build(deps): move the web UI to Vite 7 and Vitest 4 - #647
Merged
Conversation
haksungjang
added
the
run-heavy-e2e
Seven of the eight advisories `npm audit` reported on this package tree came from the build toolchain, and none of them could be fixed on its own: esbuild's dev-server CORS issue is fixed by the Vite that depends on it, and Vite's own path-traversal and Windows `server.fs.deny` bypass need a major. Vitest's was the serious one — with its UI server listening, an arbitrary file can be read and executed — and that needs a major too. Vite 7 rather than 8: 7.3.6 is past every advisory range, and @vitejs/plugin-react 4.7.0 already accepts it as a peer, so the plugin stays where it is. Vite 8 would have taken the plugin with it. Nothing else moved. The build output is byte-identical enough that all thirty-three visual baselines pass unchanged, the ninety Playwright tests pass, and the 315 unit tests pass. Coverage thresholds are re-baselined, not lowered in spirit: Vitest 4's v8 provider remaps through the AST instead of counting raw v8 ranges, so the same tests over the same code measure branches at 69.38% where they measured 82%, and functions at 81.79% where they measured 88%. The comment in the config says so, and the new numbers sit just under the new measurement exactly as the old ones sat under the old. One advisory is left: nanoid, whose fix shipped five days ago. We do not call nanoid, and taking a release that fresh to fix a defect we cannot reach is the wrong trade. Dependabot security updates are on now and will bring it when it has aged.
haksungjang
force-pushed
the
chore/vite7-vitest4
branch
from
August 8, 2026 13:49
1e2ca06 to
f6cf130
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Seven of the eight advisories
npm auditreported on this tree came from the build toolchain, and none could be fixed alone.npm auditWhat each one was:
.maphandling,server.fs.denybypass on Windows alternate paths, launch-editor NTLM disclosure. Needs a major.Vite 7, not 8. 7.3.6 is past every advisory range, and
@vitejs/plugin-react@4.7.0already lists^7as an accepted peer — so the plugin stays put. Vite 8 would have dragged it along (plugin-react 6 peers^8only). One major instead of two, with less to break.Node. Vite 7 wants
^20.19 || >=22.12. The image build stage isnode:26-alpineand the pinned Playwright container is Node 24.17. Both clear it.Nothing else moved. All 33 visual baselines pass unchanged — the toolchain bump did not alter a pixel — along with 90 Playwright tests and 315 unit tests.
Coverage thresholds are re-baselined, not relaxed. Vitest 4's v8 provider remaps coverage through the AST rather than counting raw v8 ranges, so the same tests over the same code measure branches at 69.38% (was 82%) and functions at 81.79% (was 88%). Nothing stopped being tested. The new thresholds sit just under the new measurement exactly as the old ones sat under the old, and the config comment records why.
One advisory left.
nanoid— the fix shipped five days ago. We do not call nanoid, and pulling a release that fresh to fix a defect we cannot reach trades a real supply-chain risk for a theoretical one. Dependabot security updates were switched on for this repository today and will bring it once it has aged.Local gates: build, typecheck, 315 unit tests, coverage thresholds, 90 Playwright UI tests, 33 visual baselines, token lint, i18n coverage, lib-test-gate, third-party notices (23 bundled packages, all with license text).