results: `corepack pnpm install --frozen-lockfile passes. corepack pnpm -r run check: 0 errors in all four projects. corepack pnpm -r run test: rag-app 25 files / 143 tests passed, api-server 82 files / 936 tests passed (both on Vitest 5.0.3; file counts match the test files on disk), scripts 88 passed. corepack pnpm --filter @workspace/rag-app run build passes on Vite 8.3.4. Audit, the workflow's exact commands with pnpm 11.13.0: before 3 critical, 6 high, 11 moderate, 4 low; after 0 critical, 1 high (braces, ignored), 4 moderate, 3 low; "audit --audit-level high" exits 0; "audit --prod --audit-level high" (security.yml) exits 0. verify:vulnerabilities passes. verify:pci-evidence locally reports only the two CRLF stale-hash lines that every Windows checkout reports (pitfalls.md, 2026-10-10); CI decides.` - Negative/security tests: `Compliance page output: dist/security/** and dist/security-pci.html from the Vite 8 build are byte-identical to the Vite 5 build of origin/main (diff -r, no differences), so compliance-pages.ts renders the same HTML and CSS.` - Runtime/integration verification: `Local fixture preview only (headless Chrome over CDP, fixture API from scripts/preview/mock-api). Dev server (review-env.mjs, Vite 8): signed-out login page, login form submit, CSR ask page with a submitted question rendering an answer with citations, manager Sources, Documents, Users, Teams, Source usage, Gaps, super-user /compliance list and a compliance document (GFM table and footnote), and the static /security/compliance/ page; no console errors other than the expected 401 on /api/me when signed out and a favicon 404 on the static page. Production build: the same 16 steps against vite preview of the Vite 8 build and of the Vite 5 build, same fixture state: page text identical on all 16; 11 screenshots pixel-identical; the other 5 differ only inside animated regions (login background drift, the Gaps portal loader, the ask-page animation). Screenshots: D:/screenshots/Truenote/vite8-upgrade/. Railway: Pending, owner, after deploy.` - Evidence not collected locally: `The Docker image build on Linux (Container scan runs it on this PR because pnpm-lock.yaml changed); the deployed SPA on Railway; the first scheduled Full dependency audit after merge. Owner @ryanportfolio.` ## Vulnerabilities and dependencies - Dependency/SBOM impact: `Dev and build dependencies: vite 5.4.21 to 8.3.4 (adds rolldown and lightningcss, drops rollup and esbuild 0.21), vitest 2.1.9 to 5.0.3 (drops tinypool and vite-node), @vitejs/plugin-react 4 to 6.1.2 (drops Babel), postcss 8.5.14/8.5.24 to 8.5.29, autoprefixer to 10.6.1, browserslist to 4.29.3, @types/node 20 to 24. Production dependency set unchanged; the production audit (security.yml) still passes.` - Finding/exception links: `TN-VULN-2026-009 (braces GHSA-vfj7-8cjw-p6xm, CVE-2026-93687), accepted exception approved by @ryanportfolio on 2026-10-11, review by 2026-11-10 or when braces 3.0.4 publishes.` ## Deployment and secure recovery - Deployment/configuration/DDL steps: `Merge. No DDL, no variable. The next production deploy (owner's approval) builds the SPA with Vite 8.` - Post-deployment verification: `After merge: the next scheduled Full dependency audit (04:37 UTC) passes. After the next deploy: truenote.org login, ask page and /security/compliance/ load with styles; railway logs for web show no static-asset errors.` - Failure signal: `Full dependency audit fails, Container scan fails to build the image, or the deployed SPA loads without styles or with console errors.` - Secure recovery procedure: `Revert this pull request and redeploy the previous web image.` - Incident ID: `Not applicable: normal change` - Emergency authority: `Not applicable: normal change` - Retrospective review due: `Not applicable: normal change` ## Approval and closure - Non-author reviewer: `Unassigned: single-owner repository` - Review evidence: `This pull request, its hosted checks and the Codex review.` - Specialist approval: `Not applicable: no CDE control change; the braces exception is approved by the owner in TN-VULN-2026-009` - Release/change-authority decision: `pending` 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps vitest from 2.1.9 to 4.1.11.
Release notes
Sourced from vitest's releases.
... (truncated)
Commits
9bd8d46chore: release v4.1.11 (#10995)9851dbcfix(browser): trigger playwright/chromium gc on lower disk availability [back...db616d2chore: release v4.1.10 (#10718)bae52b5fix(vm): fix external module resolve error with deps optimizer query for enco...a7a61e7chore: release v4.1.9 (#10598)934b0f5fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...7fb2965fix(browser): wait for orchestrator readiness before resolving browser sessio...a518019fix: fiximportOriginalwith optimizer and query import [backport to v4] (#...e61f2ddchore: release v4.1.8e4067b3fix(browser): disable clientcdpAPI whenallowWrite/allowExec: false[ba...Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for vitest since your current version.