chore: migrate test suite from Mocha/Chai to Vitest by MarshallOfSound · Pull Request #1257 · electron/rebuild

MarshallOfSound · 2026-04-04T09:35:22Z

This PR migrates the entire test suite from Mocha and Chai to Vitest, a modern and faster test framework.

Summary

The test infrastructure has been completely refactored to use Vitest instead of Mocha/Chai. This includes updating test syntax, assertion methods, and configuration files to align with Vitest's API and conventions.

Key Changes

Test Framework Migration: Replaced Mocha with Vitest as the primary test runner
Assertion Library: Migrated from Chai assertions (e.g., expect().to.equal()) to Vitest assertions (e.g., expect().toBe())
Test Hooks: Updated lifecycle hooks from Mocha style (before, after) to Vitest style (beforeAll, afterAll, beforeEach, afterEach)
Test Syntax: Converted function-based test definitions to arrow functions and removed this.timeout() calls
Configuration:
- Added vitest.config.ts with test configuration including timeout settings, coverage configuration, and file parallelism settings
- Removed .mocharc.jsonc (Mocha configuration)
- Updated package.json scripts to use vitest run instead of mocha
Coverage: Replaced nyc with Vitest's built-in v8 coverage provider
Dependencies:
- Removed: mocha, chai, chai-as-promised, nyc, @types/mocha, @types/chai, @types/chai-as-promised, eslint-plugin-mocha
- Added: vitest, @vitest/coverage-v8
Test Utilities: Updated helper functions to remove Mocha-specific code (e.g., execArgv filtering for tsx)
ESLint: Removed Mocha plugin and related rules from .eslintrc.js
TypeScript Config: Updated tsconfig.json to remove Mocha types

Notable Implementation Details

Test timeout is configured globally in vitest.config.ts (10 minutes) rather than per-test
File parallelism is disabled (fileParallelism: false) since test files share a single TEST_MODULE_PATH fixture on disk
Coverage configuration uses Vitest's v8 provider with lcov reporter for CI integration
All assertion syntax has been updated to use Vitest's chainable API (e.g., .toBe(), .toContain(), .toEqual(), .toHaveLength(), .rejects.toThrow())

https://preview.claude.ai/code/session_01QHrqXbnQUtPxuynmvQsJrz

socket-security · 2026-04-04T09:35:47Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	tar@7.5.10
	vitest@4.1.2
	@vitest/coverage-v8@4.1.2
	node-pre-gyp-test@5.1.6 ⏵ 0.0.0-use.local

View full report

socket-security · 2026-04-04T09:35:49Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		High CVE: Picomatch has a ReDoS vulnerability via extglob quantifiers CVE: GHSA-c2c7-rcm5-vvqj Picomatch has a ReDoS vulnerability via extglob quantifiers (HIGH) Affected versions: >= 4.0.0 < 4.0.4; >= 3.0.0 < 3.0.2; < 2.3.2 Patched version: 4.0.4 From: `?` → `npm/vitest@4.1.2` → `npm/node-gyp@11.2.0` → `npm/picomatch@4.0.2` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/picomatch@4.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: node-npm `tar` Symlink Path Traversal via Drive-Relative Linkpath CVE: GHSA-9ppj-qmqm-q256 node-tar Symlink Path Traversal via Drive-Relative Linkpath (HIGH) Affected versions: < 7.5.11 Patched version: 7.5.11 From: package.json → `npm/tar@7.5.10` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/tar@7.5.10`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket CVE: GHSA-p9ff-h696-f583 Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket (HIGH) Affected versions: >= 8.0.0 < 8.0.5; >= 7.0.0 < 7.3.2; >= 6.0.0 < 6.4.2 Patched version: 8.0.5 From: `?` → `npm/vitest@4.1.2` → `npm/vite@8.0.3` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/vite@8.0.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: Vite: `server.fs.deny` bypassed with queries CVE: GHSA-v2wj-q39q-566r Vite: `server.fs.deny` bypassed with queries (HIGH) Affected versions: >= 8.0.0 < 8.0.5; >= 7.1.0 < 7.3.2 Patched version: 8.0.5 From: `?` → `npm/vitest@4.1.2` → `npm/vite@8.0.3` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/vite@8.0.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

MarshallOfSound · 2026-04-04T09:37:14Z

@SocketSecurity ignore npm/vite@5.4.21

dsanders11

Initial review has a couple of small comments, will come back to this later today.

dsanders11 · 2026-04-06T19:44:56Z

vitest.config.ts

+    // Test files share a single TEST_MODULE_PATH on disk, so they cannot run
+    // in parallel without clobbering each other's fixtures.
+    fileParallelism: false,


Follow-up for a different PR, but this would probably be easy enough to change if it gave us a speed up on how long CI takes, since it's 5-10 mins.

Agreed, follow-up. The blocker is TEST_MODULE_PATH being a single shared path on disk (os.tmpdir()/electron-rebuild-test), so any two test files that share it would clobber each other's fixtures if they ran concurrently. Making it per-file (e.g., os.tmpdir()/electron-rebuild-test-${path.basename(import.meta.filename)}) would unlock parallelism.

Generated by Claude Code

dsanders11 · 2026-04-06T19:47:06Z

vitest.config.ts

+  test: {
+    include: ['test/*.ts'],
+    reporters: process.env.GITHUB_ACTIONS ? ['default', 'github-actions'] : 'default',
+    testTimeout: 10 * 60 * 1000,


We had more fine-grained timeouts before, now everything is 10 minutes.

Restored. The describe-level { timeout: ... } option in vitest only applies to tests, not to beforeAll/afterAll, so the per-suite timeouts are now passed directly on each describe and the global hookTimeout is set to TIMEOUT_IN_MILLISECONDS (mirroring what mocha's this.timeout() did at the suite level for hooks). The two macOS/Windows-specific 5-minute test overrides also got restored as a third arg on the relevant it() calls, and the 10-minute debug/clang suites are explicit again.

Generated by Claude Code

dsanders11 · 2026-04-06T19:49:58Z

test/helpers/module-setup.ts

+  process.execArgv = process.execArgv.filter((arg, i, all) => {
+    if (arg === '--experimental-import-meta-resolve') return false;
+    if (arg === '--require' && all[i + 1]?.includes('vitest')) return false;
+    if (i > 0 && all[i - 1] === '--require' && arg.includes('vitest')) return false;
+    if (arg === '--conditions' && all[i + 1] === 'development') return false;
+    if (i > 0 && all[i - 1] === '--conditions' && arg === 'development') return false;
+    return true;
+  });


This might prove to be fragile over time. 🤔

Agreed. Simplified to just process.execArgv = [] with a comment explaining the forked node-gyp worker doesn't need any of vitest's worker flags. That's much less coupled to vitest's internal flag list than the earlier per-flag filter.

Generated by Claude Code

Replace mocha + chai + chai-as-promised + nyc with vitest + @vitest/coverage-v8. - Replace describe/it/before/after assertions with vitest equivalents - Replace chai matchers (to.equal, to.deep.equal, to.be.true, etc.) with vitest matchers (toBe, toEqual, etc.) - Replace 'context' aliases with 'describe' - Replace per-test/suite this.timeout() calls with a global testTimeout in vitest.config.ts - Externalize lib/ in vitest's SSR transformer so import.meta.resolve in lib/electron-locator.js works correctly - Disable file parallelism since test files share TEST_MODULE_PATH - Drop the now-obsolete tsx execArgv filter from module-setup.ts

MarshallOfSound requested a review from a team as a code owner April 4, 2026 09:35

MarshallOfSound changed the title ~~Migrate test suite from Mocha/Chai to Vitest~~ chore: migrate test suite from Mocha/Chai to Vitest Apr 4, 2026

MarshallOfSound force-pushed the claude/port-mocha-to-vitest-XGpun branch 25 times, most recently from c262511 to c2f1139 Compare April 6, 2026 16:33

MarshallOfSound force-pushed the claude/port-mocha-to-vitest-XGpun branch 7 times, most recently from 23745e1 to f7574b7 Compare April 6, 2026 17:19

dsanders11 reviewed Apr 6, 2026

View reviewed changes

MarshallOfSound force-pushed the claude/port-mocha-to-vitest-XGpun branch from f7574b7 to 822fb79 Compare April 6, 2026 19:53

dsanders11 approved these changes Apr 7, 2026

View reviewed changes

VerteDinde approved these changes Apr 7, 2026

View reviewed changes

MarshallOfSound merged commit 2ed0cf7 into main Apr 7, 2026
6 checks passed

MarshallOfSound deleted the claude/port-mocha-to-vitest-XGpun branch April 7, 2026 02:27

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: migrate test suite from Mocha/Chai to Vitest#1257

chore: migrate test suite from Mocha/Chai to Vitest#1257
MarshallOfSound merged 1 commit intomainfrom
claude/port-mocha-to-vitest-XGpun

MarshallOfSound commented Apr 4, 2026

Uh oh!

socket-security bot commented Apr 4, 2026 •

edited

Loading

Uh oh!

socket-security bot commented Apr 4, 2026 •

edited

Loading

Uh oh!

MarshallOfSound commented Apr 4, 2026

Uh oh!

dsanders11 left a comment

Uh oh!

dsanders11 Apr 6, 2026

Uh oh!

MarshallOfSound Apr 6, 2026

Uh oh!

dsanders11 Apr 6, 2026

Uh oh!

MarshallOfSound Apr 6, 2026

Uh oh!

dsanders11 Apr 6, 2026

Uh oh!

MarshallOfSound Apr 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

MarshallOfSound commented Apr 4, 2026

Summary

Key Changes

Notable Implementation Details

Uh oh!

socket-security bot commented Apr 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Apr 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

MarshallOfSound commented Apr 4, 2026

Uh oh!

dsanders11 left a comment

Choose a reason for hiding this comment

Uh oh!

dsanders11 Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

MarshallOfSound Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

dsanders11 Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

MarshallOfSound Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

dsanders11 Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

MarshallOfSound Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

socket-security bot commented Apr 4, 2026 •

edited

Loading

socket-security bot commented Apr 4, 2026 •

edited

Loading