fix(typescript): update test dependencies#346
fix(typescript): update test dependencies#346NikolayS wants to merge 2 commits intomainNikolayS/PgQue:mainfrom agent/fix-typescript-audit-compliantNikolayS/PgQue:agent/fix-typescript-audit-compliantCopy head branch name to clipboard
Conversation
|
Real-user verification evidence This PR has chronological RED then GREEN history. RED commit cd clients/typescript
bun install --frozen-lockfile
bun audit --audit-level highResult: 2 vulnerabilities, one critical in direct Vitest and one high in transitive Vite. GREEN commit bun install --frozen-lockfile
bun audit --audit-level high
bun audit --production --audit-level high
bun run check
PGQUE_TEST_DSN=postgresql:///pgque_pr_rules_audit bun run test
bun run build
npm pack --dry-runBoth audits reported |
NikolayS
left a comment
There was a problem hiding this comment.
REV rubric review
Automated ultrareview quota was unavailable, so I executed the five official
REV rubric prompts manually. SOC2 findings were omitted as instructed. This is
a comment-only review, not an approval.
Blocking findings
None. I found no unresolved functional, security, documentation, or test
blocker on head c97359cb312e321567c1c92eed4da43f9c3ae0e5.
Rubric results
- Bug hunter: the dependency-only change leaves runtime client behavior and
packaging inputs unchanged. - Security reviewer: Vitest and transitive Vite are moved past the reviewed
critical/high advisories; the frozen lockfile and high-severity audit gates
protect CI plus both release paths. - Docs reviewer: the PR body records advisory identifiers, version rationale,
runtime-floor compatibility, and exact RED/GREEN evidence; public client API
documentation does not need a change. - Guidelines checker: commits are chronological
choreRED thenfixGREEN,
both allowed and under 50 characters; title is compliant and CI is green. - Test analyzer: I independently reproduced audit exit 1 with one critical and
one high finding before the dependency update, thenNo vulnerabilities found, typecheck, unit tests, build, and package smoke on the head. Full CI
run 29156035189 passed.
Nonblocking findings
None from the manual rubrics. No code change is requested by this review.
Summary
Fixes #344.
RED
With the audit-gate commit applied before the dependency update:
The findings were
GHSA-5xrq-8626-4rwpin direct Vitest andGHSA-fx2h-pf6j-xcffin transitive Vite.GREEN
bun install --frozen-lockfilepassed;bun audit --audit-level highreported no vulnerabilities;bun audit --production --audit-level highreported no vulnerabilities;bun run checkpassed;bun run test:85 passed;bun run buildpassed;npm pack --dry-runproduced the expected 14-file package;git diff --checkpassed.Official package metadata confirms Vitest 3.2.6 and Vite 6.4.3 support the package's Node 20 runtime floor.
This is intentionally a draft and has not been merged.