chore: upgrade vitest from v3 to v4 #14045
Conversation
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the WalkthroughThis PR upgrades Vitest from v3.1.3 to v4.0.15, updates test configuration files to align with Vitest 4's new APIs (replacing poolOptions with maxWorkers/isolate settings, switching from defineWorkspace to defineConfig), removes redundant coverage settings, and consolidates imports. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20–25 minutes
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
⛔ Files ignored due to path filters (1)
yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (5)
package.json(2 hunks)packages/frontend/apps/electron/vitest.config.ts(1 hunks)packages/frontend/core/src/modules/navigation/__tests__/utils.spec.ts(1 hunks)vitest.config.ts(1 hunks)vitest.workspace.ts(1 hunks)
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2025-11-27T03:23:11.880Z
Learnt from: CR
Repo: toeverything/AFFiNE PR: 0
File: packages/frontend/apps/ios/AGENTS.md:0-0
Timestamp: 2025-11-27T03:23:11.880Z
Learning: Applies to packages/frontend/apps/ios/**/*.{ts,tsx,js,jsx} : Follow ESLint/Prettier configuration from workspace root
Applied to files:
vitest.workspace.ts
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (20)
- GitHub Check: Build AFFiNE native (x86_64-unknown-linux-gnu)
- GitHub Check: E2E Mobile Test (1)
- GitHub Check: E2E Mobile Test (4)
- GitHub Check: E2E Test (5)
- GitHub Check: E2E Test (8)
- GitHub Check: E2E Test (4)
- GitHub Check: E2E BlockSuite Cross Browser Test (2, webkit)
- GitHub Check: E2E BlockSuite Cross Browser Test (1, webkit)
- GitHub Check: E2E Test (1)
- GitHub Check: E2E Test (2)
- GitHub Check: E2E BlockSuite Cross Browser Test (2, firefox)
- GitHub Check: Typecheck
- GitHub Check: E2E BlockSuite Cross Browser Test (2, chromium)
- GitHub Check: E2E BlockSuite Cross Browser Test (1, firefox)
- GitHub Check: loom thread test
- GitHub Check: miri code check
- GitHub Check: Lint
- GitHub Check: Analyze (typescript, blocksuite)
- GitHub Check: Analyze (javascript, affine)
- GitHub Check: Analyze (typescript, affine)
🔇 Additional comments (4)
packages/frontend/core/src/modules/navigation/__tests__/utils.spec.ts (1)
4-4: Good fix! Corrected import source forafterEach.The import consolidation correctly moves
afterEachfromnode:testtovitest. Previously, mixing Node.js's native test API with Vitest could lead to inconsistent behavior in test hooks.vitest.config.ts (1)
68-72: LGTM! Correctly removed deprecatedcoverage.alloption.The removal of the deprecated
all: falsecoverage option aligns with Vitest v4 changes while retaining the necessary Istanbul provider configuration.packages/frontend/apps/electron/vitest.config.ts (1)
27-28: Migration to Vitest v4 poolOptions is correct.The configuration correctly translates the old
poolOptions.forks.singleFork: truepattern tomaxWorkers: 1andisolate: falseaccording to the official Vitest v4 migration guide. This produces the intended single-worker, non-isolated test execution behavior. Note: if your tests relied on automatic module reset between files, add a setup file that callsvi.resetModules()in abeforeAllhook.vitest.workspace.ts (1)
1-11: Workspace configuration correctly uses Vitest v4 API.The migration from
defineWorkspace([...])todefineConfig({ test: { projects: [...] } })is the correct approach for Vitest v4+. The glob and path-based project entries are properly formatted and will be correctly discovered and executed by Vitest.
| "@vitest/browser": "4.0.15", | ||
| "@vitest/coverage-istanbul": "4.0.15", | ||
| "@vitest/ui": "4.0.15", |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
Vitest 4.0.15 release version npm registry
💡 Result:
I couldn't find [email protected] on the npm registry. The latest 4.x release I can find is 4.0.14 (per Snyk's package info). [1][2]
Sources:
- Snyk package info showing latest 4.0.14. [1]
- Vitest blog announcing Vitest 4.0. [2]
🌐 Web query:
Vitest latest version 2025
💡 Result:
The latest stable Vitest release is 4.0.6 (released Oct 31, 2025). [1][2]
Sources:
[1] Vitest blog — "Vitest 4.0 is out!" (Oct 22, 2025).
[2] Package release info listing vitest 4.0.6 (published Oct 31, 2025).
🌐 Web query:
Vitest 4.0.15 security vulnerabilities advisories
💡 Result:
Short answer: There are no security advisories that specifically report a vulnerability in vitest v4.0.15. Two public advisories (CVE-2025-24964 and CVE-2025-24963) were disclosed in Feb 2025 that affected older major versions and were patched in the 1.x/2.x/3.x line — those issues do not list 4.x as vulnerable.
Details and sources:
- CVE-2025-24964 — critical remote code execution via the Vitest API (Cross-site WebSocket hijacking). Patched in 1.6.1, 2.1.9 and 3.0.5. [GitHub advisory / NVD]. [1][2]
- CVE-2025-24963 — browser-mode file-disclosure via __screenshot-error (path-traversal). Patched in 2.1.9 and 3.0.4. [GitHub advisory / GitLab advisory]. [3][4]
If you want, I can:
- check the vitest changelog/commit history for v4.0.15 to confirm fixes referencing these advisories, or
- scan your project's dependency tree to see if any vulnerable subpackages are present.
Sources:
[1] GitHub advisory GHSA-9crc-q9x8-hgqq (CVE-2025-24964).
[2] NVD entry CVE-2025-24964.
[3] GitHub advisory GHSA-8gvc-j273-4wm5 (CVE-2025-24963).
[4] GitLab advisory / CVE-2025-24963 summary.
Update Vitest packages to a valid version—4.0.15 does not exist.
Vitest 4.0.15 is not a valid release. The latest 4.0.x version is 4.0.14 (per Snyk), and the latest stable Vitest release overall is 4.0.6. Update the three packages (@vitest/browser, @vitest/coverage-istanbul, @vitest/ui) at lines 67-69 and 93 to an existing version, preferably 4.0.6 or higher (up to 4.0.14).
No security advisories affect Vitest 4.x versions; two historical CVEs (CVE-2025-24964 and CVE-2025-24963) were patched in the 1.x/2.x/3.x lines only.
🤖 Prompt for AI Agents
In package.json around lines 67-69 (and also update the related entry at line
93), the three Vitest packages "@vitest/browser", "@vitest/coverage-istanbul",
and "@vitest/ui" are pinned to a non-existent version 4.0.15; change their
versions to a valid release in the 4.0.x range (e.g., "4.0.14" or "4.0.6") by
replacing "4.0.15" with the chosen valid version in all occurrences, then run
npm/yarn install to verify resolution and update lockfile.
github-actions
bot
added
app:electron
- Update vitest and related packages to 4.0.15 in root and all sub-packages - Migrate workspace config to use projects array (defineWorkspace -> defineConfig with test.projects) - Remove deprecated coverage.all option - Migrate poolOptions.forks.singleFork to maxWorkers/isolate options - Fix incorrect import of afterEach from node:test in utils.spec.ts 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>
github-actions
bot
added
mod:infra
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## canary #14045 +/- ##
==========================================
- Coverage 57.15% 47.78% -9.38%
==========================================
Files 2757 2184 -573
Lines 137728 115975 -21753
Branches 21155 15466 -5689
==========================================
- Hits 78724 55420 -23304
- Misses 56776 59932 +3156
+ Partials 2228 623 -1605
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
1 participant
🤖 Generated with Claude Code
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.