fix(snapshot): support no-unsafe-eval CSP by evaluating snapshot files on server - #10665
Merged
Merged
Conversation
…s outside the tester Add an optional `readSnapshotFileData` to `SnapshotEnvironment` so environments that cannot evaluate snapshot content in the test runtime (e.g. the browser under a `no-unsafe-eval` CSP) can evaluate it elsewhere. `SnapshotState.create` provides the general default inline: it reads and evaluates the file in the current runtime when the environment does not implement the method. The browser is the only environment that overrides it, delegating to the server over RPC. Replace the silent `getSnapshotData` eval with `evaluateSnapshotFile`, which throws a hard error on corrupted snapshot files instead of swallowing it. Co-authored-by: OpenCode (claude-opus-4-8) <noreply@opencode.ai>
✅ Deploy Preview for vitest-dev ready!Built without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify project configuration. |
hi-ogawa
commented
Aug 10, 2026
hi-ogawa
commented
Aug 10, 2026
Co-authored-by: OpenCode <noreply@opencode.ai>
Co-authored-by: OpenCode <noreply@opencode.ai>
Co-authored-by: OpenCode <noreply@opencode.ai>
hi-ogawa
commented
Aug 10, 2026
| "@types/node": "catalog:", | ||
| "@types/pngjs": "^6.0.5", | ||
| "@types/ws": "catalog:", | ||
| "@vitest/snapshot": "workspace:*", |
Collaborator
Author
There was a problem hiding this comment.
This adds a dev dep to bundle a small piece of code evaluateSnapshotFile about 20 loc. Technically this duplicates main vitest package's snapshot bundled dep, but should be fine since small enough.
Co-authored-by: OpenCode <noreply@opencode.ai>
Co-authored-by: OpenCode <noreply@opencode.ai>
Co-authored-by: OpenCode <noreply@opencode.ai>
hi-ogawa
commented
Aug 12, 2026
Comment on lines
+322
to
+324
| const root = ctx?.config.root | ||
| if (errors && errors.length > 0 && root) { | ||
| tree.__unhandled_errors__ = errors.map((e: any) => replaceRoot(e.message, root)) |
Collaborator
Author
There was a problem hiding this comment.
Tweaked error tree to normalize root:
"__unhandled_errors__": [
"Invalid snapshot file, please manually fix or delete it: <root>/__snapshots__/basic.test.ts.snap",
]
hi-ogawa
marked this pull request as ready for review
August 12, 2026 03:24
sheremet-va
requested changes
Aug 12, 2026
| return fs.readFile(snapshotPath, 'utf-8') | ||
| }, | ||
| async readSnapshotFileData(snapshotPath) { | ||
| checkFileAccess(snapshotPath) |
Member
There was a problem hiding this comment.
I think this also needs api.allowExec check
Collaborator
Author
There was a problem hiding this comment.
Good point. Updated 👌
Co-authored-by: OpenCode <noreply@opencode.ai>
Co-authored-by: OpenCode <noreply@opencode.ai>
Co-authored-by: OpenCode <noreply@opencode.ai>
Co-authored-by: OpenCode <noreply@opencode.ai>
sheremet-va
approved these changes
Aug 12, 2026
7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
getSnapshotDataswallows the parse error, making snapshot failures impossible to debug #10615Currently the snapshot utils always evaluates snapshot file key values with
new Functionin the test runtime, but this would fails on browser mode with stricter CSP.This PR adds
SnapshotEnvironment.readSnapshotFileData, so browser environment can evaluate the file on the server so that browser runtime can directly receive napshot key value data.Also as a drive-by change, this PR now surfaces snapshot files evaluation errors as an actionable errors instead of silently ignoring it.
TODO
Please don't delete this checklist! Before submitting the PR, please make sure you do the following:
pnpm-lock.yamlunless you introduce a new test example.Tests
pnpm test:ci.Documentation
pnpm run docscommand.Changesets
feat:,fix:,perf:,docs:, orchore:.