Repository navigation
Prune leftover vitest 4 packages from bun.lock - #718
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
vitest 5.0.4 turns filesystem module caching on by default. @cloudflare/vitest-plugin 1.4.0 then fails every workerd file with readAll ENOENT on node_modules/.vitest-cache. Keep vitest 5.0.4 and turn that cache off until a plugin release reads the files from Node. Co-authored-by: hraness <0thernet@users.noreply.github.com>
cursor Bot
pushed a commit
that referenced
this pull request
Oct 15, 2026
<!-- CURSOR_AGENT_PR_BODY_BEGIN --> Security on `main` was red because `rustls@0.23.45` matches four new advisories: RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, and RUSTSEC-2026-0349. The published patch is `rustls >= 0.23.46`. Rebased onto `main` after #718 (bun.lock prune + Worker vitest 5 `fsModuleCache` fix). This PR is rustls only. - `crates/aicharts-cli/Cargo.toml` exact pin `=0.23.45` → `=0.23.46` - `Cargo.lock` package and checksum (the path `bun run security:check` audits) - `distribution/cli/linux-notices.json` version and archive checksum so Required's notices gate stays bound to the lockfile - License files in 0.23.46 are byte-identical to 0.23.45, so notice file hashes stay `cargo update -p rustls --precise 0.23.46` did not re-resolve other crates. Local verification before rebase: - `cargo audit --file Cargo.lock`: 0 vulnerabilities; RUSTSEC-2026-0346 through 0349 absent - `bun run security:check`: all lanes pass, including `cargo-audit:Cargo.lock` - `bun run release:linux:notices:check`: 37/37 - `cargo test -p aicharts-cli --bin aicharts https`: 40 passed Warnings that remain (pre-existing, recorded only): unmaintained `bincode@1.3.3`, yanked `yoke-derive@0.8.3` Will squash-merge when Required is green. <!-- CURSOR_AGENT_PR_BODY_END --> <div><a href="https://cursor.com/agents/bc-554ecace-5d43-5178-8a7f-2a43b9052963?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/background-agent?bcId=bc-554ecace-5d43-5178-8a7f-2a43b9052963&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: hraness <0thernet@users.noreply.github.com>
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
![https://cursor.com/assets/images/open-in-web-dark.png"><source](https://cursor.com/assets/images/open-in-web-dark.png"><source){kind=link}
![https://cursor.com/assets/images/open-in-web-light.png"><img](https://cursor.com/assets/images/open-in-web-light.png"><img){kind=link}
![https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a](https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a){kind=link}
![https://cursor.com/assets/images/open-in-cursor-dark.png"><source](https://cursor.com/assets/images/open-in-cursor-dark.png"><source){kind=link}
![https://cursor.com/assets/images/open-in-cursor-light.png"><img](https://cursor.com/assets/images/open-in-cursor-light.png"><img){kind=link}
![https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div](https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div){kind=link}
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Restore
bun install --frozen-lockfileafter sequential Dependabot merges left unused vitest 4.1.11 packages inbun.lock, and run Worker tests on vitest 5.0.4.Why
#404 reports the latest benchmarks-mode refresh as unhealthy: run 38742460171 failed at
DEPENDENCIES_OUTCOME=failurewith bun 1.3.14’s “lockfile had changes, but lockfile is frozen.” Every source was skipped.That SHA already included Dependabot #713–#715. Each PR updated
package.jsonandbun.lockon its own, but the merged lockfile still listed vitest 4.1.11 packages that bun now wants to prune (@vitest/pretty-format,@vitest/runner,@vitest/snapshot,@vitest/utils,tinyrainbow, and@vitest/snapshot/magic-string). Frozen install treats that prune as a lockfile change.#715 also left Worker / Worker gates red: vitest 5.0.4 turns
fsModuleCacheon by default, and@cloudflare/vitest-plugin1.4.0’s workerd runner fails every file withreadAllENOENT onnode_modules/.vitest-cache(cloudflare/workers-sdk#16237).Change
bun.lockwith bun 1.3.14 (the version CI andpackageManagerpin). Twelve stale vitest 4 lines removed.package.jsonis unchanged.--frozen-lockfileis still required; this does not weaken CI.fsModuleCache: falsein the Worker vitest config so tests run on vitest 5.0.4. Vitest is not downgraded.Verification
bun install --frozen-lockfilefailed on a clean checkout ofde653a7(then-currentmain).node_modulestree, in an isolated temp directory, in CI Checks, and on the Vercel preview install.bun run usage:worker:check: 43 files, 733 tests passed on vitest 5.0.4.Cargo / rustls is out of scope (handled separately).
#404