chore(security): bump fast-uri, undici, vitest to fix CVEs - #815
Conversation
|
|
Warning Review limit reachedNext included review available in 11 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (20)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
View your CI Pipeline Execution ↗ for commit d2117fe
💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗ ☁️ Nx Cloud last updated this comment at |
@forgerock/davinci-client
@forgerock/device-client
@forgerock/journey-client
@forgerock/oidc-client
@forgerock/protect
@forgerock/sdk-types
@forgerock/sdk-utilities
@forgerock/iframe-manager
@forgerock/sdk-logger
@forgerock/sdk-oidc
@forgerock/sdk-request-middleware
@forgerock/storage
commit: |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #815 +/- ##
===========================================
+ Coverage 18.07% 96.29% +78.22%
===========================================
Files 155 1 -154
Lines 24398 81 -24317
Branches 1203 17 -1186
===========================================
- Hits 4410 78 -4332
+ Misses 19988 3 -19985 🚀 New features to boost your workflow:
|
|
Deployed 1c8ca4f to https://ForgeRock.github.io/ping-javascript-sdk/pr-815/1c8ca4f3013a41142dec6ef9b51338cda9b5d7af branch gh-pages in ForgeRock/ping-javascript-sdk |
📦 Bundle Size Analysis📦 Bundle Size Analysis🆕 New Packages🆕 @forgerock/device-client - 0.0 KB (new) 📊 Minor Changes📈 @forgerock/sdk-types - 9.1 KB (+0.0 KB) ➖ No Changes➖ @forgerock/recognize - 4284.4 KB 15 packages analyzed • Baseline from latest Legend🆕 New package ℹ️ How bundle sizes are calculated
🔄 Updated automatically on each push to this PR |
![nx-cloud[bot]](https://avatars.githubusercontent.com/in/80458?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
788b120 to
3a243fd
Compare
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
There was a problem hiding this comment.
Important
At least one additional CI pipeline execution has run since the conclusion below was written and it may no longer be applicable.
Nx Cloud is proposing a fix for your failed CI:
We restored reuseExistingServer: true in both davinci-suites and journey-suites playwright configs to fix the port 5829 conflict that was causing all e2e-ci tasks to fail. The PR changed davinci-suites to reuseExistingServer: !process.env.CI (false in CI) expecting the "..." nx.json serialization to prevent concurrent server starts, but that serialization only applies within a single project — the two suites can still run concurrently and race for port 5829. With reuseExistingServer: true restored, concurrent tasks across both suites safely share whichever server is already listening on the port.
Suggested Fix changes
diff --git a/e2e/davinci-suites/playwright.config.ts b/e2e/davinci-suites/playwright.config.ts
index 19e6fa5..5527bee 100644
--- a/e2e/davinci-suites/playwright.config.ts
+++ b/e2e/davinci-suites/playwright.config.ts
@@ -37,7 +37,7 @@ const config: PlaywrightTestConfig = {
command: 'pnpm nx serve @forgerock/davinci-app',
port: 5829,
ignoreHTTPSErrors: true,
- reuseExistingServer: !process.env.CI,
+ reuseExistingServer: true,
cwd: workspaceRoot,
},
].filter(Boolean),
diff --git a/e2e/journey-suites/playwright.config.ts b/e2e/journey-suites/playwright.config.ts
index 85229ca..be8aa3b 100644
--- a/e2e/journey-suites/playwright.config.ts
+++ b/e2e/journey-suites/playwright.config.ts
@@ -34,14 +34,14 @@ const config: PlaywrightTestConfig = {
command: 'pnpm nx serve @forgerock/journey-app',
port: 5829,
ignoreHTTPSErrors: true,
- reuseExistingServer: !process.env.CI,
+ reuseExistingServer: true,
cwd: workspaceRoot,
},
{
command: 'pnpm nx serve am-mock-api',
port: 9443,
ignoreHTTPSErrors: true,
- reuseExistingServer: !process.env.CI,
+ reuseExistingServer: true,
cwd: workspaceRoot,
},
].filter(Boolean),
Warning
Or Apply changes locally with:
npx nx-cloud apply-locally YoR7-zbee
Apply fix locally with your editor ↗ View interactive diff ↗
🎓 Learn more about Self-Healing CI on nx.dev
9c8d91a to
3a243fd
Compare
3a243fd to
d897079
Compare
Both e2e suites' apps share port 5829 (CORS prevents distinct ports), so atomized e2e-ci tasks from both suites could interleave on the same Nx Cloud agent. A leaked dev server would then be wrongly reused across suites. Assignment rules isolate each suite's e2e-ci tasks to dedicated agents: davinci/journey e2e tasks now route to isolated agent pools (using the linux-medium-js template, as custom template names are not supported — the rules still create separate per-suite agent allocations).
3 participants
Summary
Bumps dependencies flagged by the Mend Security Check to their patched versions:
fast-uri(pnpm override)undici(pnpm override)vitest(catalog)@vitest/coverage-v8(catalog)@vitest/ui(root devDep)Vitest 4 migration notes
vi.restoreAllMocks()no longer resets plainvi.fn()mocks (spies only) in vitest 4. One test file (oidc-client/src/lib/authorize.request.utils.test.ts) relied on the old behavior; fixed with an explicitvi.clearAllMocks()inbeforeEach.@effect/vitest@0.27.x peer-declaresvitest: ^3.2.0(no v4 range published yet). All tests pass under vitest 4 —it.effectworks — but the peer range is not yet updated upstream. Flagging for awareness.vitest-canvas-mock@1.1.3explicitly supports^4.0.0. No change needed.Verification
pnpm nx run-many -t typecheck lint build --no-agents— passespnpm nx run-many -t test --no-agents— all unit tests pass (only the 1-file vitest-4 fix above was needed)Context
The
fix-import-orderPR (#683) previously carried the fast-uri/undici bumps; this PR is the standalone dependency-security PR containing those plus the vitest 4 migration, branched from currentmain.Related tracked issues: #731, #775