Repository navigation
chore(deps): migrate Vitest tooling to patched v4.1.12 [security] - #2250
Merged
Merged
Conversation
|
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
More templates
@tanstack/angular-db
@tanstack/browser-db-sqlite-persistence
@tanstack/capacitor-db-sqlite-persistence
@tanstack/cloudflare-durable-objects-db-sqlite-persistence
@tanstack/convex-db-collection
@tanstack/db
@tanstack/db-ivm
@tanstack/db-sqlite-persistence-core
@tanstack/electric-db-collection
@tanstack/electron-db-sqlite-persistence
@tanstack/expo-db-sqlite-persistence
@tanstack/node-db-sqlite-persistence
@tanstack/offline-transactions
@tanstack/powersync-db-collection
@tanstack/preact-db
@tanstack/query-db-collection
@tanstack/react-db
@tanstack/react-native-db-sqlite-persistence
@tanstack/react-router-with-db
@tanstack/rxdb-db-collection
@tanstack/solid-db
@tanstack/svelte-db
@tanstack/tauri-db-sqlite-persistence
@tanstack/trailbase-db-collection
@tanstack/vue-db
commit: |
Contributor
|
Size Change: 0 B Total Size: 238 kB ℹ️ View Unchanged
|
renovate
Bot
force-pushed
the
renovate/npm-vitest-vulnerability
branch
from
October 25, 2026 05:32
2eee691 to
4358c4a
Compare
KyleAMathews
changed the title
Contributor
Incremental update benchmarkComparing Overall median write time vs base: 0.96× · cold hydrate time: 0.99× (geometric mean of per-case ratios; lower is faster). Writes: 0 regression(s), 2 improvement(s) (threshold: ±20% and >0.05ms). Cold hydrate: No significant changes (threshold: ±50% and >5ms). Per-case flags are noisy on shared runners. Read the geometric means first. Writes
Cold hydrate
Each row aggregates the 14.4 scale/index/write-mode configurations of that query; per-configuration tables below. 100 rows/collection | source indexes: none | synced writes — geomean 0.91×, cold 0.91×, 1 change(s)
100 rows/collection | source indexes: none | optimistic writes — geomean 0.94×, cold 0.97×
100 rows/collection | source indexes: manual | synced writes — geomean 1.02×, cold 1.08×
100 rows/collection | source indexes: manual | optimistic writes — geomean 1.01×, cold 1.20×
1,000 rows/collection | source indexes: none | synced writes — geomean 1.08×, cold 1.01×, 1 change(s)
1,000 rows/collection | source indexes: none | optimistic writes — geomean 0.78×, cold 0.96×
1,000 rows/collection | source indexes: manual | synced writes — geomean 0.92×, cold 1.00×
1,000 rows/collection | source indexes: manual | optimistic writes — geomean 0.94×, cold 1.01×
10,000 rows/collection | source indexes: none | synced writes — geomean 1.01×, cold 0.97×
10,000 rows/collection | source indexes: none | optimistic writes — geomean 0.98×, cold 0.96×
10,000 rows/collection | source indexes: manual | synced writes — geomean 0.99×, cold 0.97×
10,000 rows/collection | source indexes: manual | optimistic writes — geomean 0.97×, cold 0.92×
Runner: node v24.8.0, linux 7.0.0-1017-azure, AMD EPYC 9V74 80-Core Processor. Timings on shared CI runners are noisy; treat small deltas as indicative only. |
added 6 commits
October 28, 2026 12:11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Vitest and its mocker need v4.1.11 or later to cover both GHSA-5xrq-8626-4rwp and GHSA-82fw-gwwq-j7x9. Upgrade Vitest, its UI, and Istanbul coverage to v4.1.12, and use the compatible @fast-check/vitest 0.4.1 integration.
Merge current main and migrate test infrastructure for Vitest 4:
Production code is unchanged. Oracle models, legal histories, comparisons, seeds, and run budgets are unchanged; these edits restore execution of the same tests under the patched runner. The original constructor failures were setup failures, not product-law counterexamples. This change makes no new behavior or coverage claim.
Validation:
tsc --noEmit.pnpm lint:changedpassed.Based on current main, including the merged Angular, UUID, Vite, and Zod security updates. Strict frozen installation with pnpm repeat-install optimization disabled and direct comparison of all 45 workspace dependency specifiers passed. All 15,664 DB tests with no type errors and all 193 PowerSync tests passed for the combined Zod 4/Vitest 4 tree.
CI on the updated head is the final merge gate, including the full Browser suite and real-host E2E checks.