Skip to content
Open
Show file tree
Hide file tree
Changes from 6 commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions package.json
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,7 @@
"test:e2e": "npx playwright test",
"test:e2e:update": "npx playwright test --update-snapshots",
"test:unit": "vitest run",
"test:coverage": "vitest run --coverage",
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

# Find vitest configuration files
fd -e ts -e js -e mjs -e config | grep -i vitest | head -20

Repository: Comfy-Org/desktop

Length of output: 43


🏁 Script executed:

# Check package.json for relevant dependencies and scripts
cat -n package.json | grep -E '(vitest|coverage|test:)' | head -30

Repository: Comfy-Org/desktop

Length of output: 342


🏁 Script executed:

# Search for coverage configuration in the codebase
rg -n "coverage" --type=ts --type=js -g "*vitest*" | head -20

Repository: Comfy-Org/desktop

Length of output: 209


🏁 Script executed:

# Search more broadly for vitest config files
find . -type f -name "vitest*" | head -20

Repository: Comfy-Org/desktop

Length of output: 87


🏁 Script executed:

# Search for coverage configuration anywhere in the codebase
rg "coverage" --type=ts --type=js -A 2 | head -40

Repository: Comfy-Org/desktop

Length of output: 43


🏁 Script executed:

# List all config-related files in the root
ls -la | grep -E "(vitest|config)"

Repository: Comfy-Org/desktop

Length of output: 777


🏁 Script executed:

# Check if vitest configuration is in vite.config.ts
cat -n vite.config.ts

Repository: Comfy-Org/desktop

Length of output: 2188


🏁 Script executed:

# Check if any vitest configuration exists in package.json
cat -n package.json | grep -A 20 -B 5 "vitest"

Repository: Comfy-Org/desktop

Length of output: 3091


Add coverage configuration to vite.config.ts.

The test:coverage script will run but lacks proper coverage configuration. The test object in vite.config.ts needs a coverage section specifying the provider (v8), reporter formats, and coverage thresholds. Without this, the coverage command will use incomplete defaults.

Additionally, consider removing the caret from @vitest/coverage-v8 (currently pinned to 3.2.4) to match the version pinning approach of vitest (^3.2.4), or vice versa, to ensure both packages update together.

🤖 Prompt for AI Agents
In @package.json around line 53, Add a coverage section to the test object in
vite.config.ts: configure provider as "v8", set reporters (e.g., "text", "lcov",
"json"), and define coverage thresholds for lines/branches/functions/statements
to enforce minimums; update the test configuration used by vitest (the test
object in vite.config.ts) so the "test:coverage" npm script uses these settings.
Also align version pinning between vitest and @vitest/coverage-v8 by either
removing the caret from @vitest/coverage-v8 to match a fixed version or changing
vitest to use a caret, ensuring both packages update together.

"todesktop:afterPack": "./scripts/todesktop/afterPack.cjs",
"todesktop:beforeInstall": "./scripts/todesktop/beforeInstall.cjs",
"typescript": "tsc -p tsconfig.build.json",
Expand Down Expand Up @@ -79,6 +80,7 @@
"@types/wait-on": "^5.3.4",
"@typescript-eslint/eslint-plugin": "^8.20.0",
"@typescript-eslint/parser": "^8.20.0",
"@vitest/coverage-v8": "3.2.4",
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick | 🔵 Trivial

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Read package.json to verify vitest and @vitest/coverage-v8 versions
cat -n package.json | sed -n '75,110p'

Repository: Comfy-Org/desktop

Length of output: 1354


🌐 Web query:

@vitest/coverage-v8 latest version npm

💡 Result:

The latest published version of @vitest/coverage-v8 is 4.0.16 (tagged latest, published Dec 16, 2025). [1][2]

Install: npm i -D @vitest/coverage-v8@4.0.16.

Sources: [1] Yarn package page (latest: 4.0.16). [2] Snyk/npm metadata showing 4.0.16.


🌐 Web query:

@vitest/coverage-v8 3.2.4 security vulnerabilities advisories

💡 Result:

Short answer: No known security advisories specifically affecting @vitest/coverage-v8 version 3.2.4.

Details:

  • Snyk and package scanners report no direct vulnerabilities for @vitest/coverage-v8 (v3.2.4). [1]
  • A critical Vitest WebSocket RCE (CVE-2025-24964) was disclosed (patched in Vitest 3.0.5+). that advisory affects Vitest core versions up through 3.0.4; it does not apply to @vitest/coverage-v8 3.2.4. [2][3]

If you want, I can:

  • search other advisories/databases (GitHub Security Advisories, NVD, OSV) for completeness, or
  • scan your project for indirect dependency issues.

Sources:
[1] Snyk — @vitest/coverage-v8 (package page).
[2] NVD — CVE-2025-24964.
[3] OpenCVE / advisory summaries for CVE-2025-24964.


🌐 Web query:

@vitest/coverage-v8 4.0.16 vitest version compatibility requirement

💡 Result:

@vitest/coverage-v8@4.0.16 requires the matching Vitest version (i.e., vitest v4 — use the same version as the coverage package, e.g. vitest@4.0.16). [1][2]

Sources:
[1] jsDelivr package listing for @vitest/coverage-v8 (version 4.0.16).
[2] Community guidance / troubleshooting recommending the coverage package and vitest be the same version.


Consider using a caret prefix for version consistency.

The version is pinned without a caret (^), which is inconsistent with the vitest dependency on line 100 (^3.2.4). Consider using ^3.2.4 to align versioning strategies.

🔎 Proposed fix
-    "@vitest/coverage-v8": "3.2.4",
+    "@vitest/coverage-v8": "^3.2.4",

Note: Version 3.2.4 has no security advisories. A newer major version (4.0.16) exists but requires vitest@4.x, which would be a breaking upgrade outside the scope of this consistency fix.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
"@vitest/coverage-v8": "3.2.4",
"@vitest/coverage-v8": "^3.2.4",
🤖 Prompt for AI Agents
In @package.json around line 83, The dependency "@vitest/coverage-v8" is pinned
to "3.2.4" while "vitest" uses a caret-prefixed version; update the package.json
entry for "@vitest/coverage-v8" to "^3.2.4" so versioning strategy matches
"vitest" (keep the same minor/patch but allow caret-based updates) and run your
package manager install to update lockfile accordingly.

"diff": "^7.0.0",
"electron": "31.3.1",
"electron-builder": "^25.1.8",
Expand Down
179 changes: 177 additions & 2 deletions yarn.lock
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ __metadata:
languageName: node
linkType: hard

"@ampproject/remapping@npm:^2.2.0":
"@ampproject/remapping@npm:^2.2.0, @ampproject/remapping@npm:^2.3.0":
version: 2.3.0
resolution: "@ampproject/remapping@npm:2.3.0"
dependencies:
Expand Down Expand Up @@ -119,13 +119,27 @@ __metadata:
languageName: node
linkType: hard

"@babel/helper-string-parser@npm:^7.27.1":
version: 7.27.1
resolution: "@babel/helper-string-parser@npm:7.27.1"
checksum: 10c0/8bda3448e07b5583727c103560bcf9c4c24b3c1051a4c516d4050ef69df37bb9a4734a585fe12725b8c2763de0a265aa1e909b485a4e3270b7cfd3e4dbe4b602
languageName: node
linkType: hard

"@babel/helper-validator-identifier@npm:^7.24.7, @babel/helper-validator-identifier@npm:^7.25.9":
version: 7.25.9
resolution: "@babel/helper-validator-identifier@npm:7.25.9"
checksum: 10c0/4fc6f830177b7b7e887ad3277ddb3b91d81e6c4a24151540d9d1023e8dc6b1c0505f0f0628ae653601eb4388a8db45c1c14b2c07a9173837aef7e4116456259d
languageName: node
linkType: hard

"@babel/helper-validator-identifier@npm:^7.27.1":
version: 7.27.1
resolution: "@babel/helper-validator-identifier@npm:7.27.1"
checksum: 10c0/c558f11c4871d526498e49d07a84752d1800bf72ac0d3dad100309a2eaba24efbf56ea59af5137ff15e3a00280ebe588560534b0e894a4750f8b1411d8f78b84
languageName: node
linkType: hard

"@babel/helper-validator-option@npm:^7.25.9":
version: 7.25.9
resolution: "@babel/helper-validator-option@npm:7.25.9"
Expand Down Expand Up @@ -154,6 +168,17 @@ __metadata:
languageName: node
linkType: hard

"@babel/parser@npm:^7.25.4":
version: 7.28.4
resolution: "@babel/parser@npm:7.28.4"
dependencies:
"@babel/types": "npm:^7.28.4"
bin:
parser: ./bin/babel-parser.js
checksum: 10c0/58b239a5b1477ac7ed7e29d86d675cc81075ca055424eba6485872626db2dc556ce63c45043e5a679cd925e999471dba8a3ed4864e7ab1dbf64306ab72c52707
languageName: node
linkType: hard

"@babel/runtime@npm:^7.10.0, @babel/runtime@npm:^7.15.4, @babel/runtime@npm:^7.21.0":
version: 7.26.0
resolution: "@babel/runtime@npm:7.26.0"
Expand Down Expand Up @@ -199,6 +224,23 @@ __metadata:
languageName: node
linkType: hard

"@babel/types@npm:^7.25.4, @babel/types@npm:^7.28.4":
version: 7.28.4
resolution: "@babel/types@npm:7.28.4"
dependencies:
"@babel/helper-string-parser": "npm:^7.27.1"
"@babel/helper-validator-identifier": "npm:^7.27.1"
checksum: 10c0/ac6f909d6191319e08c80efbfac7bd9a25f80cc83b43cd6d82e7233f7a6b9d6e7b90236f3af7400a3f83b576895bcab9188a22b584eb0f224e80e6d4e95f4517
languageName: node
linkType: hard

"@bcoe/v8-coverage@npm:^1.0.2":
version: 1.0.2
resolution: "@bcoe/v8-coverage@npm:1.0.2"
checksum: 10c0/1eb1dc93cc17fb7abdcef21a6e7b867d6aa99a7ec88ec8207402b23d9083ab22a8011213f04b2cf26d535f1d22dc26139b7929e6c2134c254bd1e14ba5e678c3
languageName: node
linkType: hard

"@clack/core@npm:^0.3.3, @clack/core@npm:^0.3.4":
version: 0.3.5
resolution: "@clack/core@npm:0.3.5"
Expand Down Expand Up @@ -249,6 +291,7 @@ __metadata:
"@types/wait-on": "npm:^5.3.4"
"@typescript-eslint/eslint-plugin": "npm:^8.20.0"
"@typescript-eslint/parser": "npm:^8.20.0"
"@vitest/coverage-v8": "npm:3.2.4"
adm-zip: "npm:^0.5.15"
axios: "npm:^1.8.2"
diff: "npm:^7.0.0"
Expand Down Expand Up @@ -1390,6 +1433,13 @@ __metadata:
languageName: node
linkType: hard

"@istanbuljs/schema@npm:^0.1.2":
version: 0.1.3
resolution: "@istanbuljs/schema@npm:0.1.3"
checksum: 10c0/61c5286771676c9ca3eb2bd8a7310a9c063fb6e0e9712225c8471c582d157392c88f5353581c8c9adbe0dff98892317d2fdfc56c3499aa42e0194405206a963a
languageName: node
linkType: hard

"@jridgewell/gen-mapping@npm:^0.3.5":
version: 0.3.8
resolution: "@jridgewell/gen-mapping@npm:0.3.8"
Expand Down Expand Up @@ -1432,6 +1482,16 @@ __metadata:
languageName: node
linkType: hard

"@jridgewell/trace-mapping@npm:^0.3.23, @jridgewell/trace-mapping@npm:^0.3.30":
version: 0.3.31
resolution: "@jridgewell/trace-mapping@npm:0.3.31"
dependencies:
"@jridgewell/resolve-uri": "npm:^3.1.0"
"@jridgewell/sourcemap-codec": "npm:^1.4.14"
checksum: 10c0/4b30ec8cd56c5fd9a661f088230af01e0c1a3888d11ffb6b47639700f71225be21d1f7e168048d6d4f9449207b978a235c07c8f15c07705685d16dc06280e9d9
languageName: node
linkType: hard

"@jridgewell/trace-mapping@npm:^0.3.24, @jridgewell/trace-mapping@npm:^0.3.25":
version: 0.3.25
resolution: "@jridgewell/trace-mapping@npm:0.3.25"
Expand Down Expand Up @@ -3414,6 +3474,33 @@ __metadata:
languageName: node
linkType: hard

"@vitest/coverage-v8@npm:3.2.4":
version: 3.2.4
resolution: "@vitest/coverage-v8@npm:3.2.4"
dependencies:
"@ampproject/remapping": "npm:^2.3.0"
"@bcoe/v8-coverage": "npm:^1.0.2"
ast-v8-to-istanbul: "npm:^0.3.3"
debug: "npm:^4.4.1"
istanbul-lib-coverage: "npm:^3.2.2"
istanbul-lib-report: "npm:^3.0.1"
istanbul-lib-source-maps: "npm:^5.0.6"
istanbul-reports: "npm:^3.1.7"
magic-string: "npm:^0.30.17"
magicast: "npm:^0.3.5"
std-env: "npm:^3.9.0"
test-exclude: "npm:^7.0.1"
tinyrainbow: "npm:^2.0.0"
peerDependencies:
"@vitest/browser": 3.2.4
vitest: 3.2.4
peerDependenciesMeta:
"@vitest/browser":
optional: true
checksum: 10c0/cae3e58d81d56e7e1cdecd7b5baab7edd0ad9dee8dec9353c52796e390e452377d3f04174d40b6986b17c73241a5e773e422931eaa8102dcba0605ff24b25193
languageName: node
linkType: hard

"@vitest/expect@npm:3.2.4":
version: 3.2.4
resolution: "@vitest/expect@npm:3.2.4"
Expand Down Expand Up @@ -4161,6 +4248,17 @@ __metadata:
languageName: node
linkType: hard

"ast-v8-to-istanbul@npm:^0.3.3":
version: 0.3.5
resolution: "ast-v8-to-istanbul@npm:0.3.5"
dependencies:
"@jridgewell/trace-mapping": "npm:^0.3.30"
estree-walker: "npm:^3.0.3"
js-tokens: "npm:^9.0.1"
checksum: 10c0/6796d2e79dc82302543f8109a6d75944278903cee6269b46df4a7d923c289754f1c97390df48536657741d387046e11dbedcda8ce2e6441bcbe26f8586a6d715
languageName: node
linkType: hard

"astral-regex@npm:^2.0.0":
version: 2.0.0
resolution: "astral-regex@npm:2.0.0"
Expand Down Expand Up @@ -6958,7 +7056,7 @@ __metadata:
languageName: node
linkType: hard

"glob@npm:^10.2.2, glob@npm:^10.3.10, glob@npm:^10.3.12, glob@npm:^10.3.7":
"glob@npm:^10.2.2, glob@npm:^10.3.10, glob@npm:^10.3.12, glob@npm:^10.3.7, glob@npm:^10.4.1":
version: 10.4.5
resolution: "glob@npm:10.4.5"
dependencies:
Expand Down Expand Up @@ -7277,6 +7375,13 @@ __metadata:
languageName: node
linkType: hard

"html-escaper@npm:^2.0.0":
version: 2.0.2
resolution: "html-escaper@npm:2.0.2"
checksum: 10c0/208e8a12de1a6569edbb14544f4567e6ce8ecc30b9394fcaa4e7bb1e60c12a7c9a1ed27e31290817157e8626f3a4f29e76c8747030822eb84a6abb15c255f0a0
languageName: node
linkType: hard

"http-cache-semantics@npm:^4.0.0, http-cache-semantics@npm:^4.1.0, http-cache-semantics@npm:^4.1.1":
version: 4.1.1
resolution: "http-cache-semantics@npm:4.1.1"
Expand Down Expand Up @@ -8105,6 +8210,45 @@ __metadata:
languageName: node
linkType: hard

"istanbul-lib-coverage@npm:^3.0.0, istanbul-lib-coverage@npm:^3.2.2":
version: 3.2.2
resolution: "istanbul-lib-coverage@npm:3.2.2"
checksum: 10c0/6c7ff2106769e5f592ded1fb418f9f73b4411fd5a084387a5410538332b6567cd1763ff6b6cadca9b9eb2c443cce2f7ea7d7f1b8d315f9ce58539793b1e0922b
languageName: node
linkType: hard

"istanbul-lib-report@npm:^3.0.0, istanbul-lib-report@npm:^3.0.1":
version: 3.0.1
resolution: "istanbul-lib-report@npm:3.0.1"
dependencies:
istanbul-lib-coverage: "npm:^3.0.0"
make-dir: "npm:^4.0.0"
supports-color: "npm:^7.1.0"
checksum: 10c0/84323afb14392de8b6a5714bd7e9af845cfbd56cfe71ed276cda2f5f1201aea673c7111901227ee33e68e4364e288d73861eb2ed48f6679d1e69a43b6d9b3ba7
languageName: node
linkType: hard

"istanbul-lib-source-maps@npm:^5.0.6":
version: 5.0.6
resolution: "istanbul-lib-source-maps@npm:5.0.6"
dependencies:
"@jridgewell/trace-mapping": "npm:^0.3.23"
debug: "npm:^4.1.1"
istanbul-lib-coverage: "npm:^3.0.0"
checksum: 10c0/ffe75d70b303a3621ee4671554f306e0831b16f39ab7f4ab52e54d356a5d33e534d97563e318f1333a6aae1d42f91ec49c76b6cd3f3fb378addcb5c81da0255f
languageName: node
linkType: hard

"istanbul-reports@npm:^3.1.7":
version: 3.2.0
resolution: "istanbul-reports@npm:3.2.0"
dependencies:
html-escaper: "npm:^2.0.0"
istanbul-lib-report: "npm:^3.0.0"
checksum: 10c0/d596317cfd9c22e1394f22a8d8ba0303d2074fe2e971887b32d870e4b33f8464b10f8ccbe6847808f7db485f084eba09e6c2ed706b3a978e4b52f07085b8f9bc
languageName: node
linkType: hard

"jackspeak@npm:^3.1.2":
version: 3.4.3
resolution: "jackspeak@npm:3.4.3"
Expand Down Expand Up @@ -8733,6 +8877,17 @@ __metadata:
languageName: node
linkType: hard

"magicast@npm:^0.3.5":
version: 0.3.5
resolution: "magicast@npm:0.3.5"
dependencies:
"@babel/parser": "npm:^7.25.4"
"@babel/types": "npm:^7.25.4"
source-map-js: "npm:^1.2.0"
checksum: 10c0/a6cacc0a848af84f03e3f5bda7b0de75e4d0aa9ddce5517fd23ed0f31b5ddd51b2d0ff0b7e09b51f7de0f4053c7a1107117edda6b0732dca3e9e39e6c5a68c64
languageName: node
linkType: hard

"make-dir@npm:^3.1.0":
version: 3.1.0
resolution: "make-dir@npm:3.1.0"
Expand All @@ -8742,6 +8897,15 @@ __metadata:
languageName: node
linkType: hard

"make-dir@npm:^4.0.0":
version: 4.0.0
resolution: "make-dir@npm:4.0.0"
dependencies:
semver: "npm:^7.5.3"
checksum: 10c0/69b98a6c0b8e5c4fe9acb61608a9fbcfca1756d910f51e5dbe7a9e5cfb74fca9b8a0c8a0ffdf1294a740826c1ab4871d5bf3f62f72a3049e5eac6541ddffed68
languageName: node
linkType: hard

"make-error@npm:^1.1.1":
version: 1.3.6
resolution: "make-error@npm:1.3.6"
Expand Down Expand Up @@ -11791,6 +11955,17 @@ __metadata:
languageName: node
linkType: hard

"test-exclude@npm:^7.0.1":
version: 7.0.1
resolution: "test-exclude@npm:7.0.1"
dependencies:
"@istanbuljs/schema": "npm:^0.1.2"
glob: "npm:^10.4.1"
minimatch: "npm:^9.0.4"
checksum: 10c0/6d67b9af4336a2e12b26a68c83308c7863534c65f27ed4ff7068a56f5a58f7ac703e8fc80f698a19bb154fd8f705cdf7ec347d9512b2c522c737269507e7b263
languageName: node
linkType: hard

"through@npm:^2.3.6":
version: 2.3.8
resolution: "through@npm:2.3.8"
Expand Down