chore(test): move the VeRT harness off the 2020 jest tree - #16
Merged
Conversation
jest 25 dates from January 2020 and pulls a dependency tree that carries a critical advisory (form-data unsafe boundary) plus deprecated request, node-notifier and tough-cookie. jest 27 dropped the jsdom and request chain those come through, so upgrading removes them from the tree entirely rather than patching around them. Nothing in the suite depends on jest 25 behavior: the same 6 suites and 220 tests pass unchanged. @vaulta/vert sat in dependencies, which is what made its transitive advisories report as runtime scope on a repository whose only shipped artifact is a wasm built from C++. It is the test harness and belongs in devDependencies. The bn.js advisories are cleared by letting the two lock entries re-resolve inside the ^4.11.9 and ^5.2.0 ranges they already declare, which yields 4.12.5 and 5.2.5. A forced resolution was rejected: a global bn.js pin collapses the copy vert resolves for @wharfkit/antelope from 5.x to 4.x, and a green suite does not prove a downgraded crypto library is safe. elliptic 6.6.1 has no patched release and stays.
There was a problem hiding this comment.
Pull request overview
Updates the repository’s JavaScript test harness dependencies to remove an outdated Jest dependency tree that was introducing multiple development-scope security advisories, while correctly classifying the VeRT harness as development-only.
Changes:
- Moves
@vaulta/vertfromdependenciestodevDependenciesto reflect its test-harness role. - Upgrades
jestfrom^25.1.0to^30.4.2.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The test harness pinned
jest@^25.1.0, released January 2020. Its dependency tree is where every development-scope advisory on this repository came from, including the critical one:form-data@2.3.3(unsafe boundary selection), plus deprecatedrequest@2.88.2,node-notifier@6.0.0andtough-cookie@2.5.0. jest 27 dropped the jsdom and request chain that pulls those in, so moving to jest 30 removes them from the tree outright rather than patching each one.@vaulta/vertwas declared independencies. It is the test harness, and this repository ships a wasm built from C++ with no npm runtime at all, so its transitive advisories were reporting as runtime scope on a package that has no runtime. Moving it todevDependenciesstates what it is.The two
bn.jsadvisories clear by letting the lock entries re-resolve inside the^4.11.9and^5.2.0ranges they already declare, giving 4.12.5 and 5.2.5. A forced resolution was tried first and rejected: a globalbn.jspin collapses the copy vert resolves for@wharfkit/antelopefrom 5.x to 4.x, and a green suite does not prove a downgraded crypto library is safe.elliptic@6.6.1has no patched release and is unchanged.This mirrors atomicassets-contract#30.
Validation
6 suites and 220 tests pass on jest 30, identical to jest 25 on the same commit, built with the CDT the workflow pins. Verified against the installed tree that
form-data,request,node-notifier,tough-cookieandbracesare gone rather than merely upgraded.No contract source changes.