Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions package.json
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,7 @@
"test:e2e": "npx playwright test",
"test:e2e:update": "npx playwright test --update-snapshots",
"test:unit": "vitest run",
"test:coverage": "vitest run --coverage",
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

# Find vitest configuration files
fd -e ts -e js -e mjs -e config | grep -i vitest | head -20

Repository: Comfy-Org/desktop

Length of output: 43


🏁 Script executed:

# Check package.json for relevant dependencies and scripts
cat -n package.json | grep -E '(vitest|coverage|test:)' | head -30

Repository: Comfy-Org/desktop

Length of output: 342


🏁 Script executed:

# Search for coverage configuration in the codebase
rg -n "coverage" --type=ts --type=js -g "*vitest*" | head -20

Repository: Comfy-Org/desktop

Length of output: 209


🏁 Script executed:

# Search more broadly for vitest config files
find . -type f -name "vitest*" | head -20

Repository: Comfy-Org/desktop

Length of output: 87


🏁 Script executed:

# Search for coverage configuration anywhere in the codebase
rg "coverage" --type=ts --type=js -A 2 | head -40

Repository: Comfy-Org/desktop

Length of output: 43


🏁 Script executed:

# List all config-related files in the root
ls -la | grep -E "(vitest|config)"

Repository: Comfy-Org/desktop

Length of output: 777


🏁 Script executed:

# Check if vitest configuration is in vite.config.ts
cat -n vite.config.ts

Repository: Comfy-Org/desktop

Length of output: 2188


🏁 Script executed:

# Check if any vitest configuration exists in package.json
cat -n package.json | grep -A 20 -B 5 "vitest"

Repository: Comfy-Org/desktop

Length of output: 3091


Add coverage configuration to vite.config.ts.

The test:coverage script will run but lacks proper coverage configuration. The test object in vite.config.ts needs a coverage section specifying the provider (v8), reporter formats, and coverage thresholds. Without this, the coverage command will use incomplete defaults.

Additionally, consider removing the caret from @vitest/coverage-v8 (currently pinned to 3.2.4) to match the version pinning approach of vitest (^3.2.4), or vice versa, to ensure both packages update together.

🤖 Prompt for AI Agents
In @package.json around line 53, Add a coverage section to the test object in
vite.config.ts: configure provider as "v8", set reporters (e.g., "text", "lcov",
"json"), and define coverage thresholds for lines/branches/functions/statements
to enforce minimums; update the test configuration used by vitest (the test
object in vite.config.ts) so the "test:coverage" npm script uses these settings.
Also align version pinning between vitest and @vitest/coverage-v8 by either
removing the caret from @vitest/coverage-v8 to match a fixed version or changing
vitest to use a caret, ensuring both packages update together.

"todesktop:afterPack": "./scripts/todesktop/afterPack.cjs",
"todesktop:beforeInstall": "./scripts/todesktop/beforeInstall.cjs",
"typescript": "tsc -p tsconfig.build.json",
Expand Down Expand Up @@ -79,6 +80,7 @@
"@types/wait-on": "^5.3.4",
"@typescript-eslint/eslint-plugin": "^8.20.0",
"@typescript-eslint/parser": "^8.20.0",
"@vitest/coverage-v8": "3.2.4",
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick | 🔵 Trivial

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Read package.json to verify vitest and @vitest/coverage-v8 versions
cat -n package.json | sed -n '75,110p'

Repository: Comfy-Org/desktop

Length of output: 1354


🌐 Web query:

@vitest/coverage-v8 latest version npm

💡 Result:

The latest published version of @vitest/coverage-v8 is 4.0.16 (tagged latest, published Dec 16, 2025). [1][2]

Install: npm i -D @vitest/coverage-v8@4.0.16.

Sources: [1] Yarn package page (latest: 4.0.16). [2] Snyk/npm metadata showing 4.0.16.


🌐 Web query:

@vitest/coverage-v8 3.2.4 security vulnerabilities advisories

💡 Result:

Short answer: No known security advisories specifically affecting @vitest/coverage-v8 version 3.2.4.

Details:

  • Snyk and package scanners report no direct vulnerabilities for @vitest/coverage-v8 (v3.2.4). [1]
  • A critical Vitest WebSocket RCE (CVE-2025-24964) was disclosed (patched in Vitest 3.0.5+). that advisory affects Vitest core versions up through 3.0.4; it does not apply to @vitest/coverage-v8 3.2.4. [2][3]

If you want, I can:

  • search other advisories/databases (GitHub Security Advisories, NVD, OSV) for completeness, or
  • scan your project for indirect dependency issues.

Sources:
[1] Snyk — @vitest/coverage-v8 (package page).
[2] NVD — CVE-2025-24964.
[3] OpenCVE / advisory summaries for CVE-2025-24964.


🌐 Web query:

@vitest/coverage-v8 4.0.16 vitest version compatibility requirement

💡 Result:

@vitest/coverage-v8@4.0.16 requires the matching Vitest version (i.e., vitest v4 — use the same version as the coverage package, e.g. vitest@4.0.16). [1][2]

Sources:
[1] jsDelivr package listing for @vitest/coverage-v8 (version 4.0.16).
[2] Community guidance / troubleshooting recommending the coverage package and vitest be the same version.


Consider using a caret prefix for version consistency.

The version is pinned without a caret (^), which is inconsistent with the vitest dependency on line 100 (^3.2.4). Consider using ^3.2.4 to align versioning strategies.

🔎 Proposed fix
-    "@vitest/coverage-v8": "3.2.4",
+    "@vitest/coverage-v8": "^3.2.4",

Note: Version 3.2.4 has no security advisories. A newer major version (4.0.16) exists but requires vitest@4.x, which would be a breaking upgrade outside the scope of this consistency fix.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
"@vitest/coverage-v8": "3.2.4",
"@vitest/coverage-v8": "^3.2.4",
🤖 Prompt for AI Agents
In @package.json around line 83, The dependency "@vitest/coverage-v8" is pinned
to "3.2.4" while "vitest" uses a caret-prefixed version; update the package.json
entry for "@vitest/coverage-v8" to "^3.2.4" so versioning strategy matches
"vitest" (keep the same minor/patch but allow caret-based updates) and run your
package manager install to update lockfile accordingly.

"diff": "^7.0.0",
"electron": "31.3.1",
"electron-builder": "^25.1.8",
Expand Down
179 changes: 177 additions & 2 deletions yarn.lock
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ __metadata:
languageName: node
linkType: hard

"@ampproject/remapping@npm:^2.2.0":
"@ampproject/remapping@npm:^2.2.0, @ampproject/remapping@npm:^2.3.0":
version: 2.3.0
resolution: "@ampproject/remapping@npm:2.3.0"
dependencies:
Expand Down Expand Up @@ -119,13 +119,27 @@ __metadata:
languageName: node
linkType: hard

"@babel/helper-string-parser@npm:^7.27.1":
version: 7.27.1
resolution: "@babel/helper-string-parser@npm:7.27.1"
checksum: 10c0/8bda3448e07b5583727c103560bcf9c4c24b3c1051a4c516d4050ef69df37bb9a4734a585fe12725b8c2763de0a265aa1e909b485a4e3270b7cfd3e4dbe4b602
languageName: node
linkType: hard

"@babel/helper-validator-identifier@npm:^7.24.7, @babel/helper-validator-identifier@npm:^7.25.9":
version: 7.25.9
resolution: "@babel/helper-validator-identifier@npm:7.25.9"
checksum: 10c0/4fc6f830177b7b7e887ad3277ddb3b91d81e6c4a24151540d9d1023e8dc6b1c0505f0f0628ae653601eb4388a8db45c1c14b2c07a9173837aef7e4116456259d
languageName: node
linkType: hard

"@babel/helper-validator-identifier@npm:^7.27.1":
version: 7.27.1
resolution: "@babel/helper-validator-identifier@npm:7.27.1"
checksum: 10c0/c558f11c4871d526498e49d07a84752d1800bf72ac0d3dad100309a2eaba24efbf56ea59af5137ff15e3a00280ebe588560534b0e894a4750f8b1411d8f78b84
languageName: node
linkType: hard

"@babel/helper-validator-option@npm:^7.25.9":
version: 7.25.9
resolution: "@babel/helper-validator-option@npm:7.25.9"
Expand Down Expand Up @@ -154,6 +168,17 @@ __metadata:
languageName: node
linkType: hard

"@babel/parser@npm:^7.25.4":
version: 7.28.4
resolution: "@babel/parser@npm:7.28.4"
dependencies:
"@babel/types": "npm:^7.28.4"
bin:
parser: ./bin/babel-parser.js
checksum: 10c0/58b239a5b1477ac7ed7e29d86d675cc81075ca055424eba6485872626db2dc556ce63c45043e5a679cd925e999471dba8a3ed4864e7ab1dbf64306ab72c52707
languageName: node
linkType: hard

"@babel/runtime@npm:^7.10.0, @babel/runtime@npm:^7.15.4, @babel/runtime@npm:^7.21.0":
version: 7.26.0
resolution: "@babel/runtime@npm:7.26.0"
Expand Down Expand Up @@ -199,6 +224,23 @@ __metadata:
languageName: node
linkType: hard

"@babel/types@npm:^7.25.4, @babel/types@npm:^7.28.4":
version: 7.28.4
resolution: "@babel/types@npm:7.28.4"
dependencies:
"@babel/helper-string-parser": "npm:^7.27.1"
"@babel/helper-validator-identifier": "npm:^7.27.1"
checksum: 10c0/ac6f909d6191319e08c80efbfac7bd9a25f80cc83b43cd6d82e7233f7a6b9d6e7b90236f3af7400a3f83b576895bcab9188a22b584eb0f224e80e6d4e95f4517
languageName: node
linkType: hard

"@bcoe/v8-coverage@npm:^1.0.2":
version: 1.0.2
resolution: "@bcoe/v8-coverage@npm:1.0.2"
checksum: 10c0/1eb1dc93cc17fb7abdcef21a6e7b867d6aa99a7ec88ec8207402b23d9083ab22a8011213f04b2cf26d535f1d22dc26139b7929e6c2134c254bd1e14ba5e678c3
languageName: node
linkType: hard

"@clack/core@npm:^0.3.3, @clack/core@npm:^0.3.4":
version: 0.3.5
resolution: "@clack/core@npm:0.3.5"
Expand Down Expand Up @@ -249,6 +291,7 @@ __metadata:
"@types/wait-on": "npm:^5.3.4"
"@typescript-eslint/eslint-plugin": "npm:^8.20.0"
"@typescript-eslint/parser": "npm:^8.20.0"
"@vitest/coverage-v8": "npm:3.2.4"
adm-zip: "npm:^0.5.15"
axios: "npm:^1.8.2"
diff: "npm:^7.0.0"
Expand Down Expand Up @@ -1390,6 +1433,13 @@ __metadata:
languageName: node
linkType: hard

"@istanbuljs/schema@npm:^0.1.2":
version: 0.1.3
resolution: "@istanbuljs/schema@npm:0.1.3"
checksum: 10c0/61c5286771676c9ca3eb2bd8a7310a9c063fb6e0e9712225c8471c582d157392c88f5353581c8c9adbe0dff98892317d2fdfc56c3499aa42e0194405206a963a
languageName: node
linkType: hard

"@jridgewell/gen-mapping@npm:^0.3.5":
version: 0.3.8
resolution: "@jridgewell/gen-mapping@npm:0.3.8"
Expand Down Expand Up @@ -1432,6 +1482,16 @@ __metadata:
languageName: node
linkType: hard

"@jridgewell/trace-mapping@npm:^0.3.23, @jridgewell/trace-mapping@npm:^0.3.30":
version: 0.3.31
resolution: "@jridgewell/trace-mapping@npm:0.3.31"
dependencies:
"@jridgewell/resolve-uri": "npm:^3.1.0"
"@jridgewell/sourcemap-codec": "npm:^1.4.14"
checksum: 10c0/4b30ec8cd56c5fd9a661f088230af01e0c1a3888d11ffb6b47639700f71225be21d1f7e168048d6d4f9449207b978a235c07c8f15c07705685d16dc06280e9d9
languageName: node
linkType: hard

"@jridgewell/trace-mapping@npm:^0.3.24, @jridgewell/trace-mapping@npm:^0.3.25":
version: 0.3.25
resolution: "@jridgewell/trace-mapping@npm:0.3.25"
Expand Down Expand Up @@ -3414,6 +3474,33 @@ __metadata:
languageName: node
linkType: hard

"@vitest/coverage-v8@npm:3.2.4":
version: 3.2.4
resolution: "@vitest/coverage-v8@npm:3.2.4"
dependencies:
"@ampproject/remapping": "npm:^2.3.0"
"@bcoe/v8-coverage": "npm:^1.0.2"
ast-v8-to-istanbul: "npm:^0.3.3"
debug: "npm:^4.4.1"
istanbul-lib-coverage: "npm:^3.2.2"
istanbul-lib-report: "npm:^3.0.1"
istanbul-lib-source-maps: "npm:^5.0.6"
istanbul-reports: "npm:^3.1.7"
magic-string: "npm:^0.30.17"
magicast: "npm:^0.3.5"
std-env: "npm:^3.9.0"
test-exclude: "npm:^7.0.1"
tinyrainbow: "npm:^2.0.0"
peerDependencies:
"@vitest/browser": 3.2.4
vitest: 3.2.4
peerDependenciesMeta:
"@vitest/browser":
optional: true
checksum: 10c0/cae3e58d81d56e7e1cdecd7b5baab7edd0ad9dee8dec9353c52796e390e452377d3f04174d40b6986b17c73241a5e773e422931eaa8102dcba0605ff24b25193
languageName: node
linkType: hard

"@vitest/expect@npm:3.2.4":
version: 3.2.4
resolution: "@vitest/expect@npm:3.2.4"
Expand Down Expand Up @@ -4161,6 +4248,17 @@ __metadata:
languageName: node
linkType: hard

"ast-v8-to-istanbul@npm:^0.3.3":
version: 0.3.5
resolution: "ast-v8-to-istanbul@npm:0.3.5"
dependencies:
"@jridgewell/trace-mapping": "npm:^0.3.30"
estree-walker: "npm:^3.0.3"
js-tokens: "npm:^9.0.1"
checksum: 10c0/6796d2e79dc82302543f8109a6d75944278903cee6269b46df4a7d923c289754f1c97390df48536657741d387046e11dbedcda8ce2e6441bcbe26f8586a6d715
languageName: node
linkType: hard

"astral-regex@npm:^2.0.0":
version: 2.0.0
resolution: "astral-regex@npm:2.0.0"
Expand Down Expand Up @@ -6958,7 +7056,7 @@ __metadata:
languageName: node
linkType: hard

"glob@npm:^10.2.2, glob@npm:^10.3.10, glob@npm:^10.3.12, glob@npm:^10.3.7":
"glob@npm:^10.2.2, glob@npm:^10.3.10, glob@npm:^10.3.12, glob@npm:^10.3.7, glob@npm:^10.4.1":
version: 10.4.5
resolution: "glob@npm:10.4.5"
dependencies:
Expand Down Expand Up @@ -7277,6 +7375,13 @@ __metadata:
languageName: node
linkType: hard

"html-escaper@npm:^2.0.0":
version: 2.0.2
resolution: "html-escaper@npm:2.0.2"
checksum: 10c0/208e8a12de1a6569edbb14544f4567e6ce8ecc30b9394fcaa4e7bb1e60c12a7c9a1ed27e31290817157e8626f3a4f29e76c8747030822eb84a6abb15c255f0a0
languageName: node
linkType: hard

"http-cache-semantics@npm:^4.0.0, http-cache-semantics@npm:^4.1.0, http-cache-semantics@npm:^4.1.1":
version: 4.1.1
resolution: "http-cache-semantics@npm:4.1.1"
Expand Down Expand Up @@ -8105,6 +8210,45 @@ __metadata:
languageName: node
linkType: hard

"istanbul-lib-coverage@npm:^3.0.0, istanbul-lib-coverage@npm:^3.2.2":
version: 3.2.2
resolution: "istanbul-lib-coverage@npm:3.2.2"
checksum: 10c0/6c7ff2106769e5f592ded1fb418f9f73b4411fd5a084387a5410538332b6567cd1763ff6b6cadca9b9eb2c443cce2f7ea7d7f1b8d315f9ce58539793b1e0922b
languageName: node
linkType: hard

"istanbul-lib-report@npm:^3.0.0, istanbul-lib-report@npm:^3.0.1":
version: 3.0.1
resolution: "istanbul-lib-report@npm:3.0.1"
dependencies:
istanbul-lib-coverage: "npm:^3.0.0"
make-dir: "npm:^4.0.0"
supports-color: "npm:^7.1.0"
checksum: 10c0/84323afb14392de8b6a5714bd7e9af845cfbd56cfe71ed276cda2f5f1201aea673c7111901227ee33e68e4364e288d73861eb2ed48f6679d1e69a43b6d9b3ba7
languageName: node
linkType: hard

"istanbul-lib-source-maps@npm:^5.0.6":
version: 5.0.6
resolution: "istanbul-lib-source-maps@npm:5.0.6"
dependencies:
"@jridgewell/trace-mapping": "npm:^0.3.23"
debug: "npm:^4.1.1"
istanbul-lib-coverage: "npm:^3.0.0"
checksum: 10c0/ffe75d70b303a3621ee4671554f306e0831b16f39ab7f4ab52e54d356a5d33e534d97563e318f1333a6aae1d42f91ec49c76b6cd3f3fb378addcb5c81da0255f
languageName: node
linkType: hard

"istanbul-reports@npm:^3.1.7":
version: 3.2.0
resolution: "istanbul-reports@npm:3.2.0"
dependencies:
html-escaper: "npm:^2.0.0"
istanbul-lib-report: "npm:^3.0.0"
checksum: 10c0/d596317cfd9c22e1394f22a8d8ba0303d2074fe2e971887b32d870e4b33f8464b10f8ccbe6847808f7db485f084eba09e6c2ed706b3a978e4b52f07085b8f9bc
languageName: node
linkType: hard

"jackspeak@npm:^3.1.2":
version: 3.4.3
resolution: "jackspeak@npm:3.4.3"
Expand Down Expand Up @@ -8733,6 +8877,17 @@ __metadata:
languageName: node
linkType: hard

"magicast@npm:^0.3.5":
version: 0.3.5
resolution: "magicast@npm:0.3.5"
dependencies:
"@babel/parser": "npm:^7.25.4"
"@babel/types": "npm:^7.25.4"
source-map-js: "npm:^1.2.0"
checksum: 10c0/a6cacc0a848af84f03e3f5bda7b0de75e4d0aa9ddce5517fd23ed0f31b5ddd51b2d0ff0b7e09b51f7de0f4053c7a1107117edda6b0732dca3e9e39e6c5a68c64
languageName: node
linkType: hard

"make-dir@npm:^3.1.0":
version: 3.1.0
resolution: "make-dir@npm:3.1.0"
Expand All @@ -8742,6 +8897,15 @@ __metadata:
languageName: node
linkType: hard

"make-dir@npm:^4.0.0":
version: 4.0.0
resolution: "make-dir@npm:4.0.0"
dependencies:
semver: "npm:^7.5.3"
checksum: 10c0/69b98a6c0b8e5c4fe9acb61608a9fbcfca1756d910f51e5dbe7a9e5cfb74fca9b8a0c8a0ffdf1294a740826c1ab4871d5bf3f62f72a3049e5eac6541ddffed68
languageName: node
linkType: hard

"make-error@npm:^1.1.1":
version: 1.3.6
resolution: "make-error@npm:1.3.6"
Expand Down Expand Up @@ -11791,6 +11955,17 @@ __metadata:
languageName: node
linkType: hard

"test-exclude@npm:^7.0.1":
version: 7.0.1
resolution: "test-exclude@npm:7.0.1"
dependencies:
"@istanbuljs/schema": "npm:^0.1.2"
glob: "npm:^10.4.1"
minimatch: "npm:^9.0.4"
checksum: 10c0/6d67b9af4336a2e12b26a68c83308c7863534c65f27ed4ff7068a56f5a58f7ac703e8fc80f698a19bb154fd8f705cdf7ec347d9512b2c522c737269507e7b263
languageName: node
linkType: hard

"through@npm:^2.3.6":
version: 2.3.8
resolution: "through@npm:2.3.8"
Expand Down