chore(deps-dev): bump vitest from 4.1.7 to 4.1.8 - #23
Open
dependabot[bot] wants to merge 26 commits into
Open
Conversation
- typescript ^5.9.3 -> ^6.0.3; eslint ^10.4.0 -> ^10.4.1 - tsconfig: module/moduleResolution Node16 -> NodeNext, target/lib ES2022 -> ES2023 (no import changes needed for ESM + .js specifiers) - .node-version 22.11.0 -> 24.15.0 to match the runtime/Dockerfile and end the three-way CI/prod drift; engines kept at >=22 for compatibility - CLAUDE.md: correct the Node + TypeScript facts Verified: typecheck, 1119 tests, lint, and the obfuscation build all pass under TS6; npm audit reports 0 vulnerabilities.
- snippet-extract: IDF-weight query terms so a library-name token present in every snippet no longer dominates ranking (Context7 parity gap) - cache: drop the never-consumed _staleKeys/getStaleKeys revalidation tracking (dead code); keep beneficial serve-stale within the SWR window - lockfile: detect all package versions in parallel (auto-scan requests 20+ at once against the same lockfiles) - telemetry: type the log entry as LogEntry instead of casting `as never`
probeLlmsTxt built its probe URLs from the normalized base path but keyed the cache on origin only, so two libraries hosted on the same domain under different paths (docs.example.com/react vs /vue) shared a single probe result. Key on the full normalized base instead.
The npm-version stats sweep matched `v7.0.0` inside CI workflow comments (e.g. actions/upload-artifact # v7.0.0) and bumped them to the gt-mcp version, making the SHA-pin comment lie. Skip .github/ in the sweep. Also refreshes llms.txt to v7.0.1.
Constant-time bearer-token comparison (timingSafeEqual) and CSP/COOP/CORP headers on the HTTP transport. Block CGNAT 100.64.0.0/10 (cloud metadata) and fail closed on malformed IPs in the SSRF guard. Cap remote response bodies at 5MB to stop OOM from hostile upstreams. Log SSRF-blocked redirects/Jina fetches and disk-cache write failures instead of swallowing them. Escape all regex metacharacters in the dynamic version matcher (ReDoS). Reject 0 for timeout/concurrency env vars; make deepFetchRelevanceThreshold env-tunable. Emit raw Prometheus error counts, render all logger fields and strip CR/LF (log injection). Prune respects the SWR stale window; the disk cache validates deserialized shape before serving.
resolveFromPypi now carries llmsFullTxtUrl like the other resolvers. gt_migration with only a target version no longer collapses the release band to a single major (the lower bound opens to -Infinity). gt_compat cache key includes the token budget so a truncated result is never served to a request asking for more tokens.
22 reference entries had an empty language array; set the "agnostic" sentinel and add a non-empty invariant test. schemas.test now registers and snapshots gt_dispatch (the count was a 13-vs-14 undercount). README tool table lists all 14 tools (gt_snippets and gt_dispatch were missing).
Closes the remaining security/reliability findings from the 2026-06-02
deep audit, each verified against OWASP/Unicode/Node docs and covered by
new tests:
- SEC-002: strip variation selectors (U+FE00-FE0F), Mongolian FVS and the
Tag block (U+E0000-E007F) in the injection-scan projection so split
keywords ("i<VS>gnore previous") can no longer bypass detection. Content
strip preserves FE0F so emoji survive.
- SEC-007: realpathSync before the safeguardPath boundary check so a
symlink inside an allowed dir cannot reach a blocked system path.
- SEC-009: sanitize fetched documentation before it is written to the
mem/disk cache (cacheDoc helper) so poisoned content is never persisted
raw; npm/pypi/sitemap JSON writes are deliberately left untouched.
- SEC-012: GT_NO_WATERMARK=1 opt-out for air-gapped/multi-tenant installs.
- REL-002: single-flight half-open probe (probePending) so a recovering
circuit no longer lets every concurrent caller stampede the upstream.
- REL-004: guard FetchSemaphore.release against underflow.
- REL-007 / TS-011: disk-cache prune re-reads the dir for the live count
and drops corrupt-but-parseable entries instead of leaking them.
- TS-005 / TS-006: shape-guard sitemap and snippet-index cache reads.
- EH-004: log GitHub releases fetch failures at debug.
- CORR-006: minimum fuzzy-match score (parameterised fuzzySearch) so a generic query like "how to build a rest api" no longer misroutes to a build-tool library's best practices. - CORR-007: gt_batch_resolve route now parses library names from the query (and falls back to gt_search) instead of emitting args that fail Zod. - CORR-002/003/004/005: carry llmsFullTxtUrl on registry matches, stop external npm/pypi fallback when fuzzy already returned good results, dedupe crates/go results, and token-match the ranking query. - CORR-010/011: version-tagged README fallback in gt_get_docs; wrap the gt_best_practices handler in withTelemetry so it reports metrics. - COR-001/008: parse single-line go.mod requires, Poetry dev-dependencies and PEP 735 dependency-groups in gt_auto_scan. - EH-005: log external resolver failures at debug. - TS-002/009/010: replace casts with type guards/predicates.
- PERF-003: tokenize each section once and reuse across avgDocLen, IDF and BM25 scoring (was O(N*Q) re-tokenization). Ranking output is unchanged. - PERF-005: cap code-block count/size before tokenizing in BM25 scoring. - PERF-004: match hyphenated HTML5 custom-element closing tags when stripping noisy elements. - PERF-006: halve the deep-fetch direct-hit fan-out (12 -> 6 URLs). - COR-010: close a fenced code block per CommonMark (run length + char), so a nested longer fence no longer terminates it early. - OBS-006: log deep-fetch pipeline timeouts at warn for visibility.
Move the ~4.8KB McpServer instructions template out of index.ts into buildServerInstructions(toolCount) so it can be unit-tested and edited in isolation. toolCount stays sourced from the TOOL_COUNT constant. (MX-004)
- BSC-002/005/006: SHA-pin actions, use .node-version, and add a concurrency block in security.yml (matching ci.yml). - BSC-003: download the mcp-publisher binary to a file instead of piping curl into tar, so an integrity check can be added later. - BSC-008: pin the publish-time npm upgrade to the 11.x major. - BSC-001: gate the release:* scripts on typecheck + test (not prepublishOnly, to avoid a CI double-run). - BSC-004: fail update-stats instead of writing a wrong test-count badge when vitest is unavailable. - MX-002/005b: write TOOL_COUNT back to constants.ts and fix the README comparison-table tool count + tools badge automatically.
Lock in every behaviour change from this wave: Unicode injection-bypass blocking, symlink path guard, sanitize-before-cache, single-flight circuit probe, cache prune/shape guards, router misroute + batch-resolve routing, resolver llmsFullTxtUrl/dedup/fallback, go.mod + PEP 735 scanning, CommonMark fence close, custom-element stripping, watermark opt-out, and the new buildServerInstructions module. Suite: 1120 -> 1198, all green.
Regenerated by update-stats: test badge, tool count in the comparison table, and prose counts.
The version lifecycle sweep rewrites llms.txt but did not stage it, so it drifted after each release. Add it to the version git-add list.
The shared sanitizeContent chokepoint (every fetched doc passes through it via cacheDoc) was incomplete, so noise survived on the Jina/llms.txt/ GitHub-raw paths that bypass html-to-md. Harden it: CRLF normalization, full HTML-entity decoding (named + numeric + hex), Cloudflare email- protection decode/strip, orphan comment markers, and newline-separated nav chrome (version switchers, Prev/Up/Home/Next pagers, event headings). Entity decode runs AFTER the surgical tag strips so docs that teach the script/head elements keep their literal text instead of being stripped. Also fix the relevance/reliability bugs that surfaced as noise: - gt_search: drop score-1 generic topic co-matches when a specific multi- word topic matched (no more PostgreSQL reference page for an OWASP SQL- injection query); cap topic sources before fetching, not after. - gt_best_practices: defer canonical best-practices URLs when the topic matches none of them, and keep short version tokens (v4), so "tailwind v4 migration" no longer returns optimizing-for-production; known URLs kept as a guaranteed last-resort fallback (never empties). - gt_snippets: fall back to the GitHub README when a landing-page-only doc yields no fenced code blocks. - gt_examples: exclude markdown/doc files from GitHub code search. New shared util src/utils/decode-entities.ts consumed by both sanitize.ts and html-to-md.ts. 34 new regression tests added; 1232 passing.
dependabot
Bot
added
dependencies
Every topic-targeted tool now verifies its final output against the request before returning. checkEvidence() requires repeated topic occurrences, a heading hit, or topic tokens inside code — a single passing mention no longer counts as an answer. Failing output triggers one forced topic-targeted deep fetch (new deepFetchForTopic force param); when the topic never appears at all, tools return an explicit "no topic-specific evidence found" miss with the sources checked and a content outline instead of off-topic intro sections. Successful responses carry an "## Evidence" footer (source URLs, fetch date, topic-coverage stats) and an evidence verdict in structuredContent. Root causes this kills: - BM25 zero-score fallthrough served a doc's first sections (generic intro) whenever the topic was absent - Docsify hash-route URLs (getpino.io/#/docs/web) always fetched the homepage — fragments never reach the server; new docsifyToRaw() rewrites to the raw .md path - gt_audit fix guidance: every perf finding got the LCP article, security fell back to an OWASP index page, and any 200-char tangential snippet passed — now metric-specific web.dev articles, per-class OWASP cheat sheets, per-rule typescript-eslint pages, all evidence-gated with source attribution - gt_compat scraped MDN/caniuse search-results pages — now resolves real MDN documents via the search JSON API, search pages demoted to labeled weak evidence - gt_search stages 7/8 passed search-results shells on length alone — fetchTopicContent now drops zero-coverage pages and only caches verified text - gt_snippets returned an empty shell when a topic matched nothing — now lists what the index does cover - audit seo pattern flagged every component for missing generateMetadata (content/path confusion) — patterns now receive the file path
Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) from 4.1.7 to 4.1.8. - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.8/packages/vitest) --- updated-dependencies: - dependency-name: vitest dependency-version: 4.1.8 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/vitest-4.1.8
branch
from
June 12, 2026 15:27
fe526cf to
3214c7a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps vitest from 4.1.7 to 4.1.8.
Release notes
Sourced from vitest's releases.
Commits
e61f2ddchore: release v4.1.8e4067b3fix(browser): disable clientcdpAPI whenallowWrite/allowExec: false[ba...