[chhoumann]

Summary

Dependabot alerts 214 to 218 on this repository (one high, three medium, one low) are all in vite-plus 0.1.24. It is a dev-only package that reached the tree through obsidian-e2e 0.13.0's required peer vite-plus: ^0.1.11. That peer range is also why Dependabot's security update to vite-plus 1.1.0 failed on 2026-10-23.

obsidian-e2e 0.14.0 drops the vite-plus peer. This PR bumps obsidian-e2e to ^0.14.0, which takes vite-plus out of the dev tree and resolves all five alerts. It also removes the vite-plus > oxfmt override. PR 402 added that override only to patch vite-plus's nested formatter and said to drop it once obsidian-e2e moved off vite-plus 0.1.x.

Nothing ships differently. main.js is byte-identical to master's.

Lockfile

• obsidian-e2e moves from 0.13.0 to 0.14.0. Its yaml range moves from ^2.8.2 to ^2.8.3, which the existing yaml 2.9.1 already satisfies.
• 51 entries leave, and none are added. They are vite-plus 0.1.24 and everything only it pulled in: its nested oxlint 1.67.0, oxlint-tsgolint 0.23.0 and their platform bindings, the @voidzero-dev/vite-plus-* packages, and the hoisted copies they alone used (@oxc-project/runtime, @oxc-project/types 0.133.0, @oxlint/plugins, @standard-schema/spec, es-module-lexer 1.7.0, tinybench 2.9.0, pixelmatch, pngjs, sirv, @polka/url, mrmime, totalist). Every removed entry was marked peer. Vitest and rolldown keep their own nested newer copies of es-module-lexer, tinybench and @oxc-project/types.
• No other entry changes. npm 10.9 drops the libc fields that newer npm writes, so the lockfile was rebuilt from master's with only these changes, and all 38 libc fields stay.

Simply removing the override and running npm install does not work. npm keeps vite-plus because oxfmt and oxlint list it as an optional peer, and without the override it brings back vite-plus's own oxfmt 0.52.0 and tinypool. The lockfile entries for vite-plus had to go so that npm would prune it.

Verification

Node v22.23.4, npm 10.9.9.

• npm ci installs 492 packages, down from 515. npm ls --all exits 0, and npm ls vite-plus --all is empty. oxfmt 0.73.0 and oxlint 1.88.0 resolve and run.
• npm audit no longer lists vite-plus. The remaining fast-uri and undici (via wrangler) advisories are on master too.
• npm run lint, npm run format:check, npm run typecheck, npm run build and npm run docs:build pass.
• npm run test passes. svelte-check checks 22 files with 0 errors and 0 warnings, and Vitest passes 126 files and 2,782 tests.
• npm run test:tooling passes 6 files and 41 tests.
• npm run size reports 314,268 raw bytes and 101,575 gzip bytes, the same as master. cmp against master's build is equal, and SHA-256 is 04ea3cf14d5dab0da54f7a48d4340b3b045b31402c0ec734c200cbfb13dad5df.
• The real runner ran against a freshly provisioned vault, podnotes-build-obsidian-e2e-0-14, in isolated Obsidian 1.14.4 on headless Linux:
  • npm run test:e2e -- tests/e2e/settings-tab.test.ts tests/e2e/journey-player.test.ts passes 2 files and 22 tests.
  • npm run obsidian:e2e -- eval code='Boolean(app.plugins.plugins.podnotes)' returns true, and dev:errors reports no errors.
  • The obsidian-e2e/capture path works. npm run screenshot:e2e-obsidian, capture:e2e-obsidian -- screenshot, record:e2e-obsidian and capture:e2e-obsidian -- sheet all produce the expected PodNotes view.
  • npm run stop:e2e-obsidian stops the instance, and --dry-run reports pids: none.

The 0.14.0 runner and capture code is unchanged apart from bundler output, such as constant folding and @__PURE__ annotations. PodNotes uses neither obsidian-e2e/matchers nor vite-plus/test, so the 0.14.0 matcher change does not apply here.

Release impact

None. This is a dev dependency only. No settings, storage, public API or URI changes.

---

Note

Low Risk
Dev-only dependency and lockfile cleanup with no runtime or main.js changes; main risk is e2e tooling behavior on the new obsidian-e2e release.

Overview
Bumps the dev dependency obsidian-e2e from ^0.13.0 to ^0.14.0 and refreshes package-lock.json so vite-plus and its large transitive dev tree are pruned from the install.

obsidian-e2e 0.14.0 no longer requires vite-plus as a peer, which clears the path for resolving Dependabot alerts tied to vite-plus 0.1.24. The package.json overrides entry that forced vite-plus’s nested oxfmt to match the repo’s formatter is removed because that workaround only existed while obsidian-e2e pulled in vite-plus.

There are no application or shipped artifact changes—only dependency and lockfile updates. E2E still goes through scripts/obsidian-e2e.mjs and the obsidian-e2e runner APIs unchanged in this repo.

^{Reviewed by Cursor Bugbot for commit 92a354e. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Bump obsidian-e2e dev dependency from ^0.13.0 to ^0.14.0

Updates the dev dependency range in package.json and regenerates package-lock.json. Also removes the vite-plus oxfmt formatter mapping. Behavioral Change: installs now resolve obsidian-e2e 0.14.x instead of 0.13.x.

^{Macroscope summarized 92a354e.}

[cloudflare-workers-and-pages]

Deploying podnotes with    Cloudflare Pages

Latest commit:	92a354e
Status:	✅  Deploy successful!
Preview URL:	https://5c14011c.podnotes.pages.dev
Branch Preview URL:	https://build-obsidian-e2e-0-14.podnotes.pages.dev

View logs