Originally created by: Thanatos9404
The new TypeScript client (#61) shipped with vitest 3.2.7 as a dev dependency, which opened four Dependabot alerts:
tinypool <= 2.1.1 / < 2.1.2: prototype pollution leading to code execution (2 critical);vitest and @vitest/mocker < 4.1.11: path traversal via a redirect mock (2 medium).All four are dev-only: the published client has no runtime dependencies.
This moves to vitest 5.0.5, which is outside the vulnerable range and no longer depends on tinypool. It supersedes Dependabot's [#62], which bumped only @vitest/mocker and left vitest itself on 3.
It also gives the end-to-end tests a 20 s per-test timeout. Each test talks to a real llmslim serve process, and one run timed out locally while a website build was using the CPU.
Local results: tsc --noEmit is clean, the suite passed 21/21 on three consecutive runs (including the 5 end-to-end tests against a real server), and npm run build succeeds.
Originally posted by: vercel[bot]
The latest updates on your projects. Learn more about Vercel for GitHub.
Ticket changed by: Thanatos9404