Repository navigation
Build(deps): bump @vitest/mocker and vitest in /desktop/renderer - #270
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
Bumps [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker) to 4.1.12 and updates ancestor dependency [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). These dependencies need to be updated together. Updates `@vitest/mocker` from 4.1.6 to 4.1.12 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.12/packages/mocker) Updates `vitest` from 4.1.6 to 4.1.12 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.12/packages/vitest) --- updated-dependencies: - dependency-name: "@vitest/mocker" dependency-version: 4.1.12 dependency-type: indirect - dependency-name: vitest dependency-version: 4.1.12 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/desktop/renderer/multi-456d42d8d4
branch
from
October 27, 2026 08:18
aaa661d to
063534c
Compare
Collaborator
|
Superseded by #284, rebuilt on current main. It updates only the eight aligned renderer Vitest packages to 4.1.12, preserves the jschardet resolved URL and unrelated dependency versions, and passes both normal npm ci installs, 827 renderer tests, 18 desktop Node regressions, and the production build. The replacement documents unchanged lint/audit findings and CI limitations. |
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
Angnuo (angnuoli)
added a commit
that referenced
this pull request
Oct 28, 2026
## Summary - Replace stale Dependabot #270 on current `main` (`ecbae592a053f24f0c8b92a6dbdde2ece3f25dcb`). - Raise the renderer Vitest manifest minimum to `^4.1.12` and update its eight aligned Vitest packages from `4.1.6` to `4.1.12`. - Include the published fixes for GHSA-82fw-gwwq-j7x9 and GHSA-qxg6-89mg-rqv8. - Keep the existing `[email protected]` resolved URL, Vite `6.4.4`, `[email protected]`, `[email protected]`, and every non-Vitest package entry unchanged. Unlike the old PR, do not remove the jschardet URL or update unrelated transitive packages. - Leave desktop/main-process Vitest `4.1.5` and its lockfile unchanged. Only two renderer dependency files change. ## Validation - Normal `npm ci` in `desktop`, including its renderer postinstall: passed. - Separate normal `npm ci` in `desktop/renderer`: passed. Neither command uses `--ignore-scripts`; existing npm install-script approval policy is unchanged. - Exact SHA-256 manifest/lock hashes remain unchanged after both installs. - All eight downloaded tarballs match the expected SHA-512 lock integrity. Their metadata and all 221 published files match the installed packages. - Structural lock comparison confirms only the root Vitest range and the eight approved package entries changed. Published mock redirect allowlist and string serialization hardening are present. - Full renderer tests before and after the update: 55 files, 827 passed, 2 skipped. - Desktop Node regression suite: 18 passed. - `npm run build` in `desktop` (TypeScript plus renderer production build): passed using Vite `6.4.4`. - Renderer lint: no errors, 83 existing warnings; findings exactly match the fresh baseline. - Desktop lint: the same 2 existing errors and 57 warnings as the baseline (`no-control-regex` in `chat-attachments.ts`, unused `readJsonObject` in `openclaw-upgrade-recovery.ts`). No unrelated lint changes. - Lockfile-only npm audit: the two Vitest-related moderate findings disappear (7 findings before, 5 after); the five unrelated high findings are unchanged and are not addressed by this scoped PR. - `git diff --check`: passed. ## Limitations - Full Electron-driven desktop tests and an installer smoke test are not claimed: the current npm install-script policy does not install the Electron runtime. The policy was not weakened to make validation pass. - Production build reports annotation/chunk-size warnings; build succeeds. - Original developer checkout and its two pre-existing local changes are untouched. ## Merge - Close superseded #270 and manually squash merge this replacement after checking its exact head, base, and repository rules. Do not use auto-merge, admin overrides, or required-check bypasses.
dependabot
Bot
deleted the
dependabot/npm_and_yarn/desktop/renderer/multi-456d42d8d4
branch
October 28, 2026 09:32
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps @vitest/mocker to 4.1.12 and updates ancestor dependency vitest. These dependencies need to be updated together.
Updates
@vitest/mockerfrom 4.1.6 to 4.1.12Release notes
Sourced from @vitest/mocker's releases.
... (truncated)
Commits
4766ce1chore: release v4.1.12 (#11610)b825313fix(mocker): harden manual and redirect mocks [backport to v4] (#11580)9bd8d46chore: release v4.1.11 (#10995)fe5a11dfix(mocker): restrict redirect mocks to the fs allowlist [backport to v4] (#1...db616d2chore: release v4.1.10 (#10718)a7a61e7chore: release v4.1.9 (#10598)2c9559cfix(mocker): hoist vi.mock() for vite-plus/test imports [backport to v4] (#10...e61f2ddchore: release v4.1.8a09d472chore: release v4.1.7Updates
vitestfrom 4.1.6 to 4.1.12Release notes
Sourced from vitest's releases.
... (truncated)
Commits
4766ce1chore: release v4.1.12 (#11610)5bf2197chore: delete wdio folder from v4 branch to avoid falsy release (#11581)9bd8d46chore: release v4.1.11 (#10995)9851dbcfix(browser): trigger playwright/chromium gc on lower disk availability [back...db616d2chore: release v4.1.10 (#10718)bae52b5fix(vm): fix external module resolve error with deps optimizer query for enco...a7a61e7chore: release v4.1.9 (#10598)934b0f5fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...7fb2965fix(browser): wait for orchestrator readiness before resolving browser sessio...a518019fix: fiximportOriginalwith optimizer and query import [backport to v4] (#...