[WIP] chore: fix vulnerabilities by sipayRT · Pull Request #1309 · gemini-testing/testplane

sipayRT · 2026-08-07T15:06:27Z

No description provided.

pkg-pr-new · 2026-08-07T15:08:34Z

npm i https://pkg.pr.new/gemini-testing/testplane@1309

commit: 9323d50

github-actions · 2026-08-07T15:08:52Z

✅ Testplane E2E run succeed

Report

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9dcac0b76f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-07T15:10:30Z

+        const transformed = await swc.transform(bundledScript, {
+            jsc: {
+                parser: { syntax: "ecmascript" },
+                target: "es5",


Preserve ES3 support in the compatibility bundle

When Testplane runs against IE8, calibrate.js can select this compatibility bundle, but SWC now only lowers it to ES5. The existing compatibility TypeScript configuration explicitly targets ES3, and the previous uglifyify setup disabled IE8-unsafe transformations; therefore ES5-only syntax emitted here can make screenshot commands fail before execution in the legacy browsers this bundle is intended to support. Retain an ES3/IE8-compatible transformation path or stop routing those browsers to this bundle.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-08-07T15:10:30Z

+  "engines": {
+    "node": ">=22.12",
+    "npm": ">=10"


Align the Android example's Node version with its setup

The Android example's README instructs users to run nvm use, but its tracked .nvmrc still selects Node 20 while this new engine declaration requires Node 22.12 or newer. Following the documented setup consequently runs npm ci and the upgraded Testplane/Appium stack on an explicitly unsupported Node version; update .nvmrc alongside this requirement.

Useful? React with 👍 / 👎.

github-actions · 2026-08-07T15:50:52Z

✅ Testplane browser-env run succeed

Report

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 42b94165f0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-10T09:59:34Z

+  "engines": {
+    "node": ">=22"
  }


Update the Storybook example's Node version

The Android occurrence is already noted, but the Storybook example independently has the same mismatch: its README explicitly tells users to run nvm use, while its tracked .nvmrc selects Node 20.10 and this new declaration requires Node 22 or newer. Following the documented installation steps therefore runs the upgraded Storybook/Testplane stack on an unsupported Node release; update this example's .nvmrc alongside the engine requirement.

Useful? React with 👍 / 👎.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 941596fea9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-10T12:30:00Z

+  "engines": {
+    "node": ">=22"


Update the create-react-app Node selector

The Android and Storybook occurrences are already noted, but this example independently retains a tracked .nvmrc containing 20 while the new engine declaration requires Node 22 or newer. Running nvm use in this example therefore selects an explicitly unsupported runtime for the upgraded Testplane/Vite stack; update .nvmrc with the engine requirement.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-08-10T12:30:00Z

+  "engines": {
+    "node": ">=22"


Update the react-redux Node selector

This example's tracked .nvmrc still selects Node 20, but the newly added engine declaration requires Node 22 or newer. Anyone using the repository's version selector in this directory will install and run the upgraded Testplane/Vite dependencies on an explicitly unsupported runtime; update .nvmrc alongside this requirement.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-08-10T12:30:00Z

+  "engines": {
+    "node": ">=22"


Update the drag-and-drop Node selector

The drag-and-drop example also retains a tracked .nvmrc containing 20 while this new engine declaration requires Node 22 or newer. Running nvm use in the example selects an unsupported runtime for the upgraded Testplane dependencies, so the version selector should be updated with the engine requirement.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-09-02T13:36:48Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-07T16:41:06.640636Z	`9323d50`	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector · 2026-09-02T13:43:08Z

💡 Codex Review

testplane/examples/component-testing/create-react-app/vite.config.ts

Line 10 in c2562b6

input: "src/index.tsx",

Restore an HTML entry for the Vite build

When npm run build is used, this points Rollup directly at src/index.tsx after the only index.html was deleted, and a repository-wide check of this example finds no replacement HTML entry. Vite will therefore emit the JavaScript bundle and copied public assets but no page containing the #root element that src/index.tsx mounts into, so the resulting dist cannot be served as the React application. Add a root Vite index.html and use it as the build entry.

testplane/examples/component-testing/create-react-app/package-lock.json

Line 14871 in c2562b6

"version": "9.0.12",

Lock the example to a Vite 6-compatible Testplane release

When this example is installed with npm ci, the lockfile selects Testplane 9.0.12, whose own dependency metadata still pins Vite 5.1.6, while the new package override forces its internal Vite to 6.4.3. That published Testplane build predates the debug pre-bundling compatibility change added in this commit under src/runner/browser-env/vite/server.ts, so component tests use Vite 6 without the required CommonJS dependency configuration and can fail during browser-module loading. Regenerate the lock against a Testplane release containing the Vite 6 fix, or avoid overriding its Vite major version.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6eead801b1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-09-04T15:21:10Z

+    "ip-address": "10.4.0",
+    "postcss": "8.5.26",
+    "minimatch@^9.0.0": "9.0.9",
+    "diff": "8.0.3",


Scope the diff override away from Appium

With the newly upgraded appium@3.6.0, the checked-in lockfile resolves @appium/docutils@2.5.2, which declares an exact dependency on diff@9.0.0; this unscoped override also applies to that subtree and instead requires 8.0.3. The resulting graph is internally inconsistent (npm ls --package-lock-only --all reports Appium's nested diff@9.0.0 as invalid), so dependency validation and reproducible installation of the Android example can fail. Scope this override to the older consumers that actually require it rather than downgrading Appium's dependency.

Useful? React with 👍 / 👎.

Upgrade Mocha to 12 and refresh vulnerable runtime dependencies. Adapt Mocha integration and restore the React example HTML entry. WebdriverIO security fixes remain deferred to a separate task.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9323d50bf3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-09-07T16:41:03Z

+    "brace-expansion@^1.0.0": "1.1.18",
+    "brace-expansion@^2.0.0": "2.1.4",
+    "brace-expansion@^5.0.0": "5.0.9",
+    "body-parser": "2.3.0",


Keep Express 4 on body-parser 1.x

In the Android example, this unscoped override also replaces the dependency used by html-reporter@11.14.1 and its express@4.22.2: the checked-in lockfile shows those packages require body-parser@^1.18.2 and ~1.20.5, respectively, but resolve to the incompatible major 2.3.0. When the reporter starts its Express 4 server, it therefore runs against a body-parser version outside both consumers' declared contracts; scope the 2.x override to the Appium/Express 5 subtree or retain a patched 1.x version for the reporter.

Useful? React with 👍 / 👎.

sipayRT changed the title ~~chore: fix vulnerabilities~~ [WIP] chore: fix vulnerabilities Aug 7, 2026

chatgpt-codex-connector Bot reviewed Aug 7, 2026

View reviewed changes

sipayRT force-pushed the sp.updateDeps branch from 9dcac0b to 42b9416 Compare August 10, 2026 09:53

chatgpt-codex-connector Bot reviewed Aug 10, 2026

View reviewed changes

sipayRT force-pushed the sp.updateDeps branch from 42b9416 to 941596f Compare August 10, 2026 12:26

chatgpt-codex-connector Bot reviewed Aug 10, 2026

View reviewed changes

chore: fix vulnerabilities

c2562b6

sipayRT force-pushed the sp.updateDeps branch from 941596f to c2562b6 Compare September 2, 2026 13:36

chore: remove dev-only dependency overrides

6eead80

chatgpt-codex-connector Bot reviewed Sep 4, 2026

View reviewed changes

chore: update runtime dependencies and examples

9323d50

Upgrade Mocha to 12 and refresh vulnerable runtime dependencies. Adapt Mocha integration and restore the React example HTML entry. WebdriverIO security fixes remain deferred to a separate task.

chatgpt-codex-connector Bot reviewed Sep 7, 2026

View reviewed changes

Uh oh!

Conversation

sipayRT commented Aug 7, 2026

Uh oh!

pkg-pr-new Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Testplane E2E run succeedReport

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Aug 7, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Aug 7, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Testplane browser-env run succeedReport

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Aug 10, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Aug 10, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Aug 10, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Aug 10, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot commented Sep 2, 2026

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Sep 7, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

pkg-pr-new Bot commented Aug 7, 2026 •

edited

Loading

github-actions Bot commented Aug 7, 2026 •

edited

Loading

✅ Testplane E2E run succeed

Report

github-actions Bot commented Aug 7, 2026 •

edited

Loading

✅ Testplane browser-env run succeed

Report

chatgpt-codex-connector Bot commented Sep 2, 2026 •

edited

Loading