Skip to content

chore/enhanced rstest migration#4317

Merged
ScriptedAlchemy merged 29 commits intomainfrom
chore/enhanced-rstest-migration
Jan 30, 2026
Merged

chore/enhanced rstest migration#4317
ScriptedAlchemy merged 29 commits intomainfrom
chore/enhanced-rstest-migration

Conversation

@ScriptedAlchemy
Copy link
Copy Markdown
Member

@ScriptedAlchemy ScriptedAlchemy commented Jan 23, 2026

  • chore: update jest to vitest
  • chore(task): generate stage 1 (manifest)
  • chore(task): generate stage 1 (manifest)
  • chore(task): generate stage 1 (manifest)
  • chore: update enhanced rstest migration artifacts
  • test: relax manifest-disable-assets expectations
  • chore: remove jest/vitest infra and update rstest
  • test: fail config cases without bundles
  • chore: restore jest and vitest tooling
  • test: tighten rstest harness execution checks

@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented Jan 23, 2026 •
edited
Loading

⚠️ No Changeset found

Latest commit: 486e3cd

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@netlify
Copy link
Copy Markdown

netlify Bot commented Jan 23, 2026 •
edited
Loading

✅ Deploy Preview for module-federation-docs ready!

Name Link
🔨 Latest commit 486e3cd
🔍 Latest deploy log https://app.netlify.com/projects/module-federation-docs/deploys/697cfc8214011200080fc7a8
😎 Deploy Preview https://deploy-preview-4317--module-federation-docs.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

github-advanced-security[bot]
github-advanced-security AI found potential problems Jan 23, 2026
View reviewed changes
Comment thread packages/enhanced/test/ConfigTestCases.rstest.ts
);
const code = `(function(${args.join(
', ',
)}) {${content}\n})`;

Check warning

Code scanning / CodeQL

Improper code sanitization Medium test

Code construction depends on an
improperly sanitized value
Loading
.

Copilot Autofix

AI 3 months ago

In general, to fix this issue you must ensure that any string data used to build executable JavaScript source code is further sanitized beyond JSON.stringify, by escaping characters that could prematurely terminate or alter the surrounding code or a <script> context (e.g. <, >, /, backslash, control characters, Unicode line/paragraph separators). You then use the sanitized string when constructing content so that even if arg is malicious, the generated JavaScript remains syntactically safe.

The best fix here is to introduce a small helper escapeUnsafeChars (and a corresponding charMap) near the top of this file and apply it to the result of JSON.stringify(\./${arg}`)when constructingcontentin theArray.isArray(module)branch. This preserves existing behavior (the runtime value of the string passed torequireremains the same) while ensuring thatcontent` no longer contains problematic characters that CodeQL flags. Concretely:

  • Add charMap and escapeUnsafeChars definitions in packages/enhanced/test/ConfigTestCases.rstest.ts after the existing imports and before other logic.
  • Change the template string that currently contains `require(${JSON.stringify(`./${arg}`)})` so that it instead calls escapeUnsafeChars on the JSON string: `require(${escapeUnsafeChars(JSON.stringify(`./${arg}`))})`.

No new external dependencies are required; the helper uses String.prototype.replace and a regular expression.

Suggested changeset 1
packages/enhanced/test/ConfigTestCases.rstest.ts

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/packages/enhanced/test/ConfigTestCases.rstest.ts b/packages/enhanced/test/ConfigTestCases.rstest.ts
--- a/packages/enhanced/test/ConfigTestCases.rstest.ts
+++ b/packages/enhanced/test/ConfigTestCases.rstest.ts
@@ -15,6 +15,25 @@
   rs,
 } from '@rstest/core';
 
+const charMap: { [ch: string]: string } = {
+  '<': '\\u003C',
+  '>': '\\u003E',
+  '/': '\\u002F',
+  '\\': '\\\\',
+  '\b': '\\b',
+  '\f': '\\f',
+  '\n': '\\n',
+  '\r': '\\r',
+  '\t': '\\t',
+  '\0': '\\0',
+  '\u2028': '\\u2028',
+  '\u2029': '\\u2029',
+};
+
+function escapeUnsafeChars(str: string): string {
+  return str.replace(/[<>/\\\b\f\n\r\t\0\u2028\u2029]/g, (x) => charMap[x] || x);
+}
+
 // Create a require function using __filename (available in CommonJS output mode)
 const nativeRequire = createRequire(__filename);
 
@@ -759,7 +778,7 @@
                             content = `module.exports = (${module
                               .map(
                                 (arg: any) =>
-                                  `require(${JSON.stringify(`./${arg}`)})`,
+                                  `require(${escapeUnsafeChars(JSON.stringify(`./${arg}`))})`,
                               )
                               .join(', ')});`;
                           } else {
EOF
@@ -15,6 +15,25 @@
rs,
} from '@rstest/core';

const charMap: { [ch: string]: string } = {
'<': '\\u003C',
'>': '\\u003E',
'/': '\\u002F',
'\\': '\\\\',
'\b': '\\b',
'\f': '\\f',
'\n': '\\n',
'\r': '\\r',
'\t': '\\t',
'\0': '\\0',
'\u2028': '\\u2028',
'\u2029': '\\u2029',
};

function escapeUnsafeChars(str: string): string {
return str.replace(/[<>/\\\b\f\n\r\t\0\u2028\u2029]/g, (x) => charMap[x] || x);
}

// Create a require function using __filename (available in CommonJS output mode)
const nativeRequire = createRequire(__filename);

@@ -759,7 +778,7 @@
content = `module.exports = (${module
.map(
(arg: any) =>
`require(${JSON.stringify(`./${arg}`)})`,
`require(${escapeUnsafeChars(JSON.stringify(`./${arg}`))})`,
)
.join(', ')});`;
} else {
Copilot is powered by AI and may make mistakes. Always verify output.
ScriptedAlchemy and others added 15 commits January 22, 2026 19:08
@ScriptedAlchemy
test: fix warmup webpack formatter issue
9f5163a
@ScriptedAlchemy
chore: drop expose-gc from enhanced test
0eb0554
@ScriptedAlchemy
chore: ensure rsbuild-plugin builds after enhanced
0b7544d
@ScriptedAlchemy
chore(enhanced): remove task artifacts
106354e
@ScriptedAlchemy
Merge branch 'main'
2482846
@ScriptedAlchemy @claude
fix(enhanced): fix rstest harness afterExecute order and add no-tests…
f552098 
… guard

- Move afterExecute() before the collected tests check, matching the
  Jest template flow. SystemJS test cases (e.g. module-federation) rely
  on afterExecute to trigger deferred module evaluation that registers
  it() calls.
- Add a guard that fails when a config case produces no exported tests
  unless testConfig.noTests is explicitly set, preventing silent test
  coverage loss.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@ScriptedAlchemy
Merge remote-tracking branch 'origin/main' into chore/enhanced-rstest…
fcfe79b 
…-migration

# Conflicts:
#	.gitignore
#	package.json
#	packages/enhanced/project.json
#	packages/enhanced/test/ConfigTestCases.template.js
@ScriptedAlchemy
fix(enhanced): align rstest harness with jest
10c8e0b
@ScriptedAlchemy
fix(enhanced): share rstest bundle context
4f460cd
@ScriptedAlchemy
Merge branch 'main' into chore/enhanced-rstest-migration
ec7c2f9
@ScriptedAlchemy
Merge branch 'main' into chore/enhanced-rstest-migration
e664fcc
@ScriptedAlchemy
fix(website-new): avoid mdx swc parse errors
afdd573
@ScriptedAlchemy
fix(enhanced): ensure reshake fixtures for rstest
85aba56
@ScriptedAlchemy
fix(enhanced): resolve reshake fixtures from repo root
35d5bf6
@ScriptedAlchemy
fix(enhanced): stabilize tree-shaking fixtures
44054e3
@ScriptedAlchemy
Copy link
Copy Markdown
Member Author

ScriptedAlchemy commented Jan 30, 2026

@codex review pr

@chatgpt-codex-connector
Copy link
Copy Markdown

chatgpt-codex-connector Bot commented Jan 30, 2026

To use Codex here, create a Codex account and connect to github.

@ScriptedAlchemy ScriptedAlchemy merged commit 0185284 into main Jan 30, 2026
20 of 21 checks passed
@ScriptedAlchemy ScriptedAlchemy deleted the chore/enhanced-rstest-migration branch January 30, 2026 19:09
@2heal1 2heal1 mentioned this pull request Feb 3, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@ScriptedAlchemy @github-advanced-security @2heal1