Skip to content

fix(vitest): update to patched version#29496

Merged
Amit91848 merged 2 commits into
calcom:mainfrom
bandhan-majumder:fix/vitest-ghsa-5xrq-8626-4rwp
Jun 2, 2026
Merged

fix(vitest): update to patched version#29496
Amit91848 merged 2 commits into
calcom:mainfrom
bandhan-majumder:fix/vitest-ghsa-5xrq-8626-4rwp

Conversation

@bandhan-majumder
Copy link
Copy Markdown
Member

@bandhan-majumder bandhan-majumder commented Jun 2, 2026

What does this PR do?

updates three dep:

@vitest/coverage-v8
@vitest/ui and
vitest

to 4.1.8 version

Fixes this npm audit error

image

Visual Demo (For contributors especially)

Image Demo (if applicable):

works correctly after the patch

image image

Mandatory Tasks (DO NOT REMOVE)

  • I have self-reviewed the code (A decent size PR without self-review might be rejected).
  • I have updated the developer docs if this PR makes changes that would require a documentation change. If N/A, write N/A here and check the checkbox.
  • I confirm automated tests are in place that prove my fix is effective or that my feature works.

How should this be tested?

  • Are there environment variables that should be set?
  • What are the minimal test data to have?
  • What is expected (happy path) to have (input and output)?
  • Any other important info that could help to test that PR

Checklist

  • I haven't read the contributing guide
  • My code doesn't follow the style guidelines of this project
  • I haven't commented my code, particularly in hard-to-understand areas
  • I haven't checked if my changes generate no new warnings
  • My PR is too large (>500 lines or >10 files) and should be split into smaller PRs

@bandhan-majumder bandhan-majumder self-assigned this Jun 2, 2026
@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented Jun 2, 2026

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: e2373529-3256-431a-8b83-eb1936160691

📥 Commits

Reviewing files that changed from the base of the PR and between be7e8c9 and 8e418af.

⛔ Files ignored due to path filters (1)
  • yarn.lock is excluded by !**/yarn.lock, !**/*.lock
📒 Files selected for processing (1)
  • package.json
🚧 Files skipped from review as they are similar to previous changes (1)
  • package.json

📝 Walkthrough

Walkthrough

This pull request updates the vitest development dependency from 4.0.16 to 4.1.8 in two package.json files: the monorepo root and packages/testing.

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely summarizes the main change: updating vitest to a patched version to fix a security vulnerability.
Description check ✅ Passed The description is directly related to the changeset, explaining why the vitest packages are being updated (to fix a critical npm audit vulnerability) and providing visual evidence of the fix.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@package.json`:
- Line 117: Update the Vitest family pins so all related packages match the main
vitest version: change the package.json entries for "`@vitest/ui`" and
"`@vitest/coverage-v8`" to "4.1.8" to align with "vitest": "4.1.8", then
reinstall/update the lockfile (yarn install or npm install) to ensure yarn.lock
no longer contains mixed 4.0.16/4.1.8 versions; verify devDependencies entries
for these package names and the regenerated lockfile reflect 4.1.8.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 790f16c5-fddf-4672-b9cd-a305cce940fc

📥 Commits

Reviewing files that changed from the base of the PR and between 180ede2 and be7e8c9.

⛔ Files ignored due to path filters (1)
  • yarn.lock is excluded by !**/yarn.lock, !**/*.lock
📒 Files selected for processing (2)
  • package.json
  • packages/testing/package.json

Comment thread package.json
@bandhan-majumder bandhan-majumder marked this pull request as draft June 2, 2026 11:55
@bandhan-majumder bandhan-majumder marked this pull request as ready for review June 2, 2026 12:06
@bandhan-majumder bandhan-majumder added ready-for-e2e run-ci Approve CI to run for external contributors labels Jun 2, 2026
@Amit91848 Amit91848 merged commit 717fed8 into calcom:main Jun 2, 2026
56 of 59 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ready-for-e2e run-ci Approve CI to run for external contributors size/L

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants