Skip to content

Commit a19fa45

Browse files
committed
Merge remote-tracking branch 'origin/develop' into sm/W-23147786-refactor-apex-testing-sfcommandlet-to-ef
2 parents 3693840 + db70000 commit a19fa45

33 files changed

Lines changed: 635 additions & 1322 deletions

.claude/plans/W-23094888.md

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# W-23094888 — Enable unicorn/no-array-sort-for-min-max
2+
3+
## Context
4+
- Enable `unicorn/no-array-sort-for-min-max`: disallow `[...].sort()[0]` for min/max; prefer `Math.min`/`Math.max`.
5+
- Rule exists in `eslint-plugin-unicorn` v68 (`node_modules/.../rules/no-array-sort-for-min-max.js`).
6+
- Depends W-23094887 (`prefer-boolean-return`) — already merged (commit afef5779a).
7+
- Add to `eslint.config.mjs` `**/*.ts` block, alphabetical: between `unicorn/no-array-sort` (172) and `unicorn/no-boolean-sort-comparator` (173).
8+
- Prior pattern: single `chore(eslint): enable unicorn/<rule>` commit (e.g. 48f4e16aa, afef5779a).
9+
10+
## Scope (verified via lint)
11+
- 0 violations across repo. Built `packages/eslint-local-rules`, enabled rule, ran eslint → 0 `no-array-sort-for-min-max` hits.
12+
- Pre-existing 217 errors (unused vars `scripts/`, xsd parsing) — unrelated.
13+
- No-op enablement: config-only, no source fixes.
14+
15+
## Phases
16+
17+
### Phase 1 — enable rule
18+
- Add `'unicorn/no-array-sort-for-min-max': 'error',` after `'unicorn/no-array-sort': 'error',` line in `eslint.config.mjs`.
19+
- Build local rules first (`packages/eslint-local-rules`), else ERR_MODULE_NOT_FOUND.
20+
- files: `eslint.config.mjs`
21+
- commit: `chore(eslint): enable unicorn/no-array-sort-for-min-max - W-23094888`
22+
23+
## Skills
24+
- concise (plan/docs style)
25+
- typescript (eslint.config.mjs governs TS files)
26+
- verification (lint gate)
27+
- changelog (lint-only chore; prior unicorn enables had no entry — confirm none needed)
28+
29+
## Verification
30+
- No e2e/runtime impact: pure lint config, 0 source changes.
31+
- No unit/Playwright needed — no source touched.

.claude/plans/W-23094893.md

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# W-23094893 — Enable unicorn/no-collection-bracket-access
2+
3+
## Context
4+
- Disallow bracket notation on Map/Set/WeakMap/WeakSet (sets obj prop, not entry)
5+
- eslint-plugin-unicorn v68; rule exists; suggestions-only (no autofix)
6+
- Dep W-23094891 (no-chained-comparison): Closed/merged — unblocked
7+
- Config: root `eslint.config.mjs`, unicorn rules block, alphabetical
8+
- Insert after `unicorn/no-chained-comparison` (line 175), before `unicorn/no-constant-zero-expression`
9+
- Probe (rule temporarily enabled, lint `packages/**/*.ts`): 0 violations — no code fixes needed
10+
11+
## Phases
12+
13+
### Phase 1 — enable rule
14+
- `eslint.config.mjs`: add `'unicorn/no-collection-bracket-access': 'error',` after `no-chained-comparison`
15+
- commit: `chore(eslint): enable unicorn/no-collection-bracket-access - W-23094893`
16+
17+
## Skills
18+
- concise (plan/docs)
19+
- typescript
20+
- verification
21+
22+
## Verification
23+
- `npm run lint` clean (root) — exercises rule across all pkg lint deps
24+
- not e2e-covered (lint-only change)

.claude/plans/W-23127988.md

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# W-23127988 — E2E flake: LWC LSP hover lightning-accordion
2+
3+
## Context
4+
5+
- retryRate 67%. Flake, not product defect (run 27976286397: retry 0 fail, retry 1 pass).
6+
- `waitForLwcLspReady` (`lwcUtils.ts:222`) gates only on index-status UI item, not `doHover` readiness.
7+
- HTML hover step in `lwcLspHover.headless.spec.ts` (step "hover over lightning-accordion tag and verify the LWC LSP hover card appears", currently ~lines 57-76) does single `hover()` + one-shot `expect(.monaco-hover).toBeVisible({timeout:15_000})`.
8+
- Cold-LSP: hover provider not ready when index item shows; single hover that misses never re-triggers → `.monaco-hover` never visible → fail.
9+
- Fix per WI: poll inside `toPass` — re-hover + assert.
10+
- Reference steps by their `test.step` title, not line numbers (file is 117 lines and grows; line-number-only refs go stale).
11+
12+
## Phases
13+
14+
### Phase 1 — gate HTML hover on availability via toPass re-hover
15+
16+
- File: `packages/salesforcedx-vscode-lwc/test/playwright/specs/lwcLspHover.headless.spec.ts`
17+
- Target: the HTML hover-verify `test.step` ("hover over lightning-accordion tag…"); wrap only the `hover()` + `.monaco-hover` assert (not the `goToLineCol` / `waitFor` setup) in `expect(async () => {...}).toPass({ timeout })`.
18+
- Each attempt: `tagToken.hover()`, then assert `.monaco-hover` w/ `View in Component Library` visible.
19+
- **Open question — must re-trigger fire on every attempt?** Hypothesis: if the pointer is already over the token, Monaco may not recompute the hover, so a missed first attempt never repaints. NOT verified — no Monaco source in `node_modules`, no repo precedent for mouse-move-away. Do NOT bake the move-away into the code as an asserted fact.
20+
- Implementation: keep each `toPass` attempt self-contained so a stale/absent hover is re-driven. Before each `hover()`, dismiss any open hover (e.g. `page.keyboard.press('Escape')`) and/or move the pointer off the token (`page.mouse.move` to editor body coords) so the next `hover()` is a genuine pointer transition. This is defensive: harmless if Monaco re-fires anyway, necessary if it suppresses same-token re-hover.
21+
- The move-away/Escape mechanism must be **confirmed in the local verification step** (below) — observe `.monaco-hover` actually disappear then reappear across attempts — before relying on it. If local run shows a bare re-`hover()` already repaints, drop the move-away to keep the step minimal.
22+
- Drop inner 15_000 → short per-attempt assert timeout; outer `toPass` timeout ~45_000.
23+
- Precedent: `lwcRename.headless.spec.ts:80-82,106-108` (toPass poll on flaky debounced UI); `lwcCustomComponentsIndex.headless.spec.ts:45`. (Precedent covers the toPass-around-flaky-assert pattern, NOT the hover re-trigger specifics.)
24+
- Commit: `test(lwc): poll lightning-accordion hover in toPass for cold-LSP - W-23127988`
25+
26+
### Phase 2 (optional, same commit if cheap) — apply same poll to JS hover
27+
28+
- Same file, JS hover-verify `test.step` ("hover over LightningElement…", desktop-only, 20_000 one-shot). Same cold-LSP race on `LightningElement` hover.
29+
- Wrap the `hover()` + `.monaco-hover` assert in `toPass` for consistency (same re-trigger handling as Phase 1); reduces future flake.
30+
- Fold into Phase 1 commit (one logical change: hover-readiness polling).
31+
32+
## Skills to apply
33+
34+
- playwright-e2e (toPass for async UI; avoid one-shot asserts on LSP-dependent UI)
35+
- concise (plan + any comments)
36+
37+
## Verification
38+
39+
- e2e-covered: the spec itself is the test — green run on branch confirms fix. Run `npm run test:web -w salesforcedx-vscode-lwc -- --retries 0` (and/or `test:desktop`); the `lwcPlaywrightE2E` CI workflow runs this on ubuntu (where flake observed). Ideally repeated runs to confirm retryRate drop.
40+
- Not e2e-covered:
41+
- `npm run compile` / typecheck spec file (no `let`, ternary, etc. per eslint).
42+
- eslint clean on changed spec.
43+
- **Confirm the re-trigger mechanism before PR** — local run (or PWDEBUG/headed) with `--retries 0` (`npm run test:web -w salesforcedx-vscode-lwc -- --retries 0`, so flake is observed not masked) on the HTML hover step: watch the DOM and verify across at least two `toPass` attempts that `.monaco-hover` actually disappears and reappears. This proves the loop re-drives a missed hover. If a bare re-`hover()` already repaints, drop the Escape/move-away. If even the move-away does not re-fire, escalate: the toPass loop is then ineffective and Phase 1 needs a different trigger (e.g. dispatch synthetic `mousemove`, or re-focus the token via `goToLineCol`).
44+
- **Status:** as committed, the Escape + editor-body `mouse.move` is retained defensively — the local confirm-and-trim step above was not performed, so the move-away is kept (harmless if Monaco re-fires anyway). Trim only after the local DOM observation confirms a bare re-`hover()` repaints.

.claude/plans/W-23161119.md

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# W-23161119: bump @stoplight/spectral-rulesets 1.22.0 -> 1.22.4
2+
3+
## Context
4+
5+
- Dependabot alert 297: lodash <=4.17.23 prototype pollution via `_.unset`/`_.omit` (CVE-2026-2950, GHSA-f23m-r3pf-42rh). Patched 4.18.0.
6+
- `@stoplight/spectral-rulesets@1.22.0` deps lodash `~4.17.21` -> root-hoisted lodash pinned 4.17.23 (only vuln copy; nested spectral-core/functions copies already 4.18.1).
7+
- `1.22.4` deps lodash `^4.18.1` (verified via `npm view`). lodash 4.18.1 published.
8+
- Single repo ref: `packages/salesforcedx-vscode-apex-oas/package.json`.
9+
10+
## Phases
11+
12+
### Phase 1: bump dep + regenerate lock
13+
14+
- edit `packages/salesforcedx-vscode-apex-oas/package.json` dep `@stoplight/spectral-rulesets` `1.22.0` -> `1.22.4`
15+
- `npm install` from root (workspace) -> regenerate `package-lock.json`; root lodash hoists 4.17.23 -> 4.18.1
16+
- files: `packages/salesforcedx-vscode-apex-oas/package.json`, `package-lock.json`
17+
- commit: `fix(apex-oas): bump @stoplight/spectral-rulesets to 1.22.4 (lodash CVE-2026-2950) - W-23161119`
18+
19+
## Skills to apply
20+
21+
- packageJson — dep edit conventions
22+
- typescript — TS conventions
23+
- verification — confirm done
24+
25+
## Verification
26+
27+
- `node -e "..."` on `package-lock.json`: root `node_modules/lodash` version == `4.18.1`
28+
- `npm audit` lodash vuln gone
29+
- spectral-rulesets lock entry == 1.22.4
30+
- apex-oas compile passes
31+
- jest spec directly exercising Spectral core + custom ruleset passes: `npm --workspace packages/salesforcedx-vscode-apex-oas test -- ruleset.spectral.test` (spec at `packages/salesforcedx-vscode-apex-oas/test/jest/oas/documentProcessingPipeline/ruleset.spectral.test.ts` imports `@stoplight/spectral-core` + `src/oas/documentProcessorPipeline/ruleset.spectral`, runs `spectral.setRuleset(ruleset)` + `spectral.run`)
32+
- org-gated e2e: 9 `*.headless.spec.ts` specs under `packages/salesforcedx-vscode-apex-oas/test/playwright/specs/` validate the spectral path
33+
- e.g. `decomposedSimpleAccount.headless.spec.ts` asserts `expectProblemsCount(page, 0)` after `SFDX: Validate OpenAPI Document`
34+
- requires a scratch org; CI `apexOasE2E.yml` gates the PR — no local pre-PR e2e needed

.claude/plans/W-23161121.md

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# W-23161121 — clear lodash CVE-2026-2950 (commitizen 4.3.2 + spectral-rulesets 1.22.4)
2+
3+
## Context
4+
- Dependabot alert 297: lodash <=4.17.23 prototype pollution (`_.unset`/`_.omit`), CVE-2026-2950 / GHSA-f23m-r3pf-42rh. Patched 4.18.0.
5+
- Root `node_modules/lodash` = 4.17.23 (vulnerable). Single root `package-lock.json`; npm workspaces (`packages/*`); `bootstrap = npm install`.
6+
- Two distinct pinners hold root lodash at 4.17.x — both must move or a 4.17.x copy survives:
7+
8+
### Pinner A — commitizen (dev tooling)
9+
- `commitizen@4.3.1` (transitive via `cz-conventional-changelog@3.3.0`) pins `lodash@4.17.21` (nested copy at `node_modules/commitizen/node_modules/lodash` = 4.17.21).
10+
- `commitizen@4.3.2` pins `lodash@4.18.1`; `cz-conventional-changelog` range `commitizen@^4.0.3` allows 4.3.2 — no package.json edit needed (lockfile-only).
11+
12+
### Pinner B — spectral-rulesets (RUNTIME dep, ships in VSIX)
13+
- `@stoplight/spectral-rulesets@1.22.0` pins `lodash: ~4.17.21` (>=4.17.21 <4.18.0) — no 4.18.x satisfies. Verified via package-lock.json + `npm view @stoplight/spectral-rulesets@1.22.0 dependencies.lodash`.
14+
- NOT dev-only: pinned `"1.22.0"` under `dependencies` in `packages/salesforcedx-vscode-apex-oas/package.json:38`, imported at runtime in `src/oas/documentProcessorPipeline/ruleset.spectral.ts` and bundled via the `vscode:bundle` script.
15+
- Bumping only commitizen leaves a 4.17.x lodash for spectral — CVE not cleared in shipped extension.
16+
- Fix: bump `@stoplight/spectral-rulesets` to `1.22.4`, which ships `lodash: ^4.18.1` (verified `npm view ...@1.22.4 dependencies.lodash`). 1.22.4 depends on `@stoplight/spectral-core@1.23.0` (exact) — already installed (1.23.0); no spectral-core change needed.
17+
18+
## Phases
19+
20+
### Phase 1 — bump spectral-rulesets (runtime, unblocks lodash float)
21+
- Edit `packages/salesforcedx-vscode-apex-oas/package.json:38``"@stoplight/spectral-rulesets": "1.22.0"``"1.22.4"`.
22+
23+
### Phase 2 — float commitizen + reinstall
24+
- `npm update commitizen` → nested commitizen 4.3.1→4.3.2, its lodash 4.17.21→4.18.1.
25+
- `npm install` → resolve/dedupe; root lodash 4.17.23→4.18.x (now unblocked by both pinners).
26+
- Stage `package.json` (apex-oas) + `package-lock.json`. Confirm no other package.json changed.
27+
- Commit msg: `fix(deps): bump commitizen 4.3.2 + spectral-rulesets 1.22.4 to clear lodash CVE-2026-2950 - W-23161121`
28+
29+
## Skills to apply
30+
- packageJson — dependency/lockfile conventions, exact-pin style
31+
- typescript
32+
- verification
33+
34+
## Verification
35+
<!-- targeted: root-only check can false-pass -->
36+
- `node_modules/commitizen` version = 4.3.2.
37+
- `node_modules/commitizen/node_modules/lodash` = 4.18.1, OR absent (promoted to root). Either is acceptable.
38+
- `node_modules/@stoplight/spectral-rulesets` version = 1.22.4; its lodash constraint now `^4.18.1`.
39+
- Root `node_modules/lodash` >= 4.18.0.
40+
- Enumerate every `node_modules/**/lodash` (root + all nested) in `package-lock.json`; assert NONE is < 4.18.0.
41+
- Any 4.17.x survivor: trace via `npm explain lodash`, resolve before commit.
42+
- `npm ls commitizen` — 4.3.2 under cz-conventional-changelog.
43+
- `npm audit` (lodash advisory) — CVE-2026-2950 / GHSA-f23m-r3pf-42rh cleared.
44+
- `npm run check:dupes` — check `jscpd-report` for flagged changes.
45+
- `git diff --stat` — only apex-oas `package.json` + root `package-lock.json` changed.
46+
47+
## e2e / runtime coverage
48+
- 1.22.4 bump is runtime/shipped (apex-oas OAS pipeline).
49+
- Run apex-oas OAS validation step (`oasValidationStep` / `ruleset.spectral.ts`); confirm ruleset loads. spectral-core stays at 1.23.0 — behavior unchanged, but verify.
50+
- commitizen change remains build-tooling only (no e2e surface).

.github/workflows/apexLogE2E.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ jobs:
5656
- name: Setup Node.js
5757
uses: actions/setup-node@v4
5858
with:
59-
node-version: '22'
59+
node-version: '22.22.3'
6060
cache: 'npm'
6161

6262
- uses: google/wireit@setup-github-actions-caching/v2
@@ -185,7 +185,7 @@ jobs:
185185
- name: Setup Node.js
186186
uses: actions/setup-node@v4
187187
with:
188-
node-version: '22'
188+
node-version: '22.22.3'
189189
cache: 'npm'
190190

191191
- uses: google/wireit@setup-github-actions-caching/v2

.github/workflows/apexLspE2E.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ jobs:
6666
- name: Setup Node.js
6767
uses: actions/setup-node@v4
6868
with:
69-
node-version: '22'
69+
node-version: '22.22.3'
7070
cache: 'npm'
7171

7272
- uses: google/wireit@setup-github-actions-caching/v2

.github/workflows/apexOasE2E.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ jobs:
7070
- name: Setup Node.js
7171
uses: actions/setup-node@v4
7272
with:
73-
node-version: '22'
73+
node-version: '22.22.3'
7474
cache: 'npm'
7575

7676
- uses: google/wireit@setup-github-actions-caching/v2

.github/workflows/apexReplayDebuggerE2E.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ jobs:
7070
- name: Setup Node.js
7171
uses: actions/setup-node@v4
7272
with:
73-
node-version: '22'
73+
node-version: '22.22.3'
7474
cache: 'npm'
7575

7676
- uses: google/wireit@setup-github-actions-caching/v2

.github/workflows/apexTestingE2E.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ jobs:
5656
- name: Setup Node.js
5757
uses: actions/setup-node@v4
5858
with:
59-
node-version: '22'
59+
node-version: '22.22.3'
6060
cache: 'npm'
6161

6262
- uses: google/wireit@setup-github-actions-caching/v2
@@ -209,7 +209,7 @@ jobs:
209209
- name: Setup Node.js
210210
uses: actions/setup-node@v4
211211
with:
212-
node-version: '22'
212+
node-version: '22.22.3'
213213
cache: 'npm'
214214

215215
- uses: google/wireit@setup-github-actions-caching/v2

0 commit comments

Comments
 (0)