chore(build): Bump vite 5→6, vitest 1→2, vite-plugin-dts 3→4 by chargome · Pull Request #273 · getsentry/rrweb

chargome · 2026-03-26T09:46:02Z

Bump the core build/test tooling across all workspace packages:

vite ^5.2.8 → ^6.4.1
vitest ^1.4.0 → ^2.1.9
vite-plugin-dts ^3.8.1 → ^4.5.4
rollup-plugin-terser (deprecated) → @rollup/plugin-terser in rrweb-worker

Added cssFileName: 'style' to the shared vite config to preserve the style.css output filename (Vite 6 changed the default to package-name-based).

Dependabot alerts resolved

Fully resolved (vulnerable version completely removed from lockfile):

Alert	Severity	Package	Summary
#113	CRITICAL	`vitest`	Remote Code Execution when accessing a malicious website while Vitest API server is listening
#203	HIGH	`rollup`	Rollup 4 has Arbitrary File Write via Path Traversal
#110	MEDIUM	`vue-template-compiler`	Client-side XSS (no fix available — removed by vite-plugin-dts v4 dropping the dependency)

Partially resolved (some vulnerable entries removed, but package still exists via other dependency chains):

Alert	Severity	Package	Remaining source
#154, #146, #145, #141, #140, #139, #138, #126, #111	MEDIUM/LOW	`vite`	`@sveltejs/vite-plugin-svelte@3` still pulls in vite@5 (needs Svelte 5 upgrade)
#114	MEDIUM	`esbuild`	`esbuild-plugin-umd-wrapper` still uses esbuild@0.18
#214	HIGH	`serialize-javascript`	webpack (via `@size-limit`) still pulls in v6
#105, #104	MEDIUM	`nanoid`	postcss (via vite internally) still uses nanoid@3
#165, #155	HIGH/MEDIUM	`validator`	`@microsoft/api-extractor` (via vite-plugin-dts) — needs further investigation

The partially resolved alerts will be addressed in later phases (Svelte 5 upgrade, @size-limit bump, mop-up).

closes https://linear.app/getsentry/issue/SDK-1095/bump-vitest-vite-56-1-critical-7-alerts

linear-code · 2026-03-26T09:47:35Z

SDK-1095 Bump Vitest + Vite 5→6 (1 critical + ~7 alerts)

Upgrade core build/test tooling across all workspace packages: - vite ^5.2.8 → ^6.4.1 (18 packages) - vitest ^1.4.0 → ^2.1.9 (7 packages) - vite-plugin-dts ^3.8.1 → ^4.5.4 (14 packages) - Replace deprecated rollup-plugin-terser with @rollup/plugin-terser - Add cssFileName: 'style' to shared vite config (Vite 6 changed default CSS output filename) - Use pool: 'forks' in vitest config (vitest 2 defaults to threads which causes hangs with Puppeteer browser instances) - Add --forceExit to rrvideo jest (open Playwright handles) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- packer: .toThrow('') → .toThrow() (vitest 2 matches empty string literally instead of matching any error) - rrweb: Update cross-origin iframe snapshot for vitest 2 format - Add __rrvideo__temp__ to .gitignore Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Bump actions/setup-node v3 → v4 - Pin Node.js to 20 (lts/* resolves to Node 22 which hangs with yarn v1) - Remove cache: yarn (stale cache causes install hangs with changed lockfile) - Add --network-timeout 300000 to yarn install - Add timeout-minutes: 10 to install step as safety net Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cursor

Cursor Bugbot has reviewed your changes and found 3 potential issues.

Autofix Details

Bugbot Autofix prepared fixes for all 3 issues found in the latest run.

✅ Fixed: Removed runtime dependencies still used by source code
- Added @sentry-internal/rrweb-player and @open-tech-world/cli-progress-bar back to dependencies in packages/rrvideo/package.json as they are required at runtime by src/index.ts and src/cli.ts.
✅ Fixed: Yarn dependency caching removed from CI workflow
- Restored 'cache: yarn' option to both actions/setup-node@v4 steps in the ci-cd.yml workflow for the test and artifacts jobs.
✅ Fixed: Svelte vite plugin v3 incompatible with Vite 6
- Upgraded @sveltejs/vite-plugin-svelte from ^3.0.0 to ^5.0.0 in packages/rrweb-player/package.json to ensure compatibility with Vite 6.

Or push these changes by commenting:

@cursor push d3a81fa488

Preview (d3a81fa488)

diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml
--- a/.github/workflows/ci-cd.yml
+++ b/.github/workflows/ci-cd.yml
@@ -25,6 +25,7 @@
         uses: actions/setup-node@v4
         with:
           node-version: 20
+          cache: 'yarn'
 
       - name: Install Dependencies
         run: yarn install --frozen-lockfile --network-timeout 300000
@@ -62,6 +63,7 @@
         uses: actions/setup-node@v4
         with:
           node-version: 20
+          cache: 'yarn'
 
       - name: Install Dependencies
         run: yarn install --frozen-lockfile --network-timeout 300000

diff --git a/packages/rrvideo/package.json b/packages/rrvideo/package.json
--- a/packages/rrvideo/package.json
+++ b/packages/rrvideo/package.json
@@ -14,9 +14,10 @@
   },
   "license": "MIT",
   "dependencies": {
+    "@sentry-internal/rrweb-player": "2.41.0",
     "@sentry-internal/rrweb-types": "2.41.0",
+    "@open-tech-world/cli-progress-bar": "^1.0.0",
     "fs-extra": "^10.0.1",
-    "inquirer": "^8.2.0",
     "minimist": "^1.2.6",
     "playwright": "^1.22.2"
   },

diff --git a/packages/rrweb-player/package.json b/packages/rrweb-player/package.json
--- a/packages/rrweb-player/package.json
+++ b/packages/rrweb-player/package.json
@@ -6,7 +6,7 @@
     "@sveltejs/adapter-auto": "^3.0.0",
     "@sveltejs/kit": "^2.0.0",
     "@sveltejs/package": "^2.0.0",
-    "@sveltejs/vite-plugin-svelte": "^3.0.0",
+    "@sveltejs/vite-plugin-svelte": "^5.0.0",
     "@typescript-eslint/eslint-plugin": "^7.0.0",
     "@typescript-eslint/parser": "^7.0.0",
     "eslint-plugin-svelte": "^2.37.0",

_{This Bugbot Autofix run was free. To enable autofix for future PRs, go to the Cursor dashboard.}

packages/rrvideo/package.json

.github/workflows/ci-cd.yml

packages/rrweb-player/package.json

Restore yarn dependency caching in CI workflow that was accidentally dropped when upgrading setup-node v3→v4. Restore runtime dependencies in rrvideo (rrweb-player, cli-progress-bar) that were incorrectly removed, and drop unused inquirer dependency. Revert rrweb-player to vite ^5 since @sveltejs/vite-plugin-svelte v3 requires Vite 5 and upgrading to plugin v5 would require Svelte 5. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

packages/rrvideo/package.json

The prepack script was removed, which means turbo run prepack (called by build:all) skips building rrvideo entirely. This breaks rrvideo tests in CI since build/cli.js won't exist. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

packages/rrvideo/package.json

These package metadata fields were accidentally dropped during the dependency restructuring, which would bloat the published package and break programmatic imports. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

packages/rrvideo/package.json

billyvg

lgtm

billyvg · 2026-03-30T14:47:20Z

.github/workflows/ci-cd.yml

+        uses: actions/setup-node@v4
        with:
-          node-version: lts/*
+          node-version: 20


Is this what the SDKs are on? It's out of maintentance soon

SDKs are on 18 still, but lts/* was blocking CI

The install script and playwright version were inadvertently changed during the vite/vitest bump, causing CI to fail because Playwright browsers were not downloaded before running rrvideo tests. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

In Vite 6, `hmr: false` no longer prevents the client from logging `[vite] connected`. Adding `ws: false` disables the WebSocket server entirely so the message is never sent. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

packages/rrweb/test/record/__snapshots__/cross-origin-iframes.test.ts.snap

Vite 6 injects a client script that logs messages like "[vite] connected" or "[vite] failed to connect" which pollute console-record snapshots. Filter out any console events with @vite/client in their stack trace before asserting, making tests resilient to Vite client behavior changes. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

chargome changed the title ~~build: Bump vite 5→6, vitest 1→2, vite-plugin-dts 3→4~~ chore(build): Bump vite 5→6, vitest 1→2, vite-plugin-dts 3→4 Mar 26, 2026

chargome and others added 3 commits March 30, 2026 12:16

chargome force-pushed the chargome/chore/bump-vitest-vite branch from 1351fce to 2512a4e Compare March 30, 2026 10:24

chargome marked this pull request as ready for review March 30, 2026 12:10

chargome requested review from andreiborza and billyvg March 30, 2026 12:13

cursor bot reviewed Mar 30, 2026

View reviewed changes

packages/rrvideo/package.json Outdated Show resolved Hide resolved

.github/workflows/ci-cd.yml Show resolved Hide resolved

packages/rrweb-player/package.json Outdated Show resolved Hide resolved

cursor bot reviewed Mar 30, 2026

View reviewed changes

packages/rrvideo/package.json Outdated Show resolved Hide resolved

cursor bot reviewed Mar 30, 2026

View reviewed changes

packages/rrvideo/package.json Show resolved Hide resolved

cursor bot reviewed Mar 30, 2026

View reviewed changes

packages/rrvideo/package.json Show resolved Hide resolved

packages/rrvideo/package.json Outdated Show resolved Hide resolved

billyvg approved these changes Mar 30, 2026

View reviewed changes

billyvg reviewed Mar 30, 2026

View reviewed changes

chargome and others added 2 commits March 30, 2026 20:45

cursor bot reviewed Mar 31, 2026

View reviewed changes

packages/rrweb/test/record/__snapshots__/cross-origin-iframes.test.ts.snap Show resolved Hide resolved

chargome and others added 2 commits March 31, 2026 13:58

Apply formatting changes

5fa4ca5

chargome merged commit 09cc3e0 into sentry-v2 Mar 31, 2026
6 checks passed

chargome deleted the chargome/chore/bump-vitest-vite branch March 31, 2026 12:45

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(build): Bump vite 5→6, vitest 1→2, vite-plugin-dts 3→4#273

chore(build): Bump vite 5→6, vitest 1→2, vite-plugin-dts 3→4#273
chargome merged 10 commits intosentry-v2from
chargome/chore/bump-vitest-vite

chargome commented Mar 26, 2026 •

edited

Loading

Uh oh!

linear-code bot commented Mar 26, 2026

Uh oh!

cursor bot left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

billyvg left a comment

Uh oh!

billyvg Mar 30, 2026

Uh oh!

chargome Mar 30, 2026

Uh oh!

cursor bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

chargome commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependabot alerts resolved

Uh oh!

linear-code bot commented Mar 26, 2026

Uh oh!

cursor bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

billyvg left a comment

Choose a reason for hiding this comment

Uh oh!

billyvg Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

chargome Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

chargome commented Mar 26, 2026 •

edited

Loading

cursor bot left a comment •

edited

Loading