Fix repo vulnerabilities

code/package.json

@@ -79,7 +79,7 @@
     "prettier": "2.8.8",
     "shx": "^0.4.0",
     "typescript": "5.7.3",
-    "vitest": "^3.2.6"
+    "vitest": "^4.1.11"
   },
   "engines": {
     "node": ">= 22.17.1",
@@ -94,6 +94,7 @@
     "konva": "10.0.2",
     "lodash": "4.18.1",
     "rimraf": "6.0.1",
+    "smol-toml": "1.9.0",
     "yjs": "13.6.27"
   },
   "repository": "github:InditexTech/weavejs"

code/packages/create-frontend-app/template/package.json

@@ -68,7 +68,7 @@
     "@types/react-dom": "^18",
     "@types/react-responsive-masonry": "^2.6.0",
     "@vitejs/plugin-react": "^4.3.4",
-    "@vitest/coverage-v8": "^3.2.6",
+    "@vitest/coverage-v8": "^4.1.11",
     "eslint": "^8",
     "eslint-config-next": "16.3.4",
     "eslint-config-prettier": "^10.0.2",
@@ -78,6 +78,6 @@
     "tailwindcss": "^4",
     "typescript": "^5",
     "vite-tsconfig-paths": "^5.1.4",
-    "vitest": "^3.2.6"
+    "vitest": "^4.1.11"
   }
 }

code/packages/react/package.json

@@ -56,8 +56,8 @@
     "@typescript-eslint/eslint-plugin": "8.26.0",
     "@typescript-eslint/parser": "8.26.0",
     "@vitejs/plugin-react": "4.3.4",
-    "@vitest/coverage-v8": "^3.2.6",
-    "@vitest/ui": "^3.2.6",
+    "@vitest/coverage-v8": "^4.1.11",
+    "@vitest/ui": "^4.1.11",
     "eslint": "8.57.1",
     "eslint-plugin-react": "7.34.1",
     "eslint-plugin-react-hooks": "^4.6.2",
@@ -66,7 +66,7 @@
     "rollup-plugin-visualizer": "^7.0.1",
     "tsdown": "0.22.14",
     "typescript-eslint": "8.22.0",
-    "vitest": "^3.2.6",
+    "vitest": "^4.1.11",
     "vitest-canvas-mock": "^1.1.4",
     "vitest-sonar-reporter": "^3.0.0",
     "zustand": "5.0.3"

code/packages/react/src/components/__tests__/provider.test.tsx

@@ -42,7 +42,9 @@ beforeEach(() => {
     start: vi.fn(),
     destroy: vi.fn(),
   };
-  MockWeave.mockImplementation(() => mockInstance);
+  MockWeave.mockImplementation(function () {
+    return mockInstance;
+  });
 
   mockContainer = document.createElement('div');
   vi.spyOn(mockContainer, 'getBoundingClientRect').mockReturnValue({

code/packages/renderer-konva-base/package.json

@@ -65,16 +65,16 @@
     "@types/node": "^22.15.3",
     "@typescript-eslint/eslint-plugin": "8.26.0",
     "@typescript-eslint/parser": "8.26.0",
-    "@vitest/coverage-v8": "^3.2.6",
-    "@vitest/ui": "^3.2.6",
+    "@vitest/coverage-v8": "^4.1.11",
+    "@vitest/ui": "^4.1.11",
     "eslint": "8.57.1",
     "eslint-config-eslint": "11.0.0",
     "lodash": "4.18.1",
     "rollup-plugin-visualizer": "^7.0.1",
     "tsdown": "0.22.14",
     "typescript-eslint": "8.22.0",
     "uuid": "11.1.1",
-    "vitest": "^3.2.6",
+    "vitest": "^4.1.11",
     "vitest-canvas-mock": "^1.1.4",
     "vitest-sonar-reporter": "^3.0.0"
   },

code/packages/renderer-konva-react-reconciler/package.json

@@ -67,16 +67,16 @@
     "@types/react-reconciler": "0.28.9",
     "@typescript-eslint/eslint-plugin": "8.26.0",
     "@typescript-eslint/parser": "8.26.0",
-    "@vitest/coverage-v8": "^3.2.6",
-    "@vitest/ui": "^3.2.6",
+    "@vitest/coverage-v8": "^4.1.11",
+    "@vitest/ui": "^4.1.11",
     "eslint": "8.57.1",
     "eslint-config-eslint": "11.0.0",
     "lodash": "4.18.1",
     "rollup-plugin-visualizer": "^7.0.1",
     "tsdown": "0.22.14",
     "typescript-eslint": "8.22.0",
     "uuid": "11.1.1",
-    "vitest": "^3.2.6",
+    "vitest": "^4.1.11",
     "vitest-canvas-mock": "^1.1.4",
     "vitest-sonar-reporter": "^3.0.0"
   },

code/packages/sdk/package.json

@@ -69,8 +69,8 @@
     "@types/node": "^22.15.3",
     "@typescript-eslint/eslint-plugin": "8.26.0",
     "@typescript-eslint/parser": "8.26.0",
-    "@vitest/coverage-v8": "^3.2.6",
-    "@vitest/ui": "^3.2.6",
+    "@vitest/coverage-v8": "^4.1.11",
+    "@vitest/ui": "^4.1.11",
     "emittery": "1.1.0",
     "eslint": "8.57.1",
     "eslint-config-eslint": "11.0.0",
@@ -82,7 +82,7 @@
     "tsdown": "0.22.14",
     "typescript-eslint": "8.22.0",
     "uuid": "11.1.1",
-    "vitest": "^3.2.6",
+    "vitest": "^4.1.11",
     "vitest-canvas-mock": "^1.1.4",
     "vitest-sonar-reporter": "^3.0.0",
     "yjs-types": "0.0.1"

code/packages/sdk/src/actions/arrow-tool/__tests__/arrow-tool.test.ts

@@ -40,9 +40,15 @@
 
   return {
     default: {
-      Line: vi.fn((attrs: Record<string, unknown>) => makeShape(attrs)),
-      Arrow: vi.fn((attrs: Record<string, unknown>) => makeShape(attrs)),
-      Circle: vi.fn((attrs: Record<string, unknown>) => makeShape(attrs)),
+      Line: vi.fn(function (attrs: Record<string, unknown>) {
+        return makeShape(attrs);
+      }),
+      Arrow: vi.fn(function (attrs: Record<string, unknown>) {
+        return makeShape(attrs);
+      }),
+      Circle: vi.fn(function (attrs: Record<string, unknown>) {
+        return makeShape(attrs);
+      }),
     },
   };
 });
@@ -258,7 +264,7 @@
       action.trigger(vi.fn());
       const callsAfterFirst = setupSpy.mock.calls.length;
       action.trigger(vi.fn());
       expect(setupSpy.mock.calls.length).toBe(callsAfterFirst);
     });
 
     it('4.4 sets container tabIndex = 1 and calls focus()', () => {
@@ -557,7 +563,7 @@
       handlers['pointerdown']?.(makePointerEvent({ pointerId: 0 }));
       // tempMainArrowNode is unchanged and no extra add() calls were made
       expect((action as unknown as R)['tempMainArrowNode']).toBe(firstNode);
       expect(mockWeave._measureContainer.add.mock.calls.length).toBe(addCallsAfterFirst);
     });
 
     it('9.8 sets arrowId and tempArrowId to non-null UUID strings', () => {

code/packages/sdk/src/actions/guide-tool/__tests__/guide-tool.test.ts

@@ -17,12 +17,14 @@ vi.mock('@/plugins/nodes-snapping/nodes-snapping', () => ({
 
 // Hoist Konva.Line mock so vi.mock factory can reference it
 const { MockLine } = vi.hoisted(() => {
-  const MockLine = vi.fn().mockImplementation((attrs: unknown) => ({
-    _attrs: attrs,
-    points: vi.fn(),
-    destroy: vi.fn(),
-    getClientRect: vi.fn().mockReturnValue({ x: 50, y: 0, width: 0, height: 600 }),
-  }));
+  const MockLine = vi.fn().mockImplementation(function (attrs: unknown) {
+    return {
+      _attrs: attrs,
+      points: vi.fn(),
+      destroy: vi.fn(),
+      getClientRect: vi.fn().mockReturnValue({ x: 50, y: 0, width: 0, height: 600 }),
+    };
+  });
   return { MockLine };
 });
 
@@ -31,12 +33,14 @@ vi.mock('konva', () => ({ default: { Line: MockLine } }));
 vi.mock('nanoid', () => ({ nanoid: vi.fn().mockReturnValue('test-guide-id') }));
 
 vi.mock('@/plugins/nodes-snapping/nodes-snapping.guide-distance-to-target-info', () => ({
-  WeaveNodesSnappingGuideDistanceToTargetInfo: vi.fn().mockImplementation(() => ({
-    handleTarget: vi.fn(),
-    cleanup: vi.fn(),
-    cleanupTarget: vi.fn(),
-    handleDistanceLine: vi.fn(),
-  })),
+  WeaveNodesSnappingGuideDistanceToTargetInfo: vi.fn().mockImplementation(function () {
+    return {
+      handleTarget: vi.fn(),
+      cleanup: vi.fn(),
+      cleanupTarget: vi.fn(),
+      handleDistanceLine: vi.fn(),
+    };
+  }),
 }));
 
 // In node environment, window is not defined — alias to globalThis

code/packages/sdk/src/actions/image-tool/__tests__/image-tool.test.ts

@@ -8,10 +8,12 @@
 
 // ── Hoisted Konva.Image mock ───────────────────────────────────────────────────
 const { MockImage } = vi.hoisted(() => {
-  const MockImage = vi.fn().mockImplementation(() => ({
-    setAttrs: vi.fn(),
-    destroy: vi.fn(),
-  }));
+  const MockImage = vi.fn().mockImplementation(function () {
+    return {
+      setAttrs: vi.fn(),
+      destroy: vi.fn(),
+    };
+  });
   return { MockImage };
 });
 
@@ -228,10 +230,10 @@
       expect((action as unknown as R)['pointers']).toBeInstanceOf(Map);
       expect(((action as unknown as R)['pointers'] as Map<number, unknown>).size).toBe(0);
       expect((action as unknown as R)['initialized']).toBe(false);
       expect((action as unknown as R)['imageId']).toBe(null);
       expect((action as unknown as R)['state']).toBe(WEAVE_IMAGE_TOOL_STATE.IDLE);
       expect((action as unknown as R)['tempImageId']).toBe(null);
       expect((action as unknown as R)['tempImageNode']).toBe(null);
     });
 
     it('1.4 onPropsChange is undefined', () => {
@@ -337,7 +339,7 @@
       triggerImageURL();
       const callCount = (mockWeave._stage.on as ReturnType<typeof vi.fn>).mock.calls.length;
       triggerImageURL();
       expect((mockWeave._stage.on as ReturnType<typeof vi.fn>).mock.calls.length).toBe(callCount);
     });
 
     it('4.4 loadImage calls setFocusStage (tabIndex, blur, focus)', () => {
@@ -1294,7 +1296,12 @@
         result: 'data:image/png;base64,abc',
         readAsDataURL: vi.fn(),
       };
-      vi.stubGlobal('FileReader', vi.fn().mockImplementation(() => mockReader));
+      vi.stubGlobal(
+        'FileReader',
+        vi.fn().mockImplementation(function () {
+          return mockReader;
+        })
+      );
       const promise = action.getDataURL(new Blob(['test']));
       mockReader.onloadend();
       const result = await promise;
@@ -1308,7 +1315,12 @@
         result: null,
         readAsDataURL: vi.fn(),
       };
-      vi.stubGlobal('FileReader', vi.fn().mockImplementation(() => mockReader));
+      vi.stubGlobal(
+        'FileReader',
+        vi.fn().mockImplementation(function () {
+          return mockReader;
+        })
+      );
       const promise = action.getDataURL(new Blob(['test']));
       mockReader.onerror();
       await expect(promise).rejects.toThrow('Failed to generate dataURL from file');

code/packages/sdk/src/actions/images-tool/__tests__/images-tool.test.ts

@@ -8,25 +8,33 @@
 
 // ── Hoisted Konva shape mocks ──────────────────────────────────────────────────
 const { MockGroup, MockImage, MockText, MockRect } = vi.hoisted(() => {
-  const MockGroup = vi.fn().mockImplementation(() => ({
-    setAttrs: vi.fn(),
-    destroy: vi.fn(),
-    add: vi.fn(),
-  }));
-  const MockImage = vi.fn().mockImplementation(() => ({
-    moveToBottom: vi.fn(),
-  }));
-  const MockText = vi.fn().mockImplementation(() => ({
-    measureSize: vi.fn().mockReturnValue({ height: 20 }),
-    y: vi.fn().mockReturnValue(5),
-    x: vi.fn().mockReturnValue(10),
-    width: vi.fn().mockReturnValue(100),
-    height: vi.fn().mockReturnValue(20),
-    moveToTop: vi.fn(),
-  }));
-  const MockRect = vi.fn().mockImplementation(() => ({
-    moveToBottom: vi.fn(),
-  }));
+  const MockGroup = vi.fn().mockImplementation(function () {
+    return {
+      setAttrs: vi.fn(),
+      destroy: vi.fn(),
+      add: vi.fn(),
+    };
+  });
+  const MockImage = vi.fn().mockImplementation(function () {
+    return {
+      moveToBottom: vi.fn(),
+    };
+  });
+  const MockText = vi.fn().mockImplementation(function () {
+    return {
+      measureSize: vi.fn().mockReturnValue({ height: 20 }),
+      y: vi.fn().mockReturnValue(5),
+      x: vi.fn().mockReturnValue(10),
+      width: vi.fn().mockReturnValue(100),
+      height: vi.fn().mockReturnValue(20),
+      moveToTop: vi.fn(),
+    };
+  });
+  const MockRect = vi.fn().mockImplementation(function () {
+    return {
+      moveToBottom: vi.fn(),
+    };
+  });
   return { MockGroup, MockImage, MockText, MockRect };
 });
 
@@ -339,7 +347,7 @@
       triggerImageURL();
       const callCount = (mockWeave._stage.on as ReturnType<typeof vi.fn>).mock.calls.length;
       triggerImageURL();
       expect((mockWeave._stage.on as ReturnType<typeof vi.fn>).mock.calls.length).toBe(callCount);
     });
 
     it('4.4 selectionPlugin present → setSelectedNodes([])', () => {

code/packages/sdk/src/actions/line-tool/__tests__/line-tool.test.ts

@@ -24,7 +24,9 @@
     });
     return inst;
   };
-  const MockLine = vi.fn().mockImplementation(() => makeLineInstance());
+  const MockLine = vi.fn().mockImplementation(function () {
+    return makeLineInstance();
+  });
   return { MockLine };
 });
 
@@ -34,9 +36,11 @@
 }));
 vi.mock('konva', () => ({ default: { Line: MockLine } }));
 vi.mock('@/internal-utils/greedy-snapper', () => ({
-  GreedySnapper: vi.fn().mockImplementation(() => ({
-    apply: vi.fn().mockImplementation((angle: number) => angle),
-  })),
+  GreedySnapper: vi.fn().mockImplementation(function () {
+    return {
+      apply: vi.fn().mockImplementation((angle: number) => angle),
+    };
+  }),
 }));
 vi.mock('uuid', () => ({ v4: vi.fn().mockReturnValue('test-uuid') }));
 
@@ -457,7 +461,7 @@
       // Second call with tempLineNode already set
       (action as unknown as R)['state'] = LINE_TOOL_STATE.ADDING;
       mockWeave._stageHandlers['pointerdown'](makePointerEvent());
       expect(MockLine.mock.calls.length).toBe(countBefore);
     });
 
     it('9.5 measureContainer undefined → no-op on add', () => {

code/packages/sdk/src/actions/measure-tool/__tests__/measure-tool.test.ts

@@ -31,9 +31,15 @@
     destroy: vi.fn(),
   });
 
-  const MockGroup = vi.fn().mockImplementation(() => makeGroupInstance());
-  const MockLine = vi.fn().mockImplementation(() => makeLineInstance());
-  const MockCircle = vi.fn().mockImplementation(() => makeCircleInstance());
+  const MockGroup = vi.fn().mockImplementation(function () {
+    return makeGroupInstance();
+  });
+  const MockLine = vi.fn().mockImplementation(function () {
+    return makeLineInstance();
+  });
+  const MockCircle = vi.fn().mockImplementation(function () {
+    return makeCircleInstance();
+  });
 
   return { MockGroup, MockLine, MockCircle };
 });
@@ -727,7 +733,7 @@
       expect(mockCursor.destroy).toHaveBeenCalled();
     });
 
     it('13.7 crosshairCursor null → no error', () => {
       (action as unknown as R)['crosshairCursor'] = null;
       expect(() => action.cleanup()).not.toThrow();
     });

code/packages/sdk/src/actions/pen-tool/__tests__/pen-tool.test.ts

@@ -28,8 +28,12 @@
     destroy: vi.fn(),
     moveToTop: vi.fn(),
   });
-  const MockLine = vi.fn().mockImplementation(() => makeLineInstance());
-  const MockCircle = vi.fn().mockImplementation(() => makeCircleInstance());
+  const MockLine = vi.fn().mockImplementation(function () {
+    return makeLineInstance();
+  });
+  const MockCircle = vi.fn().mockImplementation(function () {
+    return makeCircleInstance();
+  });
   return { MockLine, MockCircle };
 });
 
@@ -406,7 +410,7 @@
       const countBefore = MockLine.mock.calls.length;
       (action as unknown as R)['state'] = PEN_TOOL_STATE.ADDING;
       mockWeave._stageHandlers['pointerdown'](makePointerEvent());
       expect(MockLine.mock.calls.length).toBe(countBefore);
     });
 
     it('8.4 measureContainer undefined → ?.add() no-op, no throw', () => {

code/packages/sdk/src/actions/rectangle-tool/__tests__/rectangle-tool.test.ts

@@ -16,7 +16,7 @@
 
 // Hoist Konva.Rect mock
 const { MockRect } = vi.hoisted(() => {
-  const MockRect = vi.fn().mockImplementation((attrs: Record<string, unknown>) => {
+  const MockRect = vi.fn().mockImplementation(function (attrs: Record<string, unknown>) {
     const inst = {
       _attrs: { ...attrs },
       setAttrs: vi.fn().mockImplementation(function (
@@ -534,7 +534,7 @@
       (action as unknown as R)['tempRectNode'] = existingRect;
       const callsBefore = MockRect.mock.calls.length;
       mockWeave._stageHandlers['pointerdown']?.(makePointerEvent({ pointerId: 1 }));
       expect(MockRect.mock.calls.length).toBe(callsBefore);
     });
 
     it('11.6 after handleAdding → state=DEFINING_SIZE', () => {

code/packages/sdk/src/actions/stroke-tool/__tests__/stroke-tool.test.ts

@@ -12,9 +12,11 @@ vi.mock('@/plugins/nodes-selection/nodes-selection', () => ({
 }));
 vi.mock('konva', () => ({ default: {} }));
 vi.mock('@/internal-utils/greedy-snapper', () => ({
-  GreedySnapper: vi.fn().mockImplementation(() => ({
-    apply: vi.fn().mockImplementation((angle: number) => angle),
-  })),
+  GreedySnapper: vi.fn().mockImplementation(function () {
+    return {
+      apply: vi.fn().mockImplementation((angle: number) => angle),
+    };
+  }),
 }));
 vi.mock('uuid', () => ({ v4: vi.fn().mockReturnValue('test-uuid') }));
 

code/packages/sdk/src/managers/__tests__/fonts.test.ts

@@ -152,7 +152,9 @@ describe('WeaveFontsManager', () => {
 
     beforeEach(() => {
       mockFontFaceInstance = { load: vi.fn().mockResolvedValue(undefined) };
-      MockFontFaceClass = vi.fn().mockImplementation(() => mockFontFaceInstance);
+      MockFontFaceClass = vi.fn().mockImplementation(function () {
+        return mockFontFaceInstance;
+      });
       documentFontsAdd = vi.fn();
       vi.stubGlobal('FontFace', MockFontFaceClass);
       vi.stubGlobal('document', { fonts: { add: documentFontsAdd } });