Skip to content

chore(test): move the VeRT harness off the 2020 jest tree - #30

Merged
robrigo merged 1 commit into
mainfrom
chore/modernize-test-toolchain
Jul 16, 2026
Merged

chore(test): move the VeRT harness off the 2020 jest tree#30
robrigo merged 1 commit into
mainfrom
chore/modernize-test-toolchain

Conversation

@robrigo

@robrigo robrigo commented Jul 16, 2026

Copy link
Copy Markdown
Contributor

Why

The test harness pinned jest@^25.1.0, released January 2020. Its dependency tree is where every development-scope advisory on this repository came from, including the critical one: form-data@2.3.3 (unsafe boundary selection), plus deprecated request@2.88.2, node-notifier@6.0.0 and tough-cookie@2.5.0. jest 27 dropped the jsdom and request chain that pulls those in, so moving to jest 30 removes them from the tree outright rather than patching each one.

@vaulta/vert was declared in dependencies. It is the test harness, and this repository ships a wasm built from C++ with no npm runtime at all, so its transitive advisories were reporting as runtime scope on a package that has no runtime. Moving it to devDependencies states what it is.

Refreshing the lockfile picks up bn.js 4.12.5 and 5.2.5 inside the ranges already declared, which clears both bn.js advisories. A forced resolution was tried first and rejected: a global bn.js pin collapses the copy vert resolves for @wharfkit/antelope from 5.x to 4.x, and a green suite does not prove a downgraded crypto library is safe. elliptic@6.6.1 has no patched release and is unchanged.

Validation

40 suites and 325 tests pass on jest 30, identical to jest 25 on the same commit, built with the CDT 4.1.1 the workflow pins. Verified against the installed tree that form-data, request, node-notifier, tough-cookie and braces are gone rather than merely upgraded.

No contract source changes, so the wasm and ABI published in v2.0.0-rc5 are unaffected.

jest 25 dates from January 2020 and pulls a dependency tree that carries a critical advisory (form-data unsafe boundary) plus deprecated request, node-notifier and tough-cookie. jest 27 dropped the jsdom and request chain those come through, so upgrading removes them from the tree entirely rather than patching around them. Nothing in the suite depends on jest 25 behavior: the same 40 suites and 325 tests pass unchanged.

@vaulta/vert sat in dependencies, which is what made its transitive advisories report as runtime scope on a repository whose only shipped artifact is a wasm built from C++. It is the test harness and belongs in devDependencies.

Refreshing the lockfile also picks up bn.js 4.12.5 and 5.2.5 within the ranges already declared, which clears both bn.js advisories without forcing a resolution. elliptic 6.6.1 has no patched release and stays.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR modernizes the repository’s JavaScript test harness by upgrading Jest from an older 2020-era dependency tree and correctly scoping the VeRT harness as a development-only dependency, aligning with the repo’s non-runtime (Wasm/C++) nature.

Changes:

  • Move @vaulta/vert from dependencies to devDependencies to reflect that it is only used for testing.
  • Upgrade jest from ^25.1.0 to ^30.4.2.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@robrigo
robrigo merged commit e748b81 into main Jul 16, 2026
2 checks passed
@robrigo
robrigo deleted the chore/modernize-test-toolchain branch July 16, 2026 04:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants