Use exact versions in tests

7 files changed, 68 insertions, 27 deletions

diff --git a/test/bun.lockb b/test/bun.lockb
index f8ea8e4c6..f30ca197a 100755
--- a/test/bun.lockb
+++ b/test/bun.lockb
diff --git a/test/internal/package-json-lint.test.ts b/test/internal/package-json-lint.test.ts
new file mode 100644
index 000000000..5a1fae5f9
--- /dev/null
+++ b/test/internal/package-json-lint.test.ts
@@ -0,0 +1,42 @@
+import { test, expect, describe } from "bun:test";
+import { join } from "path";
+import { readdirSync, existsSync } from "fs";
+const base = join(import.meta.dir, "../");
+
+const packageJSONDirs = [
+  base,
+  ...readdirSync(join(import.meta.dir, "../", "js", "third_party"))
+    .map(a => join(import.meta.dir, "../", "js", "third_party", a))
+    .filter(a => existsSync(join(a, "./package.json"))),
+];
+
+// For test reliability and security reasons
+// We must use exact versions for third-party dependencies in our tests.
+describe("package.json dependencies must be exact versions", async () => {
+  for (const dir of packageJSONDirs) {
+    test(join("test", dir.replace(base, ""), "package.json"), async () => {
+      const {
+        dependencies = {},
+        devDependencies = {},
+        peerDependencies = {},
+        optionalDependencies = {},
+      } = await Bun.file(join(dir, "./package.json")).json();
+
+      for (const [name, dep] of Object.entries(dependencies)) {
+        expect(dep).toMatch(/^([a-zA-Z0-9\.])+$/);
+      }
+
+      for (const [name, dep] of Object.entries(devDependencies)) {
+        expect(dep).toMatch(/^([a-zA-Z0-9\.])+$/);
+      }
+
+      for (const [name, dep] of Object.entries(peerDependencies)) {
+        expect(dep).toMatch(/^([a-zA-Z0-9\.])+$/);
+      }
+
+      for (const [name, dep] of Object.entries(optionalDependencies)) {
+        expect(dep).toMatch(/^([a-zA-Z0-9\.])+$/);
+      }
+    });
+  }
+});
diff --git a/test/js/third_party/esbuild/bun.lockb b/test/js/third_party/esbuild/bun.lockb
index f46c6aa5d..1fcce3837 100755
--- a/test/js/third_party/esbuild/bun.lockb
+++ b/test/js/third_party/esbuild/bun.lockb
diff --git a/test/js/third_party/esbuild/package.json b/test/js/third_party/esbuild/package.json
index ad6bc55f6..46535bc29 100644
--- a/test/js/third_party/esbuild/package.json
+++ b/test/js/third_party/esbuild/package.json
@@ -1,6 +1,6 @@
 {
   "type": "module",
   "dependencies": {
-    "esbuild": "^0.17.11"
+    "esbuild": "0.17.11"
   }
-}
\ No newline at end of file
+}
diff --git a/test/js/third_party/prisma/package.json b/test/js/third_party/prisma/package.json
index 369bd42ba..ac8694e36 100644
--- a/test/js/third_party/prisma/package.json
+++ b/test/js/third_party/prisma/package.json
@@ -3,11 +3,11 @@
   "module": "index.ts",
   "type": "module",
   "devDependencies": {
-    "bun-types": "^0.6.0",
+    "bun-types": "0.6.12",
     "prisma": "4.15.0"
   },
   "peerDependencies": {
-    "typescript": "^5.0.0"
+    "typescript": "5.0.0"
   },
   "dependencies": {
     "@prisma/client": "4.15.0"
diff --git a/test/js/third_party/socket.io/package.json b/test/js/third_party/socket.io/package.json
index edeb84845..af70e36a6 100644
--- a/test/js/third_party/socket.io/package.json
+++ b/test/js/third_party/socket.io/package.json
@@ -2,9 +2,8 @@
   "name": "socket.io",
   "version": "1.0.0",
   "dependencies": {
-    "socket.io": "^4.6.1",
-    "socket.io-client": "^4.6.1",
-    "supertest": "^6.1.6",
-    "uWebSockets.js": "uNetworking/uWebSockets.js#v20.24.0"
+    "socket.io": "4.6.1",
+    "socket.io-client": "4.6.1",
+    "supertest": "6.1.6"
   }
 }
diff --git a/test/package.json b/test/package.json
index d4246ea43..116571879 100644
--- a/test/package.json
+++ b/test/package.json
@@ -1,29 +1,29 @@
 {
   "name": "test",
   "devDependencies": {
-    "@types/dedent": "^0.7.0"
+    "@types/dedent": "0.7.0"
   },
   "dependencies": {
     "@prisma/client": "4.15.0",
-    "@swc/core": "^1.3.38",
-    "@types/react": "^18.0.28",
-    "@types/react-dom": "^18.0.11",
-    "bktree-fast": "^0.0.7",
-    "body-parser": "^1.20.2",
-    "dedent": "^0.7.0",
-    "esbuild": "^0.18.6",
-    "express": "^4.18.2",
-    "iconv-lite": "^0.6.3",
-    "jest-extended": "^4.0.0",
-    "lodash": "^4.17.21",
+    "@swc/core": "1.3.38",
+    "@types/react": "18.0.28",
+    "@types/react-dom": "18.0.11",
+    "bktree-fast": "0.0.7",
+    "body-parser": "1.20.2",
+    "dedent": "0.7.0",
+    "esbuild": "0.18.6",
+    "express": "4.18.2",
+    "iconv-lite": "0.6.3",
+    "jest-extended": "4.0.0",
+    "lodash": "4.17.21",
     "prisma": "4.15.0",
-    "socket.io": "^4.6.1",
-    "socket.io-client": "^4.6.1",
-    "supertest": "^6.1.6",
-    "svelte": "^3.55.1",
-    "typescript": "^5.0.2",
-    "undici": "^5.20.0",
-    "vitest": "^0.32.2",
+    "socket.io": "4.6.1",
+    "socket.io-client": "4.6.1",
+    "supertest": "6.1.6",
+    "svelte": "3.55.1",
+    "typescript": "5.0.2",
+    "undici": "5.20.0",
+    "vitest": "0.32.2",
     "webpack": "5.88.0",
     "webpack-cli": "4.7.2"
   },