chore: disable vitest interopDefault, remove dotenvx (#587)

* fix: handle @babel/traverse CJS-ESM interop in .mts files

@babel/traverse is a CJS package that exports { default: fn }.
In Node ESM (.mts), `import traverse from '@babel/traverse'`
resolves to the module object, not the function, causing
"traverse is not a function" at runtime.

Use `_traverse.default ?? _traverse` to unwrap correctly.

* chore: remove dotenvx, simplify pre-commit hook

Replace dotenvx with plain pnpm test in pre-commit hook.
Remove @dotenvx/dotenvx devDependency (unused outside hook).

* fix: remove unnecessary CJS interop hack for @babel/traverse

* fix: use ssr.external for @babel/traverse instead of CJS interop hack

Let Node handle @babel/traverse as native CJS instead of having vite
transpile it. This makes the plain default import work correctly.

* fix: resolve @babel/traverse CJS interop for both native and vite contexts

The ssr.external approach only works for single-file runs, not the full
suite with isolate: false. Use runtime typeof check to handle both
native CJS resolution and vite's SSR transform.

* fix: use .default fallback for @babel/traverse CJS import

Vite's SSR transform wraps CJS module.exports as .default, so the
traverse function ends up at traverseModule.default. Use a simple
fallback pattern that works in both vite and native Node contexts.

* chore(ci): simplify CI to use socket-registry reusable workflow (eb53b17d)

* fix: use named default import for @babel/traverse, drop interopDefault

import { default as traverse } works correctly with vite's SSR transform
and has proper types. Remove deps.interopDefault: false from both vitest
configs — the default (true) handles CJS interop correctly.

* fix: use socket-registry's own pinned SHA for action references

Use f9f6e265 (the SHA socket-registry uses internally) instead of
eb53b17d which zizmor can't verify via impostor-commit check.

Author: jdalton

.github/workflows/ci.yml

@@ -14,16 +14,13 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   ci:
     name: Run CI Pipeline
-    uses: SocketDev/socket-registry/.github/workflows/ci.yml@b86b2cb3fefa4ffa6c1a702476f9785f6c3bb887 # main
+    uses: SocketDev/socket-registry/.github/workflows/ci.yml@bbe46386c0a2bc6baefd02916234956a38e622d5 # main
     with:
-      fail-fast: false
-      lint-script: 'pnpm run lint --all'
-      node-versions: '["24.10.0"]'
-      os-versions: '["ubuntu-latest", "macos-latest", "windows-latest"]'
       test-script: 'pnpm run test --all --skip-build'
-      test-setup-script: 'pnpm run build'
-      type-check-script: 'pnpm run type'
-      type-check-setup-script: 'pnpm run build'

.github/workflows/generate.yml

@@ -45,14 +45,14 @@ jobs:
           echo "Sleeping for $delay seconds..."
           sleep $delay
 
-      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@b86b2cb3fefa4ffa6c1a702476f9785f6c3bb887 # main
+      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@bbe46386c0a2bc6baefd02916234956a38e622d5 # main
 
       - name: Configure push credentials
         env:
           GH_TOKEN: ${{ github.token }}
         run: git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git"
 
-      - uses: SocketDev/socket-registry/.github/actions/setup-git-signing@b86b2cb3fefa4ffa6c1a702476f9785f6c3bb887 # main
+      - uses: SocketDev/socket-registry/.github/actions/setup-git-signing@bbe46386c0a2bc6baefd02916234956a38e622d5 # main
         with:
           gpg-private-key: ${{ secrets.BOT_GPG_PRIVATE_KEY }}
 
@@ -122,5 +122,5 @@ jobs:
             gh pr reopen "$pr_number"
           fi
 
-      - uses: SocketDev/socket-registry/.github/actions/cleanup-git-signing@b86b2cb3fefa4ffa6c1a702476f9785f6c3bb887 # main
+      - uses: SocketDev/socket-registry/.github/actions/cleanup-git-signing@bbe46386c0a2bc6baefd02916234956a38e622d5 # main
         if: always()

.github/workflows/provenance.yml

@@ -30,7 +30,7 @@ jobs:
     permissions:
       contents: write # To create GitHub releases
       id-token: write # For npm trusted publishing via OIDC
-    uses: SocketDev/socket-registry/.github/workflows/provenance.yml@b86b2cb3fefa4ffa6c1a702476f9785f6c3bb887 # main
+    uses: SocketDev/socket-registry/.github/workflows/provenance.yml@bbe46386c0a2bc6baefd02916234956a38e622d5 # main
     with:
       debug: ${{ inputs.debug }}
       dist-tag: ${{ inputs.dist-tag }}

.github/workflows/weekly-update.yml

@@ -24,7 +24,7 @@ jobs:
     outputs:
       has-updates: ${{ steps.check.outputs.has-updates }}
     steps:
-      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@b86b2cb3fefa4ffa6c1a702476f9785f6c3bb887 # main
+      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@bbe46386c0a2bc6baefd02916234956a38e622d5 # main
 
       - name: Check for npm updates
         id: check
@@ -48,7 +48,7 @@ jobs:
       contents: write
       pull-requests: write
     steps:
-      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@b86b2cb3fefa4ffa6c1a702476f9785f6c3bb887 # main
+      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@bbe46386c0a2bc6baefd02916234956a38e622d5 # main
 
       - name: Create update branch
         id: branch
@@ -60,7 +60,7 @@ jobs:
           git checkout -b "$BRANCH_NAME"
           echo "branch=$BRANCH_NAME" >> $GITHUB_OUTPUT
 
-      - uses: SocketDev/socket-registry/.github/actions/setup-git-signing@b86b2cb3fefa4ffa6c1a702476f9785f6c3bb887 # main
+      - uses: SocketDev/socket-registry/.github/actions/setup-git-signing@bbe46386c0a2bc6baefd02916234956a38e622d5 # main
         with:
           gpg-private-key: ${{ secrets.BOT_GPG_PRIVATE_KEY }}
 
@@ -306,7 +306,7 @@ jobs:
             test-output.log
           retention-days: 7
 
-      - uses: SocketDev/socket-registry/.github/actions/cleanup-git-signing@b86b2cb3fefa4ffa6c1a702476f9785f6c3bb887 # main
+      - uses: SocketDev/socket-registry/.github/actions/cleanup-git-signing@bbe46386c0a2bc6baefd02916234956a38e622d5 # main
         if: always()
 
   notify:

.husky/pre-commit

@@ -8,12 +8,7 @@ else
 fi
 
 if [ -z "${DISABLE_PRECOMMIT_TEST}" ]; then
-  # Use .env.precommit if it exists, otherwise proceed without it
-  if [ -f ".env.precommit" ]; then
-    pnpm exec dotenvx -q run -f .env.precommit -- pnpm test --staged
-  else
-    pnpm test --staged
-  fi
+  pnpm test --staged
 else
   echo "Skipping testing due to DISABLE_PRECOMMIT_TEST env var"
 fi

package.json

@@ -70,7 +70,6 @@
     "@babel/parser": "7.26.3",
     "@babel/traverse": "7.26.4",
     "@babel/types": "7.26.3",
-    "@dotenvx/dotenvx": "1.54.1",
     "@oxlint/migrate": "1.52.0",
     "@socketsecurity/lib": "5.18.2",
     "@sveltejs/acorn-typescript": "1.0.8",