chore(test): move the VeRT harness off the 2020 jest tree - #30
Merged
Conversation
jest 25 dates from January 2020 and pulls a dependency tree that carries a critical advisory (form-data unsafe boundary) plus deprecated request, node-notifier and tough-cookie. jest 27 dropped the jsdom and request chain those come through, so upgrading removes them from the tree entirely rather than patching around them. Nothing in the suite depends on jest 25 behavior: the same 40 suites and 325 tests pass unchanged. @vaulta/vert sat in dependencies, which is what made its transitive advisories report as runtime scope on a repository whose only shipped artifact is a wasm built from C++. It is the test harness and belongs in devDependencies. Refreshing the lockfile also picks up bn.js 4.12.5 and 5.2.5 within the ranges already declared, which clears both bn.js advisories without forcing a resolution. elliptic 6.6.1 has no patched release and stays.
There was a problem hiding this comment.
Pull request overview
This PR modernizes the repository’s JavaScript test harness by upgrading Jest from an older 2020-era dependency tree and correctly scoping the VeRT harness as a development-only dependency, aligning with the repo’s non-runtime (Wasm/C++) nature.
Changes:
- Move
@vaulta/vertfromdependenciestodevDependenciesto reflect that it is only used for testing. - Upgrade
jestfrom^25.1.0to^30.4.2.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The test harness pinned
jest@^25.1.0, released January 2020. Its dependency tree is where every development-scope advisory on this repository came from, including the critical one:form-data@2.3.3(unsafe boundary selection), plus deprecatedrequest@2.88.2,node-notifier@6.0.0andtough-cookie@2.5.0. jest 27 dropped the jsdom and request chain that pulls those in, so moving to jest 30 removes them from the tree outright rather than patching each one.@vaulta/vertwas declared independencies. It is the test harness, and this repository ships a wasm built from C++ with no npm runtime at all, so its transitive advisories were reporting as runtime scope on a package that has no runtime. Moving it todevDependenciesstates what it is.Refreshing the lockfile picks up
bn.js4.12.5 and 5.2.5 inside the ranges already declared, which clears bothbn.jsadvisories. A forced resolution was tried first and rejected: a globalbn.jspin collapses the copy vert resolves for@wharfkit/antelopefrom 5.x to 4.x, and a green suite does not prove a downgraded crypto library is safe.elliptic@6.6.1has no patched release and is unchanged.Validation
40 suites and 325 tests pass on jest 30, identical to jest 25 on the same commit, built with the CDT 4.1.1 the workflow pins. Verified against the installed tree that
form-data,request,node-notifier,tough-cookieandbracesare gone rather than merely upgraded.No contract source changes, so the wasm and ABI published in v2.0.0-rc5 are unaffected.