test: fix CI regressions from namespaced storage key and docked sidebar#152
Merged
Merged
Conversation
- AppConfig.test.tsx hardcoded the pre-namespacing sessionStorage key; update to use getPluginStorageKey (broken since the namespace-storage-key fix, never caught because that PR did not touch this test). - The session sidebar became a persistent docked panel (open by default, no longer closes on new-chat) in #143, but e2e specs still assumed the old closed-by-default modal. Update sessionManagement/sessionSharing/ chat specs: disambiguate the header Chat history / New chat buttons from the sidebar's own New Chat and Clear All History controls (both now simultaneously in the DOM), and drop the stale sidebar-closes-on-new-session assertion. - sidePanel.spec.ts's DOM heuristic (first 3-child div under [role=main]) now matches the docked sidebar instead of the SplitLayout pane; scope it to the existing [data-plugin-split-layout] marker instead. All 491 unit tests and all 38 Playwright e2e tests pass locally. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Both transitive copies (via i18next-parser/eslint/postcss-loader on 4.x, and via babel-plugin-istanbul on 3.x) were vulnerable to CVE-2026-59869 (GHSA-52cp-r559-cp3m, quadratic CPU consumption via YAML merge-key chains). No direct dependency to bump; overrides is already the established pattern here for dompurify/lodash-es. This is required for the plugin-validator osv-scanner gate (Build, lint and unit tests / Validate plugin) to pass. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Both are transitive (cheerio -> undici, jsdom -> ws) and their parent packages already allow the patched range, so this only pins the floor: - undici < 7.28.0 is vulnerable to several HIGH CVEs (2026-6734, 2026-9697, 2026-12151); patched in 7.28.0. - ws < 8.21.0 is vulnerable to CVE-2026-48779 (fragment-count DoS); patched in 8.21.0. Closes out the remaining plugin-validator osv-scanner findings on this branch (js-yaml was fixed in the previous commit). Local 'npm run validate' now only reports the documented benign findings (unsigned plugin, stale Go SDK, sponsor link). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
AppConfig.test.tsxhardcoded the pre-namespacing sessionStorage key (ask-o11y.settings.activeTab); it now usesgetPluginStorageKey('settings.activeTab')to match production code. Broken since the "fix: namespace storage key" commit, which never touched this test.sessionManagement/sessionSharing/chate2e specs still assumed the old closed-by-default modal, causing ambiguous "History"/"New Chat" locator matches against the sidebar's own always-visible "Clear All History" and "+ New Chat" controls. Disambiguated header button locators and dropped the stale "sidebar closes on new session" assertion.sidePanel.spec.ts's DOM heuristic (first 3-childdivunder[role="main"]) started matching the now-larger docked sidebar markup instead of the actualSplitLayoutpane. Scoped it to the existing[data-plugin-split-layout]marker instead.Build, lint and unit tests / Validate pluginstep (plugin-validator's osv-scanner) failing independently of the above: real HIGH-severity CVEs already onmainin transitive depsjs-yaml(CVE-2026-59869),undici(CVE-2026-6734/9697/12151), andws(CVE-2026-48779). None have a direct dependency to bump, so addedoverridesentries (same established pattern asdompurify/lodash-es) pinning all three to their patched versions.Fixes the failing
Build, lint and unit testsandE2E Tests with Coveragechecks on main (been red since PR #143 / the storage-key fix, ~1 month).Test plan
npm run test:ci— 491/491 passednpm run typecheck,npm run lint— cleango test ./pkg/...— passednpm run build— passeddocker compose up -d grafana— 38/38 passednpm run validate— osv-scanner clean; only documented benign findings remain (unsigned plugin, stale Go SDK, sponsor link)🤖 Generated with Claude Code