create-objectstack, os create plugin: the scaffolds' vitest "~4.0.0" pin (PR #23799, against npm 10's edgesOut crash) now starts every new project on @vitest/mocker 4.0.18, inside GHSA-qxg6-89mg-rqv8, which has no 4.0.x fix

Filed by domain:devx seat 1 (seat post #6023) · os-warren · session session_01FM29ZqLTrnPNXxijioZwMp, from the #25163 dev's out-of-scope finding (PR #25164). Routed to domain:cli, which owns create-objectstack and packages/cli in SKILL.md's lane table. The pin came from #23788 (domain:devx, PR #23799 d795719926) and its CLI half #23805. ⛔ Not a claim.

What ships

packages/create-objectstack/src/templates/blank/package.json declares "vitest": "~4.0.0" in devDependencies (:31) and again in npm overrides (:34).
The package's tsup.config.ts copies src/templates to dist/templates, and files ships dist, so every create-objectstack scaffold carries the pin.
The CLI scaffolds carry the same range. packages/cli/src/commands/init.ts:421 reads export const SCAFFOLD_VITEST_RANGE = '~4.0.0'; (cli: os init / os create emit manifests npm 10 cannot install since vitest@4.1.12 (edgesOut); the CLI half of #23788's template override #23805), which is used by objectstack init -t plugin and objectstack create plugin.
Today ~4.0.0 resolves to vitest 4.0.18 and its exact @vitest/mocker 4.0.18 (npm view; 4.0.18 is the newest 4.0.x).

Why it is now a defect

The advisory. GHSA-qxg6-89mg-rqv8 was published 2026-10-21. It is a code injection through unauthenticated manual-mock registration, served on the dev-server origin. It affects @vitest/mocker from 2.1.0-beta.7 up to the fix in 4.1.12, so 4.0.18 is affected, and no 4.0.x fix exists. The range is from the OSV record as the [finding] main's lockfile matches two new OSV advisories on @vitest/mocker 4.1.11 (GHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp; fixed in 4.1.12): the scheduled OSV scan is red again #25163 dev read it; osv.dev is not reachable from this seat's container.
The trade-off the pin never weighed. PR fix(devx): npm 10 crashes with edgesOut on the vendor-export probe and the blank scaffold — the probe installs with a pinned npm 11, the template overrides vitest #23799 pinned ~4.0.0 on 2026-10-16 deliberately, because vitest 4.1.12 declares "@vitest/browser-webdriverio": "^4.1.11", which no 4.1.12 satisfies, and npm 10 crashes on that peer set (Cannot read properties of null (reading 'edgesOut')). The advisory came five days later.
The monorepo is fixed separately. [finding] main's lockfile matches two new OSV advisories on @vitest/mocker 4.1.11 (GHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp; fixed in 4.1.12): the scheduled OSV scan is red again #25163 / PR fix(deps): re-lock vitest and the @vitest/* family onto 4.1.12 for the two @vitest/mocker OSV advisories #25164 re-locks it to 4.1.12. This card covers only the shipped scaffolds, the template and SCAFFOLD_VITEST_RANGE, which install with npm and have no lockfile.

Done when

A fresh create-objectstack blank scaffold, and a fresh objectstack create plugin scaffold, each installs on npm 10 and on npm 11 with no edgesOut crash. It then resolves @vitest/mocker at or above 4.1.12 (or a later fixed line), and npm audit / an OSV scan of the installed tree reports no @vitest/mocker advisory.
The route is measured, not assumed. Candidates:
- the vitest 4.1.x line with an override that settles the contradictory optional peer;
- vitest 5.x (5.0.5 is latest), if its peer set does not crash npm 10 and the template's tests pass on it;
- or another route.
Each candidate is read on npm 10 and npm 11.
The PR states why the chosen route holds on npm 10. If no route serves both npm 10 and the fix, the report returns needs_decision with the measurements, because dropping npm 10 support is the maintainer's call.
A changeset for create-objectstack and @objectstack/cli, since both ship the range.
Registry canary failed: fresh npx create-objectstack install is broken #24462 (open, pm:blocked on [Decision] The nightly registry canary is red since 10-16: npx create-objectstack@latest is 17.7.0, whose install crashes on npm 10 (edgesOut), and 17.x is frozen — canary on @next until 18.0 GA (A), a scaffolder-only 17.7.1 (B), or wait (C)? #24445) is the registry canary of a fresh npx create-objectstack install, with a different root cause. A route chosen here must keep that canary's install green on npm 10.

Dedupe

search_issues on objectstack:

"create-objectstack blank template vitest 4.0 advisory scaffold @vitest/mocker npm 10 edgesOut": 0 hits.
"create-objectstack scaffold vitest pin npm 10 crash": 62 hits. The nearest are release(next): the Version Packages PR #23481 is red — npm 10 crashes with edgesOut on two lockfile-less installs (validate-deps vendor-export resolve, scaffold-e2e); fix on main, never on the generated branch #23788 and cli: os init / os create emit manifests npm 10 cannot install since vitest@4.1.12 (edgesOut); the CLI half of #23788's template override #23805 (the pin's two halves, closed), finding: on npm 10 (Node 22's bundled major), npm install of a scaffold that declares vitest ^4.0.0 (SCAFFOLD_VITEST_RANGE: objectstack init -t plugin, objectstack create plugin) crashes with "Cannot read properties of null (reading 'edgesOut')" #22912 (the first edgesOut finding, closed), [Decision] The nightly registry canary is red since 10-16: npx create-objectstack@latest is 17.7.0, whose install crashes on npm 10 (edgesOut), and 17.x is frozen — canary on @next until 18.0 GA (A), a scaffolder-only 17.7.1 (B), or wait (C)? #24445 (the canary decision, closed) and Registry canary failed: fresh npx create-objectstack install is broken #24462 (the canary anchor, open, a different cause). None names the advisory.

Dedupe words: create-objectstack blank template vitest ~4.0.0 advisory, SCAFFOLD_VITEST_RANGE advisory, scaffold @vitest/mocker 4.0.18.

Generated by Claude Code

Claim: PM loop round 1 · domain:cli seat 2 · p2 · security · claimed under exception 2 (filer-labelled by domain:devx seat 1; the lane fits the table: create-objectstack and packages/cli; the body reads as filing gate ① with its reader and dedupe) · 2026-10-22T04:09Z
Session: session_01AFrKwndmrCLtF5V9hNtrw3
Account: os-bill (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-25165-scaffold-vitest-advisory
Worktree: objectstack-issue-25165
Domain: domain:cli
Seat: domain:cli#2 (seat post #22648)
File surface (read on origin/main 06900c9c2; stop on a breach and explain it in the report): packages/create-objectstack/src/templates/blank/package.json (the vitest range in devDependencies and overrides, :31, :34), packages/cli/src/commands/init.ts (SCAFFOLD_VITEST_RANGE, :421, and only what an override for the chosen route needs beside it), their tests, and changesets for create-objectstack and @objectstack/cli.
Container & model: M, mode:subagent, model: default tier (dispatch-gates.mjs --tier: "no path-derived mandate")
Clause-②: no
Basis for the Clause-② line: the scaffolds' dev-dependency range moves; no accept set or public surface of either package widens.
Responsibility: this lane's two scaffold sources (create-objectstack's template and init.ts's SCAFFOLD_VITEST_RANGE); the platform path that already covers the shape is the monorepo's own re-lock (#25163, PR #25164); it reaches every newly scaffolded project, which starts on @vitest/mocker 4.0.18 inside GHSA-qxg6-89mg-rqv8.
Thread-read: none
Serial constraints cleared: no open PR touches packages/create-objectstack/** or packages/cli/src/commands/init.ts (the open PRs' file lists read in this act). PR #25164 (domain:devx, the monorepo re-lock) is one file, disjoint. Fold-or-serial with #25123 (p3, queued, same file init.ts, SCAFFOLD_ALLOWED_PEER_VERSIONS): a different fix shape, so not folded; #25123 is serial after this card and re-reads init.ts on the merged code. #24462's registry canary of npx create-objectstack must stay green on npm 10.

Generated by Claude Code

os-dev-report

{
  "issue": 25165,
  "status": "done",
  "branch": "claude/issue-25165-scaffold-vitest-advisory",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/25173",
  "head": "4eb2ff4c4",
  "session": "session_01AFrKwndmrCLtF5V9hNtrw3 (mode:subagent; the dispatching seat's id, matching claim 6332477074, whose Branch: line names this branch)",
  "premise_still_valid": true,
  "summary": "Route B is taken: vitest `~4.1.12` plus the existing `overrides.vitest`, moved together.\n- SCAFFOLD_VITEST_RANGE in packages/cli/src/commands/init.ts goes from ~4.0.0 to ~4.1.12.\n- SCAFFOLD_NPM_OVERRIDES is built from that constant, so every standalone os init / os create plugin manifest overrides vitest to ~4.1.12. Its shape is unchanged.\n- The blank template's devDependencies.vitest and overrides.vitest were re-stamped by the write run of scripts/sync-scaffold-emission-policy.mjs.\n- A floor pin was added: the range's lowest version must be at or above the advisory fix for its major (4.1.12; 5.0.3 on 5.x), and an unknown major is refused.\n- One patch changeset names @objectstack/cli and create-objectstack.\n\nWhy it holds on npm 10: vitest 4.1.12 itself peers @vitest/browser-webdriverio ^4.1.11, whose only release peers vitest 4.1.11 exactly. npm 10 crashes on that peer set without the override (edgesOut, measured on every manifest that declares vitest, and on -t app through optional peers). With the vitest override alone, npm 10.9.4, 10.9.9 and 11.21.1 install every manifest.\n- H2 is half-falsified: no @vitest/browser-webdriverio override is needed.\n- The install does not depend on the latest tag: latest is 5.0.5, outside the range, and the range installs.\n\nH1 confirmed from the npm registry's bulk advisory endpoint (osv.dev answers 403 at the proxy): GHSA-qxg6-89mg-rqv8 on @vitest/mocker affects from 2.1.0-beta.7 up to the fix in 4.1.12, and from 5.0.0-beta.1 up to the fix in 5.0.3. The baseline's 4.0.18 is also inside GHSA-82fw-gwwq-j7x9 and vitest's critical GHSA-5xrq-8626-4rwp; the new floor clears all three.\n\nWhy 5.x was not chosen, though route D (^5.0.5 + override) also installs and clears the advisory: vitest 5's engines.node is ^22.12.0 || ^24.0.0 || >=26.0.0, narrower than the CLI's >=22.0.0, while 4.1.12 keeps 4.0.18's engines. The monorepo itself runs vitest 4.1.x. This is the smallest change.\n\nH3 holds: one constant, stamped into the template. H4: SCAFFOLD_ALLOWED_PEER_VERSIONS is untouched.",
  "route_measurements": {
    "method": "Each manifest in its own empty directory under the scratchpad, with a fresh --cache for every leg. @objectstack/* ranges ^18.0.0 resolve to the published 18.0.0. vitest and every @vitest/mocker copy are read from node_modules, then npm audit --json is run. The blank template's bytes equal this PR's stamped template. The os init / os create manifests' dependency blocks are byte-equal to this branch's source emission (bin/run-dev.js). '4.1.12' = exactly one vitest and one @vitest/mocker at that version.",
    "rows": [
      "baseline ~4.0.0 + override | blank | npm 10.9.9: exit 0, 4.0.18, audit lists GHSA-qxg6-89mg-rqv8, GHSA-82fw-gwwq-j7x9, GHSA-5xrq-8626-4rwp | npm 11.21.1: not measured",
      "baseline | os init -t plugin, os create plugin | npm 10.9.9: exit 0, 4.0.18, the same advisories | npm 11.21.1: exit 0, 4.0.18, the same advisories",
      "A ~4.1.12, no override | blank, os init -t plugin, os create plugin | npm 10.9.9: exit 1, Cannot read properties of null (reading 'edgesOut') | npm 11.21.1: blank exit 0, 4.1.12 (plugins not measured)",
      "A | os init -t app, no override | npm 10.9.9: exit 1, edgesOut",
      "B (chosen) ~4.1.12 + override | blank, os init -t plugin, os create plugin | npm 10.9.9: exit 0, 4.1.12, audit: no vitest/@vitest entry | npm 11.21.1: the same | npm 10.9.4: the same",
      "B | os init -t app, -t empty | npm 10.9.9: exit 0, no vitest installed, audit: none | npm 11.21.1: the same",
      "C ^5.0.5, no override | blank | npm 10.9.9: exit 1, edgesOut | npm 11.21.1: exit 0, 5.0.5 at the root plus a nested 4.1.12",
      "D ^5.0.5 + override | blank, os init -t plugin, os create plugin | npm 10.9.9: exit 0, 5.0.5, audit: no vitest entry | npm 11.21.1: the same",
      "D' exact 5.0.4 + override (simulates latest having moved past the range) | blank | npm 10.9.9: exit 0, 5.0.4 | npm 11.21.1: exit 0, 5.0.4"
    ],
    "chosen_route_runtime": "On npm 10.9.9, the full blank template on route B: install exit 0; npm test exit 0 ('RUN v4.1.12', 'Test Files 1 passed (1)', 'Tests 1 passed (1)'); npm run build exit 0. Emitted os init -t plugin and os create plugin on route B: install exit 0, 4.1.12, build exit 0, typecheck exit 0. Their npm test exits 1 'No test files found', the same as the 4.0.18 baseline (see out_of_scope_findings).",
    "audit_residue": "Every manifest except os create plugin keeps 9 moderate npm audit entries on every route, all from GHSA-w5hq-g745-h8pq (uuid 8.x via exceljs via @objectstack/rest). os create plugin audits to 0 on routes B and D."
  },
  "tests": "Head 4eb2ff4c4.\n(1) pnpm --filter @objectstack/cli exec vitest run --project unit --maxWorkers=2, under the verify lock: VERDICT command-exit 1, 'Test Files 2 failed | 320 passed (322)', 'Tests 4728 passed | 29 skipped'. The two failures were test/published-subpath-console.pin.test.ts and test/published-subpath-hook-body.pin.test.ts refusing an unbuilt packages/cli/dist ('packages/cli is not built'), a missing build rather than a test failure.\n(2) After the full build, those two files plus test/scaffold-npm-overrides.test.ts (verbose): VERDICT command-exit 0, 'Test Files 3 passed (3)', 'Tests 41 passed (41)', including '✓ ... its lowest admitted version is at or above the advisory fix for its major'.\n(3) pnpm --filter create-objectstack test: 'Test Files 18 passed (18)', 'Tests 278 passed (278)'.\n(4) pnpm --filter @objectstack/cli typecheck && pnpm --filter create-objectstack typecheck: VERDICT command-exit 0. packages/cli 'tsc -p tsconfig.test.json --listFiles' lists scaffold-npm-overrides.test.ts once; create-objectstack's tsc --listFiles lists template-consistency.test.ts once.\n(5) eslint --no-inline-config over the 3 changed TS files: exit 0.\n(6) Ablation of the floor pin, fix committed first, through scripts/ablation-replace.mjs in wrap mode. The mutation SCAFFOLD_VITEST_RANGE '~4.1.12' to '~4.0.0' landed: anchor 1 to 0, blob 47a2518d9a21 to 8da3d5de0b48. Result: 'Tests 1 failed | 11 passed (12)', with 'SCAFFOLD_VITEST_RANGE \"~4.0.0\" admits 4.0.0, below the fix 4.1.12'. The 11 derived-equality cases stay green under the mutation. Restored: blob equals HEAD 47a2518d9a21, git diff HEAD empty, git status clean. The test imports ../src, so no dist is on its path.\n(7) The CLI integration tier is left to CI: the diff touches no spawn entry and no integration-tier file. test:repo was not run locally: the diff touches none of its tests and the derivation does not name it.",
  "gates": "Local, head 4eb2ff4c4, merge base 425c743fd, 5 paths. node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 84 commands. Each was run byte for byte, with its exit code captured before any pipe. First pass: 80 exited 0. check:dual-build-cjs-loads, check:i18n, check:i18n-coverage and check:i18n-walk-parity exited 3 (PREREQUISITE NOT MET, no dist). After turbo run build over every package (75/75 tasks, under the lock, VERDICT command-exit 0), all four re-ran to exit 0. --ran: '84 derived, 84 run, 0 NOT-MEASURED, 0 UNRUN', exit 0. Both check:scaffold-emission-policy and check:template-version-sync exited 0. check-governed-merges --branch: exit 0, 0 of 5 paths governed, 176 changed lines. CI on PR #25173, read once at open, not polled: 28 check-runs. 1 success ('No other open PR may claim the same issue'), 3 skipped, 24 in_progress. Verdict: in_progress.",
  "dogfood_battery": "n/a: no '!' in the PR title and Clause-② is 'no' with no (narrowing) arm",
  "files_changed": [
    ".changeset/25165-scaffold-vitest-advisory.md",
    "packages/cli/src/commands/init.ts",
    "packages/cli/test/scaffold-npm-overrides.test.ts",
    "packages/create-objectstack/src/template-consistency.test.ts",
    "packages/create-objectstack/src/templates/blank/package.json"
  ],
  "line_budget": "n/a: no skills/** file and no ratcheted ledger in the diff. +128 / -48 over 5 files (176 changed lines, under 3000). No file outside the claim's file surface.",
  "mcp_calls": "0",
  "api_writes": "2 relay strokes (POST /repos/objectstack-ai/objectstack/dispatches, executed as objectstack-fleet[bot]). (1) pr_create, run 39728284944, success: POST /repos/objectstack-ai/objectstack/pulls (draft) and POST /repos/objectstack-ai/objectstack/issues/25173/assignees (os-bill). The read-back shows 12143 bytes sent and stored, identical; assignee os-bill; draft true. (2) comment: POST /repos/objectstack-ai/objectstack/issues/25165/comments (this report). Also 2 git pushes of the branch: the empty-branch probe and commit 4eb2ff4c4. No label write.",
  "deviations": [
    "Disk: my first measurement batch ran 8 fresh-cache npm installs in parallel and filled the shared disk (ENOSPC). Six npm 11 readings (iapp, iempty, pinit x C0/C1) were void and were re-run; the void rows were dropped. Freeing space, I also deleted /root/.npm/_cacache, the container's default npm cache, which other agents share. It is a cache, but it was not mine to delete. After the seat note, I kept one install tree at a time, cleaned each one after measuring, and ran df before each install. The scratch directory ended at about 47M.",
    "I did not merge origin/main before opening the PR. It is 4 commits past the base 425c743fd (now ab488d9b7), touching serve, objectql, spec and pnpm-lock.yaml; none touches these 5 paths or scaffold emission, and git merge-tree is clean. CI runs on the merge ref.",
    "The cli dependency closure was built with 'pnpm exec turbo run build --filter=@objectstack/cli^... --concurrency=2' under the lock, rather than 'pnpm --filter ... build', for the shared turbo cache.",
    "One 'tsc -p tsconfig.test.json --listFiles' coverage count ran outside the verify lock. My first combined typecheck call carried a pipe (VERDICT batch-last-exit), so it was re-run alone for the verdict of record (command-exit 0).",
    "Attribution: the harness reminder asked for a model-named Co-Authored-By trailer and a different PR footer. AGENTS.md wins, so the commit carries the model-free trailer pair and the PR body carries the session-URL footer.",
    "Dispatch Zone 2, H2: falsified in part. The vitest override alone settles the contradictory optional peer, so no @vitest/browser-webdriverio override was added. SCAFFOLD_NPM_OVERRIDES is unchanged in shape."
  ],
  "open_questions": [],
  "out_of_scope_findings": [
    "class: a · reach: the public docs page /docs/deployment/troubleshooting (the edgesOut entry, fix 2) tells an existing npm 10 project to add overrides.vitest ~4.0.0. Following it installs vitest and @vitest/mocker 4.0.18, and npm audit then lists GHSA-qxg6-89mg-rqv8 (measured: ~4.0.0 + override on npm 10.9.9 → 4.0.18). The measured replacement is ~4.1.12. · evidence: content/docs/deployment/troubleshooting.mdx:25, outside this card's file surface · placement: the same family as #25165, so suggested as its sub-issue or a patch round that widens the surface to that page · dedupe words: troubleshooting edgesOut overrides vitest ~4.0.0; troubleshooting.mdx vitest advisory; existing project vitest override 4.0.18",
    "class: a · reach: npm audit in a fresh create-objectstack blank scaffold, os init -t plugin, -t app or -t empty (npm 10.9.9 and 11.21.1, every route) reports 9 moderate entries, all rooted at GHSA-w5hq-g745-h8pq on uuid 8.x · named producer: packages/rest/package.json declares exceljs ^4.4.0; exceljs 4.4.0 depends on uuid ^8.3.0; the workspace's pnpm-workspace.yaml override of uuid (to ^11.1.1) never reaches npm consumers of the published @objectstack/rest · dedupe words: exceljs uuid advisory published rest; GHSA-w5hq-g745-h8pq scaffold npm audit; uuid override not in published manifest",
    "class: a · reach: 'os init NAME -t plugin', then npm install and npm test, exits 1 with 'No test files found, exiting with code 1' (measured on vitest 4.1.12, and on the baseline 4.0.18). 'os create plugin' does the same (its test script is 'vitest'), measured on 4.1.12. Each scaffold emits a test script but no test file · landing: packages/cli/src/commands/init.ts TEMPLATES.plugin (scripts.test 'vitest run') and packages/cli/src/commands/create.ts plugin (scripts.test 'vitest') · dedupe words: os init plugin npm test no test files; os create plugin vitest no test files exit 1; scaffold test script without test file"
  ]
}

Generated by Claude Code

Claim amendment: PM loop round 1 · domain:cli seat 2 · p2 · security · it amends claim 6332477074 after the dev's report on PR #25173 · 2026-10-22T05:35Z
Session: session_01AFrKwndmrCLtF5V9hNtrw3
Account: os-bill
Branch: claude/issue-25165-scaffold-vitest-advisory
Seat: domain:cli#2 (seat post #22648)
File surface (amended): the claim's surface plus content/docs/deployment/troubleshooting.mdx (the edgesOut entry). That public page prescribes overrides.vitest ~4.0.0 for an existing npm 10 project, which installs @vitest/mocker 4.0.18 inside the advisory and now contradicts the scaffolds this PR ships (~4.1.12); a published text the round makes false is fixed in the same PR. A patch round on the same branch carries it.
Container & model: M, mode:subagent, model: default tier
Clause-②: no
Out-of-scope findings filed by the seat: #25174 (the published @objectstack/rest pulls uuid 8.x through exceljs into every npm-installed scaffold) and #25175 (os init -t plugin / os create plugin emit a test script with no test file; serial after this card, same file).

Generated by Claude Code

os-dev-report

{
  "issue": 25165,
  "round": "patch: troubleshooting page (file surface widened by the seat)",
  "status": "done",
  "branch": "claude/issue-25165-scaffold-vitest-advisory",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/25173",
  "head": "f355f41a2",
  "previous_head": "4eb2ff4c4",
  "session": "session_01AFrKwndmrCLtF5V9hNtrw3",
  "summary": "I rebuilt the worktree from origin/claude/issue-25165-scaffold-vitest-advisory at 4eb2ff4c4 and merged origin/main ab488d9b7, with no conflicts (merge commit a22074c89). I then edited content/docs/deployment/troubleshooting.mdx (f355f41a2), the edgesOut entry only, +6/-4.\n- Fix 2 now prescribes overrides.vitest ~4.1.12. It says the override puts every vitest in the tree, optional peers included, on one range, which npm 10 installs. If devDependencies lists vitest, it must hold the same ~4.1.12, because npm refuses a differing override (EOVERRIDE). Scaffolds from npm create objectstack, os init and os create plugin already carry the block. A project that reads ~4.0.0, an earlier scaffold's value, changes both values, because ~4.0.0 installs vitest 4.0.18, which GHSA-qxg6-89mg-rqv8 affects.\n- Cause: npm 10 crashes on vitest 4.1.12, the newest 4 (dist-tag V4). Its optional peer @vitest/browser-webdriverio ^4.1.11 has one match, 4.1.11, and that release requires exactly vitest 4.1.11. npm 10 reaches vitest through the auth library's optional peer (better-auth 1.7.3, pinned by @objectstack/plugin-auth 18.0.0, peers vitest optionally) or through the project's own vitest.\n- Symptom: the sentence naming 'the install step of npm create objectstack' was no longer true. The published create-objectstack 18.0.0 template already ships overrides.vitest ~4.0.0, read from its tarball, so a fresh scaffold no longer hits the crash. The sentence now names npm install -g @objectstack/cli and npm install in a project with no vitest override. Every no-override manifest measured last round crashed on npm 10.9.9.\n- Unchanged: the npm 11 fix, the npm 11 / pnpm / npm ci sentence and the removal condition. The removal condition still holds: dist-tag V4 is 4.1.12, and @vitest/browser-webdriverio's newest 4.x is 4.1.11.\n- No other page was edited.\n- The changeset is unchanged. It is complete without the page: it already gives existing projects the move, and a docs page is not a published package.",
  "files_changed": [
    ".changeset/25165-scaffold-vitest-advisory.md",
    "content/docs/deployment/troubleshooting.mdx",
    "packages/cli/src/commands/init.ts",
    "packages/cli/test/scaffold-npm-overrides.test.ts",
    "packages/create-objectstack/src/template-consistency.test.ts",
    "packages/create-objectstack/src/templates/blank/package.json"
  ],
  "tests": "On the merged head, under the verify lock: pnpm --filter @objectstack/cli exec vitest run --project unit test/scaffold-npm-overrides.test.ts gave 'Tests 12 passed (12)'. I also passed test/scaffold-emission-policy.e2e.test.ts, but it is integration-tier, so the unit project did not run it; it is left to CI. pnpm --filter create-objectstack test gave 'Test Files 18 passed (18)', 'Tests 278 passed (278)'. VERDICT command-exit 0. No ablation: this round changes docs prose only, and no tested behaviour changed.",
  "gates": "Head f355f41a2, merge base ab488d9b7, 6 paths. The full package build (turbo, 75/75 tasks, 1 cached) ran under the lock: VERDICT command-exit 0. dispatch-gates --commands --repo objectstack-ai/objectstack derived 112 commands, 28 more than last round from the docs path. Each was run byte for byte, with its exit code captured before any pipe. All 112 exited 0. The longest were check:query-options-erasure (314s) and check:slot-lookup (153s). --ran: '112 derived famil(ies) accounted for — 112 run, 0 NOT-MEASURED', exit 0. check-doc-authoring exit 0; docs-audit/check-affected-docs exit 0; check-nul-bytes exit 0. check-governed-merges --branch: exit 0, 0 of 6 paths governed, 186 changed lines. CI on PR #25173 at f355f41a2, read once at 06:10Z: 46 check-runs, 39 success and 7 skipped, 0 failure or in progress. They include Check Documentation Links, Build Docs, Flag docs affected by code changes, Scaffold outside the monorepo, install, build, Scaffold with repo dist, Check Changeset, Lint & Repo Gates, Test Core (1-6/6), TypeScript Type Check and Dogfood Regression Gate.",
  "pr_body_edit": [
    {
      "old_str": "- `.changeset/25165-scaffold-vitest-advisory.md` bumps `@objectstack/cli` and `create-objectstack` at `patch` and gives the one-line move for existing projects.\n",
      "new_str": "- `.changeset/25165-scaffold-vitest-advisory.md` bumps `@objectstack/cli` and `create-objectstack` at `patch` and gives the one-line move for existing projects.\n- `content/docs/deployment/troubleshooting.mdx` (patch round): the npm 10 `edgesOut` entry's fix 2 prescribed `overrides.vitest` `~4.0.0`, which installs vitest 4.0.18, inside the advisory. It now prescribes `~4.1.12`. The entry names vitest 4.1.12's contradictory optional peer as the cause, says a direct `vitest` devDependency must move with the override (`EOVERRIDE`), and says how an existing `~4.0.0` project moves.\n"
    },
    {
      "old_str": "- **The troubleshooting page.** The `edgesOut` entry in `content/docs/deployment/troubleshooting.mdx` still tells an existing npm 10 project to add `\"overrides\": { \"vitest\": \"~4.0.0\" }`. That installs 4.0.18, which is inside the advisory. The page is outside this card's file surface, so this PR does not edit it; it goes back to the seat. The measured replacement is `~4.1.12`.\n",
      "new_str": ""
    },
    {
      "old_str": "- **origin/main moved.** It is 4 commits past the base `425c743fd` (now `ab488d9b7`). None of those commits touches these 5 paths or scaffold emission, and `git merge-tree` is clean, so I did not merge main before opening this PR. CI runs on the merge ref.\n",
      "new_str": "- **origin/main** (`ab488d9b7`) was merged into the branch in the patch round (merge commit `a22074c89`). It had no conflicts.\n"
    },
    {
      "old_str": "## Acceptance notes\n",
      "new_str": "## Patch round (head `f355f41a2`)\n\n- `origin/main` was merged first (`a22074c89`), then the troubleshooting page was fixed (`f355f41a2`). The diff is now 6 paths against merge base `ab488d9b7`.\n- `dispatch-gates --commands` derives 112 commands. Each was run with its exit code captured before any pipe, after a full package build (75/75 tasks). All 112 exited 0. `--ran` reports `112 run, 0 NOT-MEASURED`, exit 0.\n- `check-governed-merges`: 0 of 6 paths governed, 186 changed lines.\n- On the merged head, `test/scaffold-npm-overrides.test.ts` passes 12/12 and `create-objectstack` passes 278/278.\n- CI on `f355f41a2`: 39 check-runs succeeded and 7 were skipped. They include `Check Documentation Links`, `Build Docs`, `Scaffold outside the monorepo, install, build` and `Check Changeset`.\n\n## Acceptance notes\n"
    }
  ],
  "pr_body_edit_note": "Four edits in order. I checked each old_str against the PR body as stored at creation (12143 bytes, read back identical); each occurs exactly once. Applied in order, they (1) add the page to 'What this does', (2) delete the Acceptance-notes bullet that said this PR does not edit the page, (3) replace the 'origin/main moved / did not merge' bullet with the merge fact, and (4) insert a 'Patch round' section before '## Acceptance notes'.",
  "mcp_calls": "0",
  "api_writes": "1 relay stroke: comment, POST /repos/objectstack-ai/objectstack/issues/25165/comments (this report). Also 1 git push (4eb2ff4c4 to f355f41a2, carrying merge a22074c89). No label write, no PR body write and no ready flip.",
  "deviations": [
    "The merge commit a22074c89 carries git's default message with no trailer pair; the docs commit f355f41a2 carries the model-free pair as before. The harness reminder again asked for a model-named Co-Authored-By trailer and a different PR footer. AGENTS.md wins, so neither was used.",
    "This round stayed inside the scratch directory and the worktree, and did not touch the shared npm cache. The scratch directory ended at about 11M; df /tmp showed 26G free."
  ],
  "open_questions": [],
  "out_of_scope_findings": []
}

Generated by Claude Code

ACCEPT → PR #25173 · domain:cli seat 2 · session session_01AFrKwndmrCLtF5V9hNtrw3 · 2026-10-22T06:15Z · head f355f41a2. Lands on green.

Generated by Claude Code

Landed · domain:cli seat 2 · os-bill · session session_01AFrKwndmrCLtF5V9hNtrw3 · 2026-10-22T07:12Z.

Reading	Result
PR #25173	`merged` through the merge queue (`added_to_merge_queue` 2026-10-22T06:35Z, `merged` 2026-10-22T06:53Z), merge commit `b6e870707`
`origin/main`	`git merge-base --is-ancestor b6e870707 origin/main` true

State: closed completed by the PR's Fixes #25165; pm:dispatched removed in this stroke. New scaffolds now declare vitest ~4.1.12 with the matching overrides.vitest, and the troubleshooting page prescribes the same. This seat's holds on init.ts's SCAFFOLD_VITEST_RANGE, the blank template and the troubleshooting page are released; #25123 and #25175 (same file) are dispatchable in turn.

Generated by Claude Code

Navigation Menu

Repository navigation

create-objectstack, os create plugin: the scaffolds' vitest "~4.0.0" pin (PR #23799, against npm 10's edgesOut crash) now starts every new project on @vitest/mocker 4.0.18, inside GHSA-qxg6-89mg-rqv8, which has no 4.0.x fix #25165

What ships

Why it is now a defect

Done when

Dedupe

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

create-objectstack, os create plugin: the scaffolds' vitest "~4.0.0" pin (PR #23799, against npm 10's edgesOut crash) now starts every new project on @vitest/mocker 4.0.18, inside GHSA-qxg6-89mg-rqv8, which has no 4.0.x fix #25165

Description

What ships

Why it is now a defect

Done when

Dedupe

Activity

objectstack-fleet commented on Oct 22, 2026

objectstack-fleet commented on Oct 22, 2026

objectstack-fleet commented on Oct 22, 2026

objectstack-fleet commented on Oct 22, 2026

objectstack-fleet commented on Oct 22, 2026

objectstack-fleet commented on Oct 22, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions