chore(fingerprintjs): bump submodule to vitest 4.1.10 - #3051
Merged
Conversation
Clears GHSA-5xrq-8626-4rwp, which is reported against this repo because the lockfile carried a nested vitest 3.2.4 tree under packages/fingerprintjs while the root was already on 4.x. With the submodule on the same version the nested copy is deduped away entirely, which is most of the lockfile diff. All 41 fingerprintjs test files pass on 4.1.10.
goastler
marked this pull request as ready for review
August 12, 2026 20:34
goastler
enabled auto-merge (squash)
August 12, 2026 20:34
HughParry
added a commit
that referenced
this pull request
Aug 13, 2026
…act drop Review follow-ups on the vanilla widget port. The image grid lost `paddingTop`/`paddingBottom` (`theme.spacing.unit`, 10px) in the port, so the tiles butted straight up against the instruction header and the button row — neither of which pads against the grid. Restored as a theme-derived `gridStyle`, re-applied on rebuild so a theme change keeps it. `injectStyle` handed a no-op disposer to the second caller for an id but let the first caller's disposer remove the shared tag, so whichever component was destroyed first stripped the CSS out from under its still-mounted siblings. The tag is now reference-counted and each disposer is idempotent. The checkbox baked the theme into its stylesheet at mount and never re-injected, leaving label colour, font and focus ring on the mount-time theme after a swap. The sheet id is now scoped by `palette.mode` and swapped on update. Dropped `RenderSettings` from `renderCaptcha`: it existed for `identifierPrefix` and `emotionCacheKey`, both gone with React, and the remaining `webComponentTag` was never read there. Also restores the `packages/fingerprintjs` pointer to 0467ba6 (main's #3051 vitest 4.1.10 bump); both merges from main had kept the branch's older commit, which would have reverted it on merge. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TdXVDYG6wybfWpMmAhqDpC
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the
packages/fingerprintjssubmodule to prosopo/fingerprintjs#9 (vitest 3.2.4 -> 4.1.10) and refreshes the lockfile.Clears GHSA-5xrq-8626-4rwp: the alert is reported here, not in the submodule, because the lockfile carried a nested vitest 3.2.4 tree under
packages/fingerprintjswhile the root was already on 4.x. Matching versions dedupes that tree away, which accounts for most of the lockfile diff.All 41 fingerprintjs test files pass on 4.1.10.