Skip to content

[cli] test global Mops installation in CI#411

Open
rvanasa wants to merge 8 commits intomainfrom
ryan/global-install-ci
Open

[cli] test global Mops installation in CI#411
rvanasa wants to merge 8 commits intomainfrom
ryan/global-install-ci

Conversation

@rvanasa
Copy link
Collaborator

@rvanasa rvanasa commented Mar 18, 2026

Simulates a globally installed ic-mops npm package for better E2E test coverage.

@rvanasa rvanasa changed the title Test global Mops installation in CI [cli] test global Mops installation in CI Mar 18, 2026
@github-actions
Copy link
Contributor

github-actions bot commented Mar 18, 2026

Benchmark Results

bench/1-buffer-vector-add.bench.mo $({\color{green}-8.22\%})$

Add (second)

Add items one-by-one (second)

Instructions: ${\color{green}-8.22\%}$
Heap: ${\color{gray}0\%}$
Stable Memory: ${\color{gray}0\%}$
Garbage Collection: ${\color{gray}0\%}$

Instructions

10 10000 1000000
Buffer 9_557 $({\color{green}-29.67\%})$ 5_687_594 $({\color{green}-8.33\%})$ 525_783_888 $({\color{green}-8.25\%})$
Vector 13_525 $({\color{red}+18.47\%})$ 4_378_612 $({\color{green}-10.82\%})$ 417_864_498 $({\color{green}-10.74\%})$

Heap

10 10000 1000000
Buffer 272 B $({\color{gray}0\%})$ 272 B $({\color{gray}0\%})$ 272 B $({\color{gray}0\%})$
Vector 272 B $({\color{gray}0\%})$ 272 B $({\color{gray}0\%})$ 272 B $({\color{gray}0\%})$

Garbage Collection

10 10000 1000000
Buffer 1.09 KiB $({\color{gray}0\%})$ 143.28 KiB $({\color{gray}0\%})$ 12.02 MiB $({\color{gray}0\%})$
Vector 1.09 KiB $({\color{gray}0\%})$ 45.65 KiB $({\color{gray}0\%})$ 3.86 MiB $({\color{gray}0\%})$
bench/2-vector-buffer-add.bench.mo $({\color{green}-10.02\%})$

Add

Add items one-by-one

Instructions: ${\color{green}-10.02\%}$
Heap: ${\color{gray}0\%}$
Stable Memory: ${\color{gray}0\%}$
Garbage Collection: ${\color{gray}0\%}$

Instructions

10 10000 1000000
Vector 13_525 $({\color{green}-12.27\%})$ 4_378_966 $({\color{green}-10.82\%})$ 417_886_092 $({\color{green}-10.74\%})$
Buffer 9_557 $({\color{green}-9.75\%})$ 5_686_886 $({\color{green}-8.33\%})$ 525_781_056 $({\color{green}-8.25\%})$

Heap

10 10000 1000000
Vector 272 B $({\color{gray}0\%})$ 272 B $({\color{gray}0\%})$ 272 B $({\color{gray}0\%})$
Buffer 272 B $({\color{gray}0\%})$ 272 B $({\color{gray}0\%})$ 272 B $({\color{gray}0\%})$

Garbage Collection

10 10000 1000000
Vector 1.09 KiB $({\color{gray}0\%})$ 45.65 KiB $({\color{gray}0\%})$ 3.86 MiB $({\color{gray}0\%})$
Buffer 1.09 KiB $({\color{gray}0\%})$ 143.28 KiB $({\color{gray}0\%})$ 12.02 MiB $({\color{gray}0\%})$
bench/array.bench.mo $({\color{green}-17.47\%})$

Array

arr arr

Instructions: ${\color{green}-17.47\%}$
Heap: ${\color{gray}0\%}$
Stable Memory: ${\color{gray}0\%}$
Garbage Collection: ${\color{gray}0\%}$

Instructions

100k x1 reset1 100k x3 reset2 100k x4 reset3
Array 13_502_096 $({\color{green}-10.00\%})$ 3_335 $({\color{green}-25.14\%})$ 27_003_270 $({\color{green}-10.00\%})$ 3_809 $({\color{green}-24.92\%})$ 54_004_127 $({\color{green}-10.00\%})$ 4_283 $({\color{green}-24.74\%})$

Heap

100k x1 reset1 100k x3 reset2 100k x4 reset3
Array 390.9 KiB $({\color{gray}0\%})$ -390.37 KiB $({\color{gray}0\%})$ 390.9 KiB $({\color{gray}0\%})$ -390.37 KiB $({\color{gray}0\%})$ 390.9 KiB $({\color{gray}0\%})$ -390.37 KiB $({\color{gray}0\%})$

Garbage Collection

100k x1 reset1 100k x3 reset2 100k x4 reset3
Array 360 B $({\color{gray}0\%})$ 390.97 KiB $({\color{gray}0\%})$ 391 KiB $({\color{gray}0\%})$ 390.97 KiB $({\color{gray}0\%})$ 1.14 MiB $({\color{gray}0\%})$ 390.97 KiB $({\color{gray}0\%})$
No previous results found "/home/runner/work/mops/mops/.bench/prng.bench.json"
bench/prng.bench.mo $({\color{gray}0\%})$

Prng

Benchmark N next calls for different PRNGs

Instructions: ${\color{gray}0\%}$
Heap: ${\color{gray}0\%}$
Stable Memory: ${\color{gray}0\%}$
Garbage Collection: ${\color{gray}0\%}$

Instructions

10 100 1000 10000
Seiran128 1_694 15_194 150_194 1_500_194
SFC64 2_802 28_962 288_557 2_882_655
SFC32 2_383 23_825 237_026 2_379_333

Heap

10 100 1000 10000
Seiran128 272 B 272 B 272 B 272 B
SFC64 308 B 272 B 272 B 272 B
SFC32 280 B 280 B 272 B 272 B

Garbage Collection

10 100 1000 10000
Seiran128 296 B 296 B 296 B 296 B
SFC64 536 B 4.98 KiB 47.16 KiB 469.04 KiB
SFC32 376 B 1.78 KiB 15.39 KiB 156.11 KiB
bench/removeLast.bench.mo $({\color{green}-10.90\%})$

Remove items using removeLast

Vector and buffer are initialized with 100k items and then 70k items are removed one-by-one.

Instructions: ${\color{green}-10.90\%}$
Heap: ${\color{gray}0\%}$
Stable Memory: ${\color{gray}0\%}$
Garbage Collection: ${\color{gray}0\%}$

Instructions

remove 70k
Vector 27_707_716 $({\color{green}-13.98\%})$
Buffer 29_236_977 $({\color{green}-7.82\%})$

Heap

remove 70k
Vector -136.8 KiB $({\color{gray}0\%})$
Buffer -269.76 KiB $({\color{gray}0\%})$

Garbage Collection

remove 70k
Vector 139.45 KiB $({\color{gray}0\%})$
Buffer 540.43 KiB $({\color{gray}0\%})$
bench/stable-memory.bench.mo $({\color{green}-134.03\%})$

Stable Memory and Region

Grow Region and store blobs in it

Instructions: ${\color{green}-66.97\%}$
Heap: ${\color{green}-6.10\%}$
Stable Memory: ${\color{gray}0\%}$
Garbage Collection: ${\color{green}-60.97\%}$

Instructions

Region (fill 1/100) Region (fill 1/50) StableMemory
10 pages 2_627_029 $({\color{green}-95.97\%})$ 10_496_302 $({\color{green}-95.97\%})$ 2_693 $({\color{green}-5.87\%})$
100 pages 52_466_897 $({\color{green}-95.97\%})$ 104_914_730 $({\color{green}-95.97\%})$ 2_698 $({\color{green}-8.67\%})$
256 pages 134_273_310 $({\color{green}-95.97\%})$ 268_575_103 $({\color{green}-95.97\%})$ 3_246 $({\color{green}-12.37\%})$

Heap

Region (fill 1/100) Region (fill 1/50) StableMemory
10 pages 272 B $({\color{green}-8.11\%})$ 272 B $({\color{gray}0\%})$ 276 B $({\color{gray}0\%})$
100 pages 272 B $({\color{green}-11.69\%})$ 272 B $({\color{green}-11.69\%})$ 272 B $({\color{gray}0\%})$
256 pages 272 B $({\color{green}-11.69\%})$ 272 B $({\color{green}-11.69\%})$ 276 B $({\color{gray}0\%})$

Garbage Collection

Region (fill 1/100) Region (fill 1/50) StableMemory
10 pages 208.34 KiB $({\color{green}-91.44\%})$ 832.38 KiB $({\color{green}-91.45\%})$ 336 B $({\color{gray}0\%})$
100 pages 4.06 MiB $({\color{green}-91.46\%})$ 8.13 MiB $({\color{green}-91.46\%})$ 340 B $({\color{gray}0\%})$
256 pages 10.4 MiB $({\color{green}-91.46\%})$ 20.8 MiB $({\color{green}-91.46\%})$ 340 B $({\color{gray}0\%})$

Stable Memory

Region (fill 1/100) Region (fill 1/50) StableMemory
10 pages 8 MiB $({\color{gray}0\%})$ 8 MiB $({\color{gray}0\%})$ 8 MiB $({\color{gray}0\%})$
100 pages 8 MiB $({\color{gray}0\%})$ 8 MiB $({\color{gray}0\%})$ 0 B $({\color{gray}0\%})$
256 pages 16 MiB $({\color{gray}0\%})$ 16 MiB $({\color{gray}0\%})$ 16 MiB $({\color{gray}0\%})$

@rvanasa rvanasa marked this pull request as ready for review March 18, 2026 18:44
@rvanasa rvanasa requested a review from a team as a code owner March 18, 2026 18:44
@rvanasa rvanasa enabled auto-merge (squash) March 20, 2026 13:47
Kamirus added a commit that referenced this pull request Mar 23, 2026
## Summary
- Bumped `tar` (7.5.9 → 7.5.11) and `minimatch` (10.0.1 → 10.2.4) in
`cli/package.json` — security fixes for path traversal and ReDoS
- Updated `cli/package-lock.json` and `docs/package-lock.json`
transitive deps in-place to pick up security patches (lodash, js-yaml,
node-forge, jws, undici, flatted, ajv, etc.)
- `cli-releases/frontend` changes come from merged PR #340 (vite 5.2.6 →
5.4.21)
- `frontend/package-lock.json` reverted to main — `npm update
--legacy-peer-deps` introduced a `@dfinity/agent` ↔ `@dfinity/candid`
peer dep conflict that broke CI
- `blog/package-lock.json` was already up to date (no changes needed)

### What was NOT included and why
- **`frontend/package-lock.json`** — peer dep conflict between
`@dfinity/agent@1.0.1` and `@dfinity/candid@0.19.3` prevents a clean
lockfile update. Needs a coordinated `@dfinity/*` dependency bump in a
separate PR.
- **Unfixable transitive vulns in CLI** — `axios` (via `wasm-pack` →
`binary-install`) and `esbuild` (via `tsx`) can't be updated without
breaking upstream. Pre-existing on main.

### Closed dependabot PRs (replaced by this PR)
#368, #341, #344, #338, #345, #346, #349, #323, #328, #382, #353, #359,
#357, #348, #325, #324, #421, #419, #379, #377

## Test plan
- [x] Benchmarks pass
- [x] mops test passes (node 20 + node 24, all install methods)
- [ ] CI workflow passes
- [ ] Code quality (lint, format) passes

## Verification
Ran findings-verifier on both direct dependency bumps:
- **minimatch 10.0.1 → 10.2.4**: All changes are additive (new options,
perf/security hardening). CLI uses a simple glob pattern unaffected by
any changes.
- **tar 7.5.9 → 7.5.11**: Pure security fixes in extraction path
validation. No API surface changes. CLI's tar usage (create + extract)
is standard and unaffected.
- **No new peer deps**, no engine requirement changes, no breaking API
changes.

---

## Remaining Open PRs — TODO

### Review & Merge (real package.json bumps, security fixes)
| PR | What | Status |
|---|---|---|
| #336 | Vite 5.2.6 → 5.4.21 in `/frontend` | Multiple CVEs fixed |
| #361 | Elliptic + ic-mops in `/frontend` | Critical crypto
vulnerability |
| #367 | Tar + ic-mops in `/frontend` | Tar path traversal fix |
| #420 | Devalue + @sveltejs/kit in `/cli-releases/frontend` | Real
package.json bump |

### Need @dependabot rebase (merge conflict with main)
| PR | What | Status |
|---|---|---|
| #372 | Tar 7.5.6 → 7.5.7 in `/cli` | Now superseded — tar bumped to
7.5.11 in this PR |
| #342 | Glob 11.0.1 → 11.1.0 in `/cli` | Security fix —
GHSA-5j98-mcp5-4vw2 |

### Need Careful Review (major version bumps, risk of breakage)
| PR | What | Status |
|---|---|---|
| #380 | Docusaurus 2.4.3 → 3.9.2 in `/docs` | Major v2 → v3. Test docs
locally. |
| #329 | vite-plugin-static-copy 1.0.2 → 2.3.2 in `/frontend` | Major v1
→ v2. Has security fix but API may differ. |

### Non-Dependabot PRs
| PR | Author | What |
|---|---|---|
| #411 | rvanasa | Test global Mops installation in CI |
| #363 | codecustard | Fix code page scroll naturally like docs page |
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants