Skip to content

upgrade vitest to address vite security vulnerability #37

@williamstein

Description

@williamstein

Doing "pnpm audit" shows a moderate vulnerability from vite. It seems to fix this the best way is to upgrade vitest. However, that breaks all tests due to commonjs issues:

...
 FAIL  dist/lib/test/websocket/websocket-proxy.test.js [ dist/lib/test/websocket/websocket-proxy.test.js ]
Error: Vitest cannot be imported in a CommonJS module using require(). Please use "import" instead.

If you are using "import" in your source code, then it's possible it was bundled into require() automatically by your bundler. In that case, do not bundle CommonJS output since it will never work with Vitest, or use dynamic import() which is available in all CommonJS modules.
 ❯ Object.<anonymous> node_modules/.pnpm/vitest@4.0.8_@types+debug@4.1.12_@types+node@22.15.12/node_modules/vitest/index.cjs:1:7
 ❯ dist/lib/test/websocket/websocket-proxy.test.js:54:18
     52| const socket_io_1 = require("socket.io");
     53| const socket_io_client_1 = require("socket.io-client");
     54| const vitest_1 = require("vitest");
       |                  ^
     55| const httpProxy = __importStar(require("../.."));
     56| const get_port_1 = __importDefault(require("../get-port"));

⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[34/34]⎯


 Test Files  34 failed | 34 passed (68)
      Tests  283 passed (283)
   Start at  09:09:55
   Duration  3.05s (transform 1.15s, setup 503ms, collect 3.93s, tests 5.35s, environment 10ms, prepare 304ms)

 ELIFECYCLE  Test failed. See above for more details.
wstein@lite:~/build/http-proxy-3$ 

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions