44 lines
1.6 KiB
JavaScript
44 lines
1.6 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import { readFileSync } from "node:fs";
|
|
import path from "node:path";
|
|
import { fileURLToPath } from "node:url";
|
|
import { describe, it } from "vitest";
|
|
|
|
const rootDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
|
|
|
|
function readRepoFile(relativePath) {
|
|
return readFileSync(path.join(rootDir, relativePath), "utf8");
|
|
}
|
|
|
|
describe("React Router RSC audit exception", () => {
|
|
it("stays limited to the unused unstable RSC runtime", () => {
|
|
const workspace = readRepoFile("pnpm-workspace.yaml");
|
|
const packageManifest = readRepoFile("package.json");
|
|
const lockfile = readRepoFile("pnpm-lock.yaml");
|
|
const routerConfig = readRepoFile("react-router.config.ts");
|
|
|
|
assert.match(workspace, /ignoreGhsas:\s*\n\s+- "GHSA-qwww-vcr4-c8h2"/u);
|
|
assert.match(workspace, /"postcss": "8\.5\.22"/u);
|
|
|
|
for (const [file, source] of [
|
|
["package.json", packageManifest],
|
|
["react-router.config.ts", routerConfig],
|
|
]) {
|
|
assert.doesNotMatch(
|
|
source,
|
|
/@vitejs\/plugin-rsc|react-server-dom-webpack|unstable_reactServer|unstable_rsc/u,
|
|
`${file} must not enable the RSC runtime while GHSA-qwww-vcr4-c8h2 is ignored`,
|
|
);
|
|
}
|
|
|
|
// React Router advertises these optional peers in its own lockfile
|
|
// metadata. The exception remains valid only while neither runtime is
|
|
// actually resolved into HiveGrid's dependency graph.
|
|
assert.doesNotMatch(
|
|
lockfile,
|
|
/^ (?:'@vitejs\/plugin-rsc@|react-server-dom-webpack@)/mu,
|
|
"the RSC runtime must not be installed while GHSA-qwww-vcr4-c8h2 is ignored",
|
|
);
|
|
});
|
|
});
|