Merge pull request #2700 from srod/develop

feat: migrate to Vitest 4 Test Projects and add CodeRabbit auto-reviews

Author: srod

.coderabbit.yaml

@@ -0,0 +1,8 @@
+language: "en-US"
+reviews:
+  profile: "chill"
+  auto_review:
+    enabled: true
+    auto_incremental_review: true
+    base_branches:
+      - develop

.github/workflows/test.yml

@@ -38,6 +38,6 @@ jobs:
         uses: codecov/codecov-action@v5
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
-          directory: ./packages
+          files: ./coverage/coverage-final.json
           fail_ci_if_error: false
           verbose: true

CLAUDE.md

@@ -15,8 +15,8 @@ This branch (`main`) uses **Bun** as the package manager and runtime.
 - **Build**: `bun run build`
 - **Lint**: `bun run lint` | **Format**: `bun run format`
 - **Test all**: `bun run test`
-- **Test single package**: `bun test packages/<name>` (e.g., `bun test packages/core`)
-- **Test single file**: `bun test packages/core/__tests__/core.test.ts`
+- **Test single package**: `bun run test packages/<name>` (e.g., `bun run test packages/core`)
+- **Test single file**: `bun run test packages/core/__tests__/core.test.ts`
 - **Typecheck**: `bun run typecheck`
 - **CI (full)**: `bun run ci`
 

SECURITY.md

@@ -0,0 +1,44 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 9.x     | :white_check_mark: |
+| < 9.0   | :x:                |
+
+## Reporting a Vulnerability
+
+We take the security of node-minify seriously. If you believe you have found a security vulnerability, please report it to us through responsible disclosure.
+
+### How to Report
+
+Do **not** open a public GitHub issue for security vulnerabilities. Instead, please email: **rodolphe@2clics.net**
+
+### What to Include
+
+When reporting a vulnerability, please include:
+- A clear description of the issue
+- Steps to reproduce the issue
+- Any relevant code samples or payloads
+- Your assessment of the impact
+
+### Response Timeline
+
+- We will acknowledge receipt of your report within **72 hours**
+- You can expect an initial assessment within **7 days**
+- We will provide updates on the status of your report at least every **7 days**
+- Once the vulnerability is confirmed, we will release a security patch as quickly as possible
+
+### Scope
+
+This policy applies to the node-minify monorepo and its packages:
+- @node-minify/core
+- All compressor packages (@node-minify/*)
+- The CLI tool
+
+Note: This does not include vulnerabilities in third-party compressors (esbuild, terser, lightningcss, etc.) - those should be reported to their respective maintainers.
+
+### Recognition
+
+We appreciate responsible disclosure and will credit researchers in any security advisory, unless they prefer to remain anonymous.

bun.lock

@@ -23,16 +23,15 @@
     "build:deps": "bun run --filter '@node-minify/utils' build && bun run --filter '@node-minify/run' build",
     "build:docs": "bun run --filter '@node-minify/docs' build",
     "check-exports": "bun run --filter '*' check-exports",
-    "ci": "bun run build && bun run check-exports && bun run lint && bun run typecheck && bun run test:ci",
+    "ci": "bun run build && bun run check-exports && bun run lint && bun run typecheck && bun run test:coverage",
     "clean": "bun run clean:build",
     "clean:build": "bunx rimraf packages/*/dist docs/dist docs/.astro",
     "clean:test": "bunx rimraf tests/tmp/*.{js,js.map,css,html,json}",
     "dev": "bun run --filter '*' dev",
     "lint": "bun run --filter '*' lint",
     "local-release": "bun run changeset:version && bun run changeset:release",
-    "test": "bun run --filter '*' test",
-    "test:watch": "bun run --filter '*' test:watch",
-    "test:ci": "bun run --filter '*' test:ci",
+    "test": "vitest run",
+    "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
     "changeset": "changeset",
     "changeset:version": "changeset version && bun install --no-frozen-lockfile",

package.json

@@ -41,5 +41,19 @@ describe("Package: babel-minify", async () => {
             ).rejects.toThrow("Babel minification failed: empty result");
             spy.mockRestore();
         });
+
+        test("should pass through non-string presets unchanged", async () => {
+            const minifyPreset = (await import("babel-preset-minify")).default;
+            const result = await babelMinify({
+                content: "var x = 1;",
+                settings: {
+                    options: {
+                        // Pass the preset module directly instead of a string
+                        presets: [minifyPreset],
+                    },
+                },
+            } as any);
+            expect(result.code).toBeDefined();
+        });
     });
 });

packages/babel-minify/__tests__/babel-minify.test.ts

@@ -47,19 +47,19 @@
     "lint": "biome lint .",
     "prepublishOnly": "bun run build",
     "test": "vitest run",
-    "test:ci": "vitest run --coverage",
+    "test:coverage": "vitest run --coverage",
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit",
     "dev": "tsdown src/index.ts --watch"
   },
   "dependencies": {
     "@node-minify/utils": "workspace:*",
     "babel-core": "6.26.3",
+    "babel-preset-env": "1.7.0",
     "babel-preset-minify": "0.5.2"
   },
   "devDependencies": {
     "@node-minify/types": "workspace:*",
-    "@types/babel-core": "^6.25.10",
-    "babel-preset-env": "1.7.0"
+    "@types/babel-core": "^6.25.10"
   }
-}
+}

packages/babel-minify/package.json

@@ -7,10 +7,22 @@
 import type { CompressorResult, MinifierOptions } from "@node-minify/types";
 import { readFile, warnDeprecation } from "@node-minify/utils";
 import { transform } from "babel-core";
+import env from "babel-preset-env";
 import minify from "babel-preset-minify";
 
+type BabelPreset = typeof minify | typeof env;
+
 type BabelOptions = {
-    presets: (string | typeof minify)[];
+    presets: (string | BabelPreset)[];
+};
+
+/**
+ * Known presets that we can resolve directly to avoid Babel 6's runtime module resolution,
+ * which can fail in monorepos or when the working directory differs from the package location.
+ */
+const knownPresets: Record<string, BabelPreset> = {
+    env,
+    minify,
 };
 
 /**
@@ -43,7 +55,16 @@ export async function babelMinify({
         babelOptions.presets = presets.concat(babelrcPresets);
     }
 
-    if (!babelOptions.presets.includes("minify")) {
+    // Resolve known preset strings to their imported modules to avoid
+    // Babel 6's runtime resolution which fails in monorepos/different cwd
+    babelOptions.presets = babelOptions.presets.map((preset) =>
+        typeof preset === "string" && preset in knownPresets
+            ? knownPresets[preset]
+            : preset
+    );
+
+    // Ensure minify preset is always included
+    if (!babelOptions.presets.includes(minify)) {
         babelOptions.presets = babelOptions.presets.concat([minify]);
     }
 

packages/babel-minify/src/index.ts

@@ -1 +1,2 @@
+declare module "babel-preset-env";
 declare module "babel-preset-minify";