fix(security): upgrade vitest to ^4.1.0 and tmp to ^0.2.6#828
Merged
Conversation
Resolves 4 open Dependabot alerts: - CVE-2026-47429 (CRITICAL): vitest UI server arbitrary file read/exec Upgrade vitest from ^3.0.2 to ^4.1.0 (resolved 4.1.8) - CVE-2026-44705 (HIGH): tmp path traversal via unsanitized prefix/postfix Upgrade tmp from 0.2.4 to ^0.2.6 (resolved 0.2.7) Test fixes for vitest 4.x compatibility: - Replace arrow functions with function expressions in vi.mock() constructor implementations (gcsAPI, githubApi, awsLambdaLayerManager) since vitest 4 requires constructable functions for mocks called with new - Fix e2e tests: disable GPG signing in test repos and centralize CLI environment into CLI_ENV constant to handle non-interactive terminals - Update obsolete snapshots
- Add explicit Mock type annotations in src/__mocks__/logger.ts to avoid TS2742 error (inferred type references internal @vitest/spy package) - Cast getGitHubClient through unknown in github.test.ts to fix TS2348 (Mock<Procedure | Constructable> is not directly callable)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves all 4 open Dependabot alerts on this repository.
Security Fixes
vitest^3.0.2->^4.1.0(resolved 4.1.8)tmp0.2.4->^0.2.6(resolved 0.2.7)CVE-2026-47429 (vitest): When Vitest UI server is listening, arbitrary files can be read and executed. Fixed in vitest >= 4.1.0.
CVE-2026-44705 (tmp): Path traversal via unsanitized prefix/postfix enables directory escape. Low practical risk for this codebase since the only usage (
src/utils/files.ts:119) uses a hardcodedprefix: 'craft-'— but still important to patch.Test Fixes for Vitest 4.x Compatibility
Vitest 4 changed how mocks handle constructors — arrow functions can no longer be used with
new. Three test files were updated:gcsAPI.test.ts: Replace arrow functions inStorage/Bucketmock constructors withfunctionexpressionsgithubApi.test.ts: Replace arrow function inOctokitmock constructor withfunctionexpressionawsLambdaLayerManager.test.ts: Replace arrow function inLambdamock constructor withfunctionexpressionE2E Test Reliability Fix
Fixed
prepare-dry-run.e2e.test.tsfailures in environments withtag.gpgsign=truein global git config (e.g., CI with TERM=dumb):commit.gpgsign,tag.gpgsign) in all test git reposCLI_ENVconstantVerification