Fix flaky TriangleModelWindow tests and clear critical dependency advisories - #8
Merged
Merged
Conversation
…sdom tests The TriangleModelWindow tests idle at ~0.5s each but inflate ~10x when parallel vitest workers contend for CPU on a loaded machine, tripping the default 5s testTimeout (reproduced: 'Test timed out in 5000ms' under induced load). Raise testTimeout to 20s and testing-library's asyncUtilTimeout to 5s — both are give-up bounds, so green runs pay nothing, and waitFor failures keep their informative DOM-dump errors. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
bun update within existing semver ranges (45 packages, no majors): vitest 3.2.7 fixes the critical UI-server arbitrary file read (GHSA-5xrq-8626-4rwp); postcss 8.5.26, axios 1.20.0, lodash 4.18.1, and jsdom 28.1.0 clear their advisories. Also dropped two stale nested postcss@8.5.6 lockfile entries whose ranges already allowed the fixed version. Audit: 86 -> 30 findings, zero critical. Verified: vite build, lint, and the full test suite twice (268/268). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The bare test/ pattern matched at any depth, so new files under the tracked frontend/src/test/ vitest setup directory were silently ignored. /test/ keeps ignoring only the top-level scratch directory. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
vite 5.4.21 -> 8.2.2 (Rolldown bundler, builds drop from ~6s to ~1.5s), @vitejs/plugin-react-swc 3 -> 4, vitest 3.2.7 -> 4.1.11, jsdom 28 -> 30. Clears the esbuild dev-server CORS advisory and the rollup/vite path-traversal advisories that vite 5 pinned us to (audit 30 -> 25). Migration fallout, all behavior-preserving: - Rolldown's stricter parser caught a real duplicate mountApp import in src/embed/index.ts that rollup silently tolerated. - vitest 4 spies pass `new` through to the implementation, so the ResizeObserver/IntersectionObserver/uPlot constructor mocks move from arrow implementations to constructible functions. - Config files use import.meta.dirname instead of __dirname (vite 8 native config loader deprecation). Verified: vite build, demo build, lint, and the full suite (268/268). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
tsc --noEmit had 72 long-standing errors that CI never caught (it only
ran lint, vite build, and vitest; vite strips types without checking).
All fixes are behavior-preserving. Real bugs surfaced along the way: a
duplicate Tx_id key in a mock literal, dataBlocks mocked as [] where
the store uses {}, a FileTrigger isDisabled prop that react-aria never
accepted (the inner Button already handles disabling), and a dead
stopPropagation on a callback that is invoked without an event.
The uplot wheel-zoom plugin drops its hand-rolled UPlotInstance type
for real uPlot types plus null guards (re-declared as explicitly typed
consts, since guard narrowing does not reach hoisted nested handlers).
The triangle viewer reuses a module-level Vector2 for raycasting NDC
coordinates instead of an untyped literal.
frontend/package.json gains a typecheck script and ci.yml runs it
between lint and build so type errors cannot accumulate again.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The minor-tier npm update moved @tauri-apps/api to 2.11 and the plugin
packages forward, which desktop-validate rejects when the Rust crates
lag behind ('version mismatched Tauri packages'). Bump tauri to 2.11
and cargo-update the plugin crates so every npm/Rust pair is on the
same minor (verified with tauri info and cargo check).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The config has declared the v8 coverage provider all along, but the provider package was never installed, so vitest --coverage errored. Verified: full suite with --coverage passes (268/268, 65.8% stmts). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
TriangleModelWindow.test.tsxtests failed intermittently when the full suite ran on a loaded machine. Reproduced under induced CPU load: the failures are vitest's default 5stestTimeouttripping on the file's interaction-heaviest tests, which idle at ~0.5s but inflate ~10x under worker contention. RaisedtestTimeoutto 20s and testing-library'sasyncUtilTimeoutto 5s — both are give-up bounds, so green runs pay nothing.bun updateacross 45 packages within existing ranges. Clears the critical vitest UI-server arbitrary-file-read advisory (GHSA-5xrq-8626-4rwp) plus postcss, axios, lodash, and jsdom advisories. Audit findings drop 86 → 30 with zero critical.src/embed/index.tsthat Rolldown's stricter parser caught, constructible mock implementations for vitest 4 spies, andimport.meta.dirnamein configs.tsc --noEmithad 72 long-standing errors CI never caught (vite build strips types without checking). All fixed behavior-preservingly, surfacing several real bugs (duplicate object key,dataBlocks: []vs{}, an ineffectiveisDisabledprop, deadstopPropagation).frontend/package.jsongains atypecheckscript and CI now runs it between lint and build.test/pattern silently ignored new files under the trackedfrontend/src/test/; scoped it to/test/.Verification
vite build, demo build,eslint, and the full suite (268/268)tsc --noEmitclean (72 → 0); typecheck, lint, both builds, and tests all green on the final tree🤖 Generated with Claude Code