Repository navigation
chore(deps): clear high/critical audit findings and fix slow test timeouts - #47
Merged
Merged
Conversation
…eouts CI's `npm audit --audit-level=high` started failing on main after new advisories for the dev toolchain: - `npm audit fix` updates vite, brace-expansion and source-map-js. - Override tinypool to 2.1.2 (critical prototype-pollution RCE in <2.1.2). Vitest stays on 3.2.7 because TDD evidence explicitly supports Vitest 3 only (src/system/tdd-evidence.ts, docs/workflows.md); moving to Vitest 5 would change that contract and is left for a separate change. Remaining: moderate @vitest/mocker / @vitest/coverage-v8 advisories, which need Vitest >=4.1.11 and are below the audit gate. Also give two man-delivery tests an explicit 30s timeout. Each spawns about 590 git subprocesses and needs 6-8s, above the 5s default, so they timed out locally, especially under coverage.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
New advisories against the dev toolchain broke CI's
npm audit --audit-level=highstep onmain. Every PR now fails there before lint and tests run, including #46.npm audit fixupdatesvite,brace-expansionandsource-map-js.tinypoolto2.1.2to fix the critical prototype-pollution RCE in versions below 2.1.2.3.2.7. TDD evidence supports only Vitest 3 (src/system/tdd-evidence.ts:52,docs/workflows.md:369). A trial upgrade to Vitest 5 cleared the audit but broke 5tdd-evidencetests on that version check. Supporting Vitest 5 would change a user-facing contract, so it is left for a separate change.man-deliverytests an explicit 30s timeout. Each spawns about 590 git subprocesses and needs 6–8s, which is over the 5s default, so they timed out locally, especially under coverage.Remaining: moderate
@vitest/mockerand@vitest/coverage-v8advisories. They need Vitest ≥4.1.11 and are below the audit gate.Test plan
npm run checkpasses locally: lint, typecheck, build,test:dist, audit, andtest:coverage(188 files, 1757 tests).Not included
A macOS-only bug in
src/secrets/run.ts: a secondkillcan returnEPERMand overwriteOUTPUT_LIMITwithEXECUTOR_FAILED. Its test is skipped on CI's ubuntu runners and fails intermittently on macOS. It is unrelated to dependencies and will get its own fix.