Skip to content

chore: Remove jest-process-manager dependency by implementing server …#598

Open
ysknsid25 wants to merge 1 commit into
storybookjs:nextfrom
ysknsid25:chore/exit-jest-process-manager
Open

chore: Remove jest-process-manager dependency by implementing server …#598
ysknsid25 wants to merge 1 commit into
storybookjs:nextfrom
ysknsid25:chore/exit-jest-process-manager

Conversation

@ysknsid25

@ysknsid25 ysknsid25 commented Apr 14, 2026

Copy link
Copy Markdown

What I did

jest-process-manager is now a public archive and can no longer be updated. Its transitive dependency axios contains a known vulnerability (CVE-2026-40175). Specifically, jest-process-manager depends on wait-on@^7.0.0, which in turn depends on a vulnerable version of axios. Since jest-process-manager is archived, there is no way to get a fix, meaning the vulnerability will remain indefinitely. Depending on a publicly archived package is also generally inappropriate.

As an alternative, jest-dev-server — the package that jest-process-manager was originally forked from — is also archived and cannot be used as a replacement.

This PR removes the dependency entirely by reimplementing the setup / teardown functionality inline using Node.js built-in child_process and the existing wait-on devDependency. The API signature remains fully compatible with the previous behavior.

Checklist for Contributors

Manual Testing Steps

A minimal reproduction environment is available in the test/ directory of the test/server-options-repro branch.

Setup

# 1. Clone the branch
git clone -b test/server-options-repro https://github.com/ysknsid25/test-runner.git
cd test-runner

# 2. Build the test-runner
yarn install && yarn build

# 3. Install dependencies for the test project
cd test
npm install

# 4. Build Storybook static files
npm run build-storybook

Run

npm run test-storybook:ci

What to verify

  • serverOptions starts src/mock-server.js (port 3001) automatically before tests run
    • Console output shows Mock server running on port 3001
  • Button/Primary and Button/Secondary stories pass
  • src/mock-server.js process is terminated after tests complete
    • lsof -ti :3001 returns nothing after the run
  • Jest exits cleanly (no "Jest did not exit one second after the test run" warning)

Expected output

[1]  PASS   browser: chromium  src/Button.stories.jsx
[1]   Example/Button
[1]     Primary
[1]       ✓ smoke-test
[1]     Secondary
[1]       ✓ smoke-test
[1]
[1] Test Suites: 1 passed, 1 total
[1] Tests:       2 passed, 2 total

Documentation

  • Add or update documentation reflecting your changes in this repository
  • Request documentation updates in the test-runner docs website

Checklist for Maintainers

  • Make sure this PR contains one of the labels below:

    Available labels
    • skip-release: Skip any releases, e.g., documentation only changes, CI config etc.
    • patch: Upgrade patch version (e.g. 0.0.x)
    • minor: Upgrade patch version (e.g. 0.x.0)
    • major: Upgrade patch version (e.g. x.0.0)

…management inline

Signed-off-by: ysknsid25 <kengo071225@gmail.com>
@ysknsid25 ysknsid25 force-pushed the chore/exit-jest-process-manager branch from aa27206 to 75efba6 Compare April 14, 2026 11:36
@ysknsid25 ysknsid25 marked this pull request as ready for review April 14, 2026 11:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant