Repository navigation
chore(deps): override tinypool to 2.1.2, bump vite 6.4.5 and vitest 4.1.12 - #7653
Conversation
oxfmt 0.41 pins tinypool 2.1.0 (GHSA-5gmw-xhrv-c9v3, GHSA-85c8-ppgw-ccpr). Every oxfmt release before 0.67 pins 2.1.0, and 0.67+ reformats 66 files, so override tinypool to the drop-in 2.1.2 patch instead of bumping oxfmt. Also bump vite ^6.4.2 -> ^6.4.5 and vitest/@vitest/coverage-v8 ^4.1.11 -> ^4.1.12 (pulls @vitest/mocker 4.1.12). Co-Authored-By: Claude Opus 5.5 <[email protected]>
jrusso1020
left a comment
jrusso1020
left a comment
There was a problem hiding this comment.
Reviewed at b4e72b5501e0b2e4e07739d23781cd5b8d9b42bd. No blockers found.
The tinypool override reaches the sole consumer, oxfmt 0.41.0, without changing formatter versions. Upstream 2.1.0→2.1.2 preserves the API and copies options onto null-prototype objects. Vite and the Vitest/coverage family stay on their existing major/minor lines. The only other lock changes remove nested postcss/nanoid copies in favor of satisfying hoisted versions. Source and runtime Lambda locks are unchanged. Remove the override when upgrading to an oxfmt version that already supplies the fix.
Validation: frozen install, full build, changed-manifest format check and formatting README through oxfmt's worker path pass. SDK-playground tests pass 5/5 with Vitest 4.1.12. bun audit --json reports 102 entries versus 117 on the base; tinypool, vite and @vitest/mocker no longer appear. CI includes successful build/typecheck/test jobs; the capture-description check and Safari benchmark have failures, so CI is not wholly green. The description check requests capture headings despite this dependency-only change; neither result demonstrates a source defect in this diff.
Need: yes, security fixes in existing tooling · Size: ok · Reuse: existing overrides/resolutions convention · Simpler: already minimal · Structure: fine (checked shared formatter setup and Vitest/coverage version alignment; no split)
Risk: low — development dependency patches with unchanged application source.
Verdict: APPROVE
Reasoning: The narrowly scoped updates preserve tooling contracts and the relevant build/test/formatter checks pass.
— Rames
What
Dev-only dependency security fixes:
tinypool2.1.0 → 2.1.2 via a rootoverrides/resolutionsentry. It is only pulled in by[email protected], which pinstinypoolexactly to2.1.0.vite^6.4.2→^6.4.5(studio, sdk-playground). Resolves to 6.4.5.vitest/@vitest/coverage-v8^4.1.11→^4.1.12in all workspaces. This also brings@vitest/mockerto 4.1.12.Why
6.4.5 is the lowest vite 6.4.x that clears all of the above. vitest 4.1.12 has no
tinypooldependency, so the onlytinypoolconsumer is oxfmt.Related work
Refs #4244. That Renovate PR bumps oxfmt to 0.78, which also clears tinypool, but it conflicts and fails the Format check because newer oxfmt reformats files. This PR clears the critical advisories without changing formatter output, so it can land first. Once #4244 (or any oxfmt ≥ 0.67) lands, the
tinypooloverride should be removed, since oxfmt 0.67–0.70 pin 2.1.2 and 0.71+ pin 2.2.0.How
Options considered, smallest first:
^0.41.0only admits 0.41.x. Every oxfmt release from 0.41 to 0.66 pinstinypool: 2.1.0. The first with ≥2.1.2 is 0.67.0, and[email protected] --check .flags 66 files onmain. Rejected.tinypoolto an exact version.withNullPrototype(...)in theTinypoolconstructor,run()andrecycleWorkers(). The public API is unchanged and there are no dependency or engine changes. The override follows the existingoverrides+resolutionsconvention in the rootpackage.json.vite and vitest are patch bumps inside their current ranges. The lock was pinned to vite 6.4.5 instead of the newest 6.4.6, which is only 4 days old. Workspace
versionchurn that bun wrote into the lock was dropped. The lock also dedupes away a nestedvite/[email protected]and[email protected].No visible change
Dev-dependency bump only. Studio's
package.jsonchangesvite/vitestranges, and no source, styles or runtime dependencies change.Test plan
bun install→bun install --frozen-lockfilepasses on a freshnode_modules.bun why: [email protected] (only via [email protected]), [email protected], [email protected], @vitest/[email protected], @vitest/[email protected].bun auditbefore → after: 117 (3 critical, 48 high) → 102 (1 critical, 44 high). Cleared:tinypool,vite,@vitest/mocker, plus[email protected]and[email protected]through dedupe. The remaining critical istarvia onnxruntime-node, which is out of scope.bun run format:checkwith oxfmt 0.41 on tinypool 2.1.2 passes (7497 files). A Markdown file with an embedded TS block was formatted through the oxfmt worker pool.bun run lintpasses.bun run buildpasses, including the vite 6.4.5 builds for studio and sdk-playground.typecheckpasses for studio, sdk-playground and core. sdk-playground vitest passes (5 tests).Heavy films: Safari vs Chromefailed on one Safariheavy-alpha-webmrun. It is a non-required perf benchmark that also fails intermittently onmainnightlies.packages/aws-lambda/scripts/runtime-lock/**) resolves tinypool, vite or vitest.🤖 Generated with Claude Code