fix(security): patch vitest, vite and launch-editor dev tooling by clay-good · Pull Request #2141 · Fission-AI/OpenSpec

clay-good · 2026-10-22T23:08:52Z

Status: LGTM once Nix Flake Validation is green (the flake hash refresh follows in a second commit). Clears 10 of the 16 open Dependabot alerts (#116–#125). Everything here is dev-only and never ships in the published CLI.

What was wrong:

Package	Was	Advisories	Path
`@vitest/mocker`	4.1.11	GHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp	vitest
`vite`	7.3.6	GHSA-587h-7wmj-h5pm (high), GHSA-698v-4r3x-3vcv, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22, GHSA-9jrq-w75r-8gcw	vitest (peer)
`launch-editor`	2.14.1	GHSA-587h-7wmj-h5pm (high), GHSA-698v-4r3x-3vcv, GHSA-r825-w8mm-5pxw	@changesets/cli

Root cause for vite: vite is a peer dependency of vitest. pnpm auto-installed it, so the lockfile froze it at 7.3.6, which nothing in package.json declared. Dependabot can't bump a version nobody declares. That's why vite kept getting alerts. An override doesn't fix it either: I tried vite@>=7.0.0 <7.3.7, and it rewrote vitest's peer range while leaving 7.3.6 installed (unmet peer vite@">=7.3.7 <8": found 7.3.6).

How it was fixed:

vitest and @vitest/ui go to ^4.1.12, which pins @vitest/mocker 4.1.12.
vite becomes a direct devDependency, ^7.3.7. This repo now owns its version, and Dependabot's development group will keep it patched. It stays on the 7 line, which is what was installed; vite 8 is a separate, deliberate upgrade.
launch-editor@<2.14.2: '>=2.14.2 <3' is added as a floor in pnpm-workspace.yaml, with the usual GHSA comment and removal check. This follows the shell-quote precedent from fix(security): override shell-quote to clear critical advisory #2085, which uses the same parent.
The flake.nix pnpmDeps hash is refreshed for the new lockfile.

Proof:

pnpm audit --audit-level low: before, 5 advisories (1 high, 3 moderate, 1 low); after, No known vulnerabilities found.
pnpm why: exactly one copy each of vite@7.3.7, launch-editor@2.14.2 and @vitest/mocker@4.1.12.
Build, lint and the full vitest suite were run locally (results in the comment below).

Notes: no changeset, since nothing reaches users. The website next alerts are fixed separately in #2140.

🤖 Generated with Claude Code

Summary by CodeRabbit

Chores
- Updated the project’s build and test tooling.
- Added a version constraint for a development tool to keep its version within a defined range.
- Refreshed the package manager configuration.

Clears 10 Dependabot alerts, all dev-only (never in the published CLI): - @vitest/mocker GHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp: bump vitest and @vitest/ui to ^4.1.12, which pins @vitest/mocker 4.1.12. - vite GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22, GHSA-9jrq-w75r-8gcw: vite is a peer of vitest, so pnpm auto-installed it and the lockfile froze it at 7.3.6 where Dependabot cannot bump it. Declare it as a direct devDependency (^7.3.7) so its version is owned here. An override does not work: it rewrites vitest's peer range and leaves 7.3.6 in place. - launch-editor (same three GHSAs): transitive via @changesets/cli; override floor >=2.14.2, following the shell-quote precedent. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

coderabbitai · 2026-10-22T23:09:08Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Source mode: Auto
Repository: Fission-AI/OpenSpec
Branch: claude/dependabot-vulns-5529ef
File: .coderabbit.yaml
Commit: a7245bc
Layers: Repository YAML
Review profile: CHILL
Plan: Advanced
Run ID: e1a89937-f09b-459b-92b1-e2e4164f9b43

📥 Commits

Reviewing files that changed from the base of the PR and between c230424 and a7245bc.

⛔ Files ignored due to path filters: 1

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing: 3

flake.nix
package.json
pnpm-workspace.yaml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

📝 Walkthrough

The pull request updates Vitest development dependencies, adds Vite, changes the pnpmDeps hash, and adds a pnpm override for launch-editor.

Changes: Dependency updates

Layer / File(s)	Summary
Development tooling versions `package.json`, `flake.nix`	Updates `@vitest/ui` and `vitest` to `^4.1.12`, adds `vite` at `^7.3.7`, and changes the `pnpmDeps` hash.
Transitive dependency override `pnpm-workspace.yaml`	Adds an override that replaces `launch-editor` versions below `2.14.2` with versions `>=2.14.2 <3`. Comments describe advisories, the dependency path, and the removal condition.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to a7245

No actionable merge-blocking risk was identified in the dependency and tooling updates.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the security-related updates to Vitest, Vite, and launch-editor dev tooling. It matches the main changes in the pull request.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

openspec-cloud · 2026-10-22T23:09:32Z

No PR-relevant drift confirmed.

AI-generated · A citation proves the line exists, not that it makes the case — verify before acting.
Checked the 0 requirements selected for this PR at d0c071d (256 total).
This is not a full-repository clean result; see the check for coverage and any broader findings.
View results · Click Refresh, then Scan again in the check. Or comment /openspec-cloud.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

clay-good · 2026-10-22T23:10:40Z

Local verification on a7245bc:

pnpm run build and pnpm run lint: pass.
vitest run: 6667 passed, 10 failed. The 10 failures are in config-edit, config-profile and artifact-workflow, and clean main (c230424) fails the same 10 in the same 3 files. They come from the sandbox's spawned test editor and pass in CI.
nix build .#default (nixos/nix in Docker) with the new pnpmDeps hash builds, and result/bin/openspec --version prints 1.14.3.

alfred-openspec

Reviewed a7245bc. The security floors match the advisories, and the lockfile resolves one patched copy each of vite 7.3.7, launch-editor 2.14.2, and @vitest/mocker 4.1.12. Independent frozen install/build, low-level audit, and dependency-path checks pass; required CI including Nix validation is green. This is dev-only, and declaring Vite directly gives Dependabot durable ownership of the peer version.

clay-good requested a review from a team as a code owner October 22, 2026 23:08

clay-good requested review from TabishB and removed request for a team October 22, 2026 23:08

fix(nix): refresh pnpmDeps hash for the dev-tooling security bumps

a7245bc

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

alfred-openspec approved these changes Oct 23, 2026

View reviewed changes

clay-good added this pull request to the merge queue Oct 23, 2026

Merged via the queue into main with commit 1cecb72 Oct 23, 2026
19 checks passed

clay-good deleted the claude/dependabot-vulns-5529ef branch October 23, 2026 00:57

This was referenced Oct 26, 2026

chore(deps): bump vite 8.3.5, eslint 10.13.0, @inquirer/core 12.0.5 #2158

Merged

chore(deps): consolidate the root dependency bumps and raise @types/node to 22 #2194

Merged

Navigation Menu

Repository navigation

fix(security): patch vitest, vite and launch-editor dev tooling - #2141

fix(security): patch vitest, vite and launch-editor dev tooling#2141
clay-good merged 2 commits into
mainfrom
claude/dependabot-vulns-5529ef

clay-good commented Oct 22, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Oct 22, 2026 •

edited

Loading

Uh oh!

openspec-cloud Bot commented Oct 22, 2026

Uh oh!

clay-good commented Oct 22, 2026 •

edited

Loading

Uh oh!

alfred-openspec left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

clay-good commented Oct 22, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openspec-cloud Bot commented Oct 22, 2026

No PR-relevant drift confirmed.

Uh oh!

clay-good commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

alfred-openspec left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

clay-good commented Oct 22, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 22, 2026 •

edited

Loading

clay-good commented Oct 22, 2026 •

edited

Loading