From 85cfb05bde2425d6038f3fde2efbed2130bba2fa Mon Sep 17 00:00:00 2001 From: Valeh Date: Sat, 9 May 2026 16:02:18 +0400 Subject: [PATCH] fix(deps): unblock test suite after vitest 4 + pytest 9 dependabot bumps MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two regressions surfaced once dependabot's npm and pip bumps landed on main alongside the credential-grid PR: 1. packages/core/tests/kdf.test.ts used the trailing-options form `describe(name, fn, opts)` which vitest 3 deprecated and vitest 4 removed. Move the `{ timeout: 30_000 }` to the second positional arg per the new signature. 25/26 vitest tests pass again (1 skipped is the network-bound integration suite). 2. server/pyproject.toml pinned `pytest-asyncio==0.24.0`, which caps at pytest<8.4 and so refused to install alongside `pytest==9.0.3` from the dependabot bump. The 1.x line is the first that supports pytest 9 — bump to `pytest-asyncio==1.3.0`. 32/32 pytest tests pass with 83% coverage restored. Lockfile drift: npm tightened the `vitest` constraint from `^4.1.5` to the exact version after `npm install`; included so the committed lockfile matches the resolver's canonical output. Co-Authored-By: Claude Opus 4.7 (1M context) --- package-lock.json | 2 +- packages/core/tests/kdf.test.ts | 4 ++-- server/pyproject.toml | 4 +++- 3 files changed, 6 insertions(+), 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index 25484ac..abe1336 100644 --- a/package-lock.json +++ b/package-lock.json @@ -2359,7 +2359,7 @@ "devDependencies": { "@types/node": "22.10.2", "typescript": "5.6.3", - "vitest": "^4.1.5" + "vitest": "4.1.5" } }, "packages/extension": { diff --git a/packages/core/tests/kdf.test.ts b/packages/core/tests/kdf.test.ts index b4a2d59..daef7a5 100644 --- a/packages/core/tests/kdf.test.ts +++ b/packages/core/tests/kdf.test.ts @@ -12,7 +12,7 @@ const fastParams: KdfParams = { parallelism: 1, }; -describe("KDF", () => { +describe("KDF", { timeout: 30_000 }, () => { it("derives a 32-byte master key", async () => { const key = await deriveMasterKey("correct-horse-battery-staple", fastParams); expect(key).toBeInstanceOf(Uint8Array); @@ -63,4 +63,4 @@ describe("KDF", () => { const k2 = await deriveAuthKey(masterKey, "different-password"); expect(k1).not.toBe(k2); }); -}, { timeout: 30_000 }); +}); diff --git a/server/pyproject.toml b/server/pyproject.toml index b15c4cf..c0adc39 100644 --- a/server/pyproject.toml +++ b/server/pyproject.toml @@ -28,7 +28,9 @@ dependencies = [ [project.optional-dependencies] dev = [ "pytest==9.0.3", - "pytest-asyncio==0.24.0", + # pytest-asyncio 0.24 capped at pytest<8.4; 1.x is the first line that + # supports pytest 9. + "pytest-asyncio==1.3.0", "pytest-cov==6.0.0", "httpx==0.28.1", "aiosqlite==0.20.0",