Skip to content

chore(build): Bump vite 5→6, vitest 1→2, vite-plugin-dts 3→4#273

Draft
chargome wants to merge 6 commits intosentry-v2from
chargome/chore/bump-vitest-vite
Draft

chore(build): Bump vite 5→6, vitest 1→2, vite-plugin-dts 3→4#273
chargome wants to merge 6 commits intosentry-v2from
chargome/chore/bump-vitest-vite

Conversation

@chargome
Copy link
Copy Markdown
Member

@chargome chargome commented Mar 26, 2026

Bump the core build/test tooling across all workspace packages:

  • vite ^5.2.8 → ^6.4.1
  • vitest ^1.4.0 → ^2.1.9
  • vite-plugin-dts ^3.8.1 → ^4.5.4
  • rollup-plugin-terser (deprecated) → @rollup/plugin-terser in rrweb-worker

Added cssFileName: 'style' to the shared vite config to preserve the style.css output filename (Vite 6 changed the default to package-name-based).

Dependabot alerts resolved

Fully resolved (vulnerable version completely removed from lockfile):

Alert Severity Package Summary
#113 CRITICAL vitest Remote Code Execution when accessing a malicious website while Vitest API server is listening
#203 HIGH rollup Rollup 4 has Arbitrary File Write via Path Traversal
#110 MEDIUM vue-template-compiler Client-side XSS (no fix available — removed by vite-plugin-dts v4 dropping the dependency)

Partially resolved (some vulnerable entries removed, but package still exists via other dependency chains):

Alert Severity Package Remaining source
#154, #146, #145, #141, #140, #139, #138, #126, #111 MEDIUM/LOW vite @sveltejs/vite-plugin-svelte@3 still pulls in vite@5 (needs Svelte 5 upgrade)
#114 MEDIUM esbuild esbuild-plugin-umd-wrapper still uses esbuild@0.18
#214 HIGH serialize-javascript webpack (via @size-limit) still pulls in v6
#105, #104 MEDIUM nanoid postcss (via vite internally) still uses nanoid@3
#165, #155 HIGH/MEDIUM validator @microsoft/api-extractor (via vite-plugin-dts) — needs further investigation

The partially resolved alerts will be addressed in later phases (Svelte 5 upgrade, @size-limit bump, mop-up).

closes https://linear.app/getsentry/issue/SDK-1095/bump-vitest-vite-56-1-critical-7-alerts

- vite ^5.2.8 → ^6.4.1 across all 18 workspace packages
- vitest ^1.4.0 → ^2.1.9 across all packages that declare it
- vite-plugin-dts ^3.8.1 → ^4.5.4 across all packages that declare it
- Replace deprecated rollup-plugin-terser with @rollup/plugin-terser in rrweb-worker
- Add cssFileName: 'style' to shared vite config to preserve backward-compatible CSS output filename (Vite 6 breaking change)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@chargome chargome changed the title build: Bump vite 5→6, vitest 1→2, vite-plugin-dts 3→4 chore(build): Bump vite 5→6, vitest 1→2, vite-plugin-dts 3→4 Mar 26, 2026
@linear-code
Copy link
Copy Markdown

linear-code bot commented Mar 26, 2026

chargome and others added 5 commits March 26, 2026 14:11
Vitest 2 changed `.toThrow('')` to match the empty string literally
instead of matching any error. Use `.toThrow()` (no argument) to match
any thrown error.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Yarn v1 can hang in CI when downloading many platform-specific optional
dependencies (esbuild/rollup binaries added by Vite 6). Adding a
5-minute network timeout prevents indefinite hangs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Vitest 2 defaults to worker threads, but Puppeteer browser instances
don't clean up reliably in threads, causing CI to hang indefinitely.
Switch to forks pool (child processes) which matches vitest 1 behavior,
and add a teardown timeout as a safety net.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The yarn cache from actions/setup-node appears to cause hangs during
yarn install when the lockfile changes significantly (e.g. Vite 6
upgrade adding many new platform-specific optional deps). Disable
caching to unblock CI while we investigate.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Jest in rrvideo leaves open handles (likely Playwright browser) that
prevent the process from exiting. This blocks the turbo test pipeline
indefinitely. Add --forceExit to match common practice for E2E test
suites.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant