Migrate from Jest to Vitest and resolve security vulnerabilities - #51
Merged
Conversation
- Replace jest/ts-jest with vitest@4.1.10 and @vitest/coverage-v8 - Upgrade eslint 9 -> 10.8.0 (adds jiti peer dep), resolving all remaining brace-expansion CVEs - Upgrade @rollup/plugin-commonjs 26 -> 28 and typedoc 0.25 -> 0.28 - Replace unmaintained npm-run-all with npm-run-all2 - Remove jest.config.js, add vitest.config.ts with equivalent settings - Result: 0 npm audit vulnerabilities (down from 35)
Drop EOL Node 18.x and 20.x from the build matrix and bump the engines field in package.json to reflect the new minimum of Node 22.
Array.prototype.at() requires es2022. Now that Node 18/20 are dropped and the minimum is Node 22, es2022 is a safe target.
asadsulaiman
approved these changes
Jul 27, 2026
asadsmalik
approved these changes
Jul 27, 2026
lamnhoan
approved these changes
Jul 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Resolved all open security vulnerabilities. The largest impact change of this was migrating to
vitestinstead ofjest. Jest hasn't published an update in 4+ months and so has been accumulating many vulnerabilities, andvitesthas surpassed them with 2x the monthly downloads, and we are already using it in many of our repos.Testing
Built/ran unit tests and linter locally. Also tested local polyline demo.