fix: upgrade vite 6→8 and vitest 3→4 to resolve esbuild CVE

[rpkruse]

Summary

• Upgrades vite from ^6.4.3 to ^8.0.0 — vite 8 replaces esbuild with rolldown, completely eliminating the vulnerable package from the dependency tree
• Upgrades vitest, @vitest/coverage-v8, and @vitest/ui from ^3.2.6 to ^4.0.0 to match
• Fixes vitest 4 breaking change: vi.fn() mocks used as constructors (new) must use function rather than arrow functions — updated tests/setup.ts and tests/memori.test.ts

Test plan

• npm run typecheck — no errors
• npm test — 256/256 tests pass
• npm audit — esbuild no longer appears in vulnerability report

[cursor]

Stale comment

Summary

This PR upgrades memori-ts dev tooling from Vite 6/Vitest 3 to Vite 8/Vitest 4, updates the lockfile, and adjusts a couple of Vitest mocks to work with the new mocking behavior.

Findings

Requires changes:

• memori-ts/package.json: the package still advertises Node >=20.12.0, but Vite 8 requires ^20.19.0 || >=22.12.0, and Vitest now fails to start on Node 20.12.0. Please either raise the documented/dev Node floor consistently, including memori-ts/README.md, or keep tooling on versions that support the current advertised minimum.

Suggestions

• npm audit no longer reports the esbuild advisory, but it still reports two moderate transitive advisories for protobufjs and ws. These were already present on the base lockfile at the same versions, so I do not consider them blocking for this PR.

Tests

Ran from memori-ts/ on PR head 11a4916:

• npm ci
• npm test - 256 passed
• npm run lint
• npm run build
• npm audit --json - exits non-zero for pre-existing protobufjs and ws advisories
• npx -y -p node@20.12.0 node ./node_modules/vitest/vitest.mjs run - fails during Vitest startup
• npx -y -p node@20.19.0 node ./node_modules/vitest/vitest.mjs --version - succeeds

Recommendation

Requires changes due to the advertised Node compatibility regression.

  

_{Sent by Cursor Automation: Memori PR Review}

[cursor]

Stale comment

Summary

This PR upgrades memori-ts dev tooling from Vite 6/Vitest 3 to Vite 8/Vitest 4, regenerates the lockfile, and updates Vitest mocks for constructor compatibility.

Findings

Required: The PR raises the published SDK runtime engine to Node >=20.19.0 even though the changed dependency pressure comes from dev-only Vite/Vitest tooling. This changes the install contract for @memorilabs/memori: consumers on Node 20.12-20.18 with engine-strict can no longer install the package, despite no runtime code or runtime dependencies changing. Please either keep the package/README runtime requirement at the previous supported Node level and document the Node 20.19+ requirement as a development/test tooling requirement, or explicitly treat this as a breaking runtime support change.

Suggestions

If the runtime engine bump is intentionally kept, please also regenerate/update the lockfile root package metadata so memori-ts/package-lock.json does not still advertise >=20.12.0 for the root package.

npm audit --json no longer reports an installed esbuild package, but it still reports two unrelated moderate advisories (protobufjs, ws). That does not block this Vite/Vitest fix, but it is worth tracking separately if the goal becomes a clean audit report.

Tests

Ran locally from memori-ts/:

• npm ci
• npm run typecheck
• npm test (256 passed)
• npm run lint
• npm run build
• npm audit --json

Observed CI: CodeQL, Python CI, security, lint/typecheck, Python test matrix, and Linux/macOS TypeScript matrix were passing; Windows TypeScript matrix was still pending at last check.

Recommendation

Requires changes for the Node engine compatibility issue above.

  

_{Sent by Cursor Automation: Memori PR Review}

[cursor]

Stale comment

Summary

This PR upgrades the memori-ts Vite/Vitest dev toolchain and lockfile to remove the resolved esbuild dependency, and updates the Vitest native-module mocks for the newer runner behavior.

Findings

Required change:

• memori-ts/package.json still advertises Node >=20.12.0, but the upgraded Vite/Rolldown toolchain requires a newer Node 20 minor. See the inline comment for the concrete failure.

Suggestions

• The remaining npm audit findings (protobufjs, ws) appear unchanged from main and come through existing broad provider SDK ranges (@google/genai / openai), so I would treat them as a separate follow-up rather than part of this PR.

Tests

Ran locally on PR head 7018bdc:

• npm ci in memori-ts/
• npm test in memori-ts/ (256 passed)
• npm run build in memori-ts/
• npm run lint in memori-ts/
• npm audit --json / npm explain protobufjs && npm explain ws
• npx -y node@20.12.0 node_modules/vitest/vitest.mjs run tests/core/engine.test.ts (fails at startup)
• npx -y node@20.19.0 node_modules/vitest/vitest.mjs run tests/core/engine.test.ts (passes)

Remote CI was mostly green when checked; Windows TS matrix jobs were still in progress.

Recommendation

Requires changes: please align the advertised/dev Node support floor with the upgraded Vite/Vitest toolchain before merging.

  

_{Sent by Cursor Automation: Memori PR Review}

[cursor]

Stale comment

Summary

This PR upgrades the memori-ts Vite/Vitest dev toolchain to Vite 8/Vitest 4, refreshes the lockfile to remove the installed esbuild package, updates Vitest constructor mocks, and raises the documented Node floor to >=20.19.0.

Findings

No required changes found in the current PR head. The earlier Node-floor compatibility issue is resolved by aligning package.json and the README with Vite 8's Node requirement.

Suggestions

I left one small inline suggestion: the root package metadata in memori-ts/package-lock.json still carries the old Node engine value, even though package.json and docs now say >=20.19.0.

The remaining npm audit findings are two moderate transitive advisories for protobufjs and ws; esbuild is no longer installed, and these findings appear unrelated to this Vite/Vitest change.

Tests

Ran locally from memori-ts/ on PR head ac470a5:

• npm ci
• npm test - 256 passed
• npm run typecheck
• npm run build
• npm run lint
• npm audit --json
• npm install --package-lock-only --ignore-scripts as a probe, which changed only the stale lockfile engine line; the workspace was restored afterward

GitHub checks that had completed were passing; several OS/Node matrix jobs were still pending when reviewed.

Recommendation

Approved with comments. No blocking merge risks found, pending the remaining CI matrix completing successfully.

  

_{Sent by Cursor Automation: Memori PR Review}

[cursor]

Summary

This PR upgrades the memori-ts Vite/Vitest toolchain to Vite 8/Vitest 4, refreshes the lockfile so esbuild is no longer installed, updates Vitest constructor mocks, and aligns the documented/package Node floor at >=20.19.0.

Findings

No required changes found in the current PR head. The prior Node engine and lockfile metadata concerns are addressed in package.json, README.md, and package-lock.json.

Suggestions

npm audit still reports two moderate transitive advisories for protobufjs and ws, but both versions are already present on the base lockfile via existing broad provider SDK ranges (@google/genai / openai). I would track those separately rather than block this Vite/Vitest CVE fix.

Tests

Ran locally from memori-ts/ on PR head 5fc4eced1245e3abe1cec112ff3dfb3df595fd95:

• npm ci
• npm test - 256 passed
• npm run typecheck
• npm run build
• npm run lint
• npm run format:check
• git diff --check eecb3cf24c25fb3c9bc07e6f5a78ff15aa4e275a...refs/remotes/origin/pr/596
• npm audit --json - non-zero only for the pre-existing protobufjs and ws advisories above
• npx -y -p node@20.19.0 node ./node_modules/vitest/vitest.mjs run tests/core/engine.test.ts - 24 passed

Observed GitHub checks: CodeQL JS/TS and Python completed successfully; CI lint, security, and type-check completed successfully. The OS/Node TypeScript matrix and Python test matrix were still in progress at last refresh.

Recommendation

Approved with comments. No blocking merge risks found, pending the remaining CI matrix completing successfully.

  

_{Sent by Cursor Automation: Memori PR Review}