Skip to content

Dependency updates: rollup 4, eslint 10, mocha 11; ffjavascript commit-ref pin - #105

Open
OBrezhniev wants to merge 35 commits into
masterfrom
feature/deps-update
Open

Dependency updates: rollup 4, eslint 10, mocha 11; ffjavascript commit-ref pin#105
OBrezhniev wants to merge 35 commits into
masterfrom
feature/deps-update

Conversation

@OBrezhniev

@OBrezhniev OBrezhniev commented Jul 4, 2026

Copy link
Copy Markdown
Member

Dependency updates: rollup 4, eslint 10, mocha 11; ffjavascript commit-ref pin

Summary

Companion to the snarkjs feature/memory-scoping PR (which pins this branch
by commit ref).

  • devDependencies — rollup 2 → 4, eslint 8 → 10 (.eslintrc.cjs migrated
    to flat eslint.config.mjs), mocha 10 → 11; bundle rebuilt, 3 tests pass.
  • Dropped an unused catch binding flagged by the new config.
  • ffjavascript pinned as a git+https://…#<commit> ref to the
    feature/msm-signed-buckets head this stack is developed against; local
    development uses an uncommitted file:../ override. Lockfile regenerated
    against the pin.

Landing order

After the ffjavascript PR lands; alternatively re-point the pin at the next
published ffjavascript version at merge time.

🤖 Generated with Claude Code

OBrezhniev added 6 commits July 4, 2026 01:31
@OBrezhniev
Update devDependencies: rollup 4, eslint 10 (flat config), mocha 11
78a20a7 
Migrates .eslintrc.cjs to flat eslint.config.mjs; drops an unused catch
binding. 3 tests pass; bundle rebuilds cleanly.
@OBrezhniev
Rebuild bundle with rollup 4
563d53f
@OBrezhniev
Pin ffjavascript to a commit ref
892c070 
Points at the ffjavascript feature branch this stack is developed
against (resolves once that branch is pushed). For local development
keep an uncommitted file:../ffjavascript override in the working tree.
@OBrezhniev
Re-pin ffjavascript (silent workers)
dc5338d
@OBrezhniev
Regenerate lockfile against the pinned commit refs
306d7a5
@OBrezhniev
Switch ffjavascript pin to git+https, re-pin
6fc3492 
git+https installs anonymously (git+ssh needs SSH credentials).
This was referenced Jul 4, 2026
Open
Open
@OBrezhniev

OBrezhniev commented Jul 4, 2026

Copy link
Copy Markdown
Member Author

PR stack (landing order):

  1. MSM endomorphisms (GLV/GLS) + CIOS field arithmetic (bn254/bls12-381) wasmcurves#75
  2. Prover performance: batch/endomorphism MSM, CIOS wasm, batching modes ffjavascript#185
  3. iden3/fastfile feature/direct_rw_optimization (pinned by binfileutils; no PR yet)
  4. BigBuffer paging threshold, dependency updates, commit-ref pins binfileutils#88 · Dependency updates: rollup 4, eslint 10, mocha 11; ffjavascript commit-ref pin #105
  5. Groth16 prover: memory scoping + MSM acceleration + prover options snarkjs#628

Cross-repo deps are pinned by git+https commit refs; re-pin consumers if a branch gains commits before merge.

This was referenced Jul 4, 2026
Open
Open
OBrezhniev and others added 16 commits July 4, 2026 20:17
@OBrezhniev
Fix dev-dependency audit findings via overrides
71eb211 
js-yaml bumped in-range; serialize-javascript ^7.0.5 and diff ^8.0.3
overridden (mocha pins vulnerable ranges). npm audit clean.
@OBrezhniev
Re-pin ffjavascript to latest commit
498994a
@OBrezhniev
test: verify loadConstraints:false never reads the constraint section…
fa2c787 
…, and wrong-magic rejection

Corrupts the constraint section's bytes on disk and confirms
readR1csHeader (loadConstraints:false) still returns correct header
fields -- proving the lazy header-only read path genuinely never
touches that data, not just that it happens to work on well-formed
files. A follow-up loadConstraints:true call on the SAME corrupted
file confirms the corruption is real (it throws), so the header-only
success isn't a false negative.

Also covers rejection of a file with the wrong magic string, which had
no coverage.
@OBrezhniev
Re-pin ffjavascript (worker-error propagation fixes)
dcc465b
@OBrezhniev
Re-pin ffjavascript (proving-phase hang-audit fixes)
5199170
@OBrezhniev
Re-pin ffjavascript (partitioned MSM)
7087946
@OBrezhniev
Re-pin ffjavascript (endo cutoff)
db09856
@OBrezhniev @claude
chore: re-pin ffjavascript (worker boot-failure give-up)
89b7226 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Wo6AVSAwvL9mHTpvnREZPR
@OBrezhniev @claude
chore: re-pin ffjavascript (wasmcurves ESM migration)
6a315ea 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Wo6AVSAwvL9mHTpvnREZPR
@OBrezhniev @claude
test: raise src coverage to 100% lines / branches / functions (from 6…
b7b3143 
…8% / 68% / 71%)

New suite covers everything the parser tests skipped:

- writeR1cs/writeR1csHeader/writeR1csConstraints/writeR1csMap via a full
  write -> read round-trip against the example fixture, the cir.curve.Fr
  fallback when cir.F is absent, write progress logging, and the
  invalid-map-size rejection
- a round-trip over a non-pairing prime (goldilocks), covering the
  getCurveFromR-throws -> F1Field fallback in readR1csHeader
- readR1csHeader field-resolution options: caller-provided F (including
  the Different Prime rejection), getFieldFromPrime and getCurveFromPrime
  factories, undefined/boolean singleThread normalization
- readR1cs with no options; readR1csFd non-object options rejection
- readConstraints/readMap options-object and legacy positional logger
  forms (the positional branch only fires for a non-object logger, since
  any object 4th argument is taken as the options bag)
- BigArray paths: a crafted (2^20)+1-constraint/map/custom-gate-use file
  exercises the BigArray selection and mid-run progress logging in
  readConstraints, readMap and readCustomGatesUsesSection

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01833VaUEJmrFZ7bVprrWwpp
@OBrezhniev @claude
chore: re-pin ffjavascript (coverage push + dormant-bug fixes)
6f1381a 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01833VaUEJmrFZ7bVprrWwpp
@OBrezhniev @claude
chore: re-pin ffjavascript (standards-vector tests)
54bb924 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01833VaUEJmrFZ7bVprrWwpp
@OBrezhniev @claude
chore: re-pin ffjavascript (wasmcurves re-pin)
f0133fd 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01833VaUEJmrFZ7bVprrWwpp
@OBrezhniev @claude
chore: re-pin ffjavascript (portable teardown, Node 20 dispatch)
85827cd 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01833VaUEJmrFZ7bVprrWwpp
@OBrezhniev @claude
chore: restore transitive git deps in the lockfile (npm ci sync)
9d5640c 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01833VaUEJmrFZ7bVprrWwpp
@OBrezhniev @claude
Migrate build/test tooling to Vite + Vitest (rebased onto feature/dep…
09b93c2 
…s-update)

Port of the feature/esm-tooling migration (2b829dc) onto the current branch:
Rollup -> Vite, Mocha -> Vitest, flat eslint.config.js, CI workflow. Our
post-fork round-trip/introspection suite (r1csfile_more.test.js) converted
(this.timeout dropped; the stringifyBigInts helper it imports is exported
from test/r1csfile.js again).

Re-pinned ffjavascript to 4ac1cba (Vite+Vitest migration landed there);
vitest ^4.1.11 (GHSA-p63j-vcc4-9vmv); postcss/brace-expansion overrides
added (npm audit clean).

20 tests pass; lint clean; CJS build regenerated with vite.

(cherry picked from commit 2b829dc)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01833VaUEJmrFZ7bVprrWwpp
@OBrezhniev
OBrezhniev force-pushed the feature/deps-update branch from 802f02d to 09b93c2 Compare August 26, 2026 17:12
OBrezhniev and others added 11 commits August 27, 2026 12:19
@OBrezhniev @claude
chore: re-pin ffjavascript (wasmcurves re-pin cascade)
0235e34 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01833VaUEJmrFZ7bVprrWwpp
@OBrezhniev @claude
ci: test on lts/-1 as well
e627cc5 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01833VaUEJmrFZ7bVprrWwpp
@OBrezhniev @claude
chore: re-pin ffjavascript (lts/-1 cascade)
bf6933b 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01833VaUEJmrFZ7bVprrWwpp
@OBrezhniev @claude
chore: re-pin ffjavascript (worker unref-on-terminate fix)
e0bb6f8 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01833VaUEJmrFZ7bVprrWwpp
@OBrezhniev @claude
ci: add timeout-minutes to the npm-publish job
230f64d 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01833VaUEJmrFZ7bVprrWwpp
@OBrezhniev @claude
chore: re-pin ffjavascript (fsqrt c=0 hang fix)
b53d52d 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01833VaUEJmrFZ7bVprrWwpp
@OBrezhniev @claude
chore: re-pin ffjavascript (idle-termination dispatch-race fix)
4d33f21 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01833VaUEJmrFZ7bVprrWwpp
@OBrezhniev @claude
chore: re-pin ffjavascript (terminate-settles-tasks + build-dedupe fi…
81a9cbf 
…xes)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01833VaUEJmrFZ7bVprrWwpp
@OBrezhniev @claude
chore: re-pin ffjavascript (worker input-buffer transfer-back)
29af5e0 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01833VaUEJmrFZ7bVprrWwpp
@OBrezhniev @claude
chore: pin LF line endings via .gitattributes
102df1f 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01833VaUEJmrFZ7bVprrWwpp
@OBrezhniev @claude
chore: drop rimraf (fs.rmSync does the clean)
ec5c2e5 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01833VaUEJmrFZ7bVprrWwpp
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@OBrezhniev