Amends ADR-022 §9 with the `is-sub-processor` / `processes-pii` discriminated union spec, including the five conditional fields required when a library is a true GDPR sub-processor. Updates the evaluate-library skill to prompt for these fields during every trace authoring pass and adds the updated frontmatter template. Backfills all nine existing library-decision traces with the new fields; payload gets `processes-pii: true` (self-hosted CMS that stores user data); all pure in-process libraries get `false / false`. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2.9 KiB
package, version, tier, decision, date, deciders, adr, lastRevalidated, is-sub-processor, processes-pii, filter-results, verification-commands, accepted-cves
| package | version | tier | decision | date | deciders | adr | lastRevalidated | is-sub-processor | processes-pii | filter-results | verification-commands | accepted-cves | ||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| vitest | ^3.0.0 | core | approved | 2026-05-14 |
|
null | null | false | false |
|
|
Filter: license
npm view vitest license returns MIT. MIT is on the allowlist.
Filter: types
vitest is authored in TypeScript and ships its own .d.ts declaration files. No separate @types/vitest package is needed.
Filter: maintenance
Actively maintained by the Vite / Vitest team. The 3.x line is the current major. Regular releases with strong community momentum in the Vite ecosystem.
Filter: boundary-fit
vitest is listed as a runtime dependency of @repo/core-testing because it provides the test runner APIs (describe, it, expect, vi) that core-testing re-exports or uses in its test utilities. All feature packages declare vitest as a devDependency. This is the correct placement for a testing infrastructure package.
Filter: shadow-check
vitest is the sole test runner in the workspace. No competing runner (Jest, Jasmine, Mocha) is present.
Filter: eu-residency
vitest is a local test runner with no network communication to vendor-controlled endpoints. EU residency does not apply.
Filter: cve-scan
pnpm audit --audit-level=moderate reports no advisories against vitest at the time of this trace.
Filter: named-consumer
@repo/core-testing lists vitest as a runtime dependency. Every feature package uses vitest as a devDependency for running tests. Named, non-hypothetical consumers exist today.
Prompt: replaces
vitest replaces Jest as the test runner. The Vite-based transformation pipeline eliminates the need for Babel transforms and provides native ES module support, reducing test suite configuration complexity.
Prompt: migration-cost-out
Hard. vitest's describe / it / expect / vi.fn() APIs are used in every test file across all packages. Migrating to Jest or another runner requires updating all test files (largely mechanical API renames) and reconfiguring the coverage pipeline (ADR-020 L0 thresholds, @vitest/coverage-v8).
Prompt: alternatives-considered
- Jest — Mature but requires additional Babel/ESM configuration in a Vite-based monorepo; vitest provides native compatibility.
- Node.js
node:test— Lightweight but lacks the ecosystem integrations (coverage, snapshot, mocking) that vitest provides out of the box.