CB / @cavalierblanc/vitest-anonymized-reporters

Security-first coverage reporters for Vitest with built-in PII (Personally Identifiable Information) anonymization.

Overview

This library provides drop-in replacements for standard Vitest coverage reporters that automatically strip absolute file paths and other potentially sensitive information from coverage reports.

Key Benefits

• Privacy by Design: Automatic PII protection in all coverage artifacts
• GDPR/CCPA Compliant: Meets data privacy requirements for test reporting
• Zero Configuration: Works out-of-the-box with sensible security defaults
• Seamless Integration: Compatible with existing Vitest workflows

Features

• Anonymized JSON Reporter: Produces Istanbul-compatible JSON coverage with sanitized paths
• Anonymized LCOV Reporter: Generates LCOV format with absolute paths removed
• Anonymized Clover Reporter: Post-processes Clover XML output to strip absolute paths
• Path Anonymization: Converts absolute paths to relative paths from project root
• Security Logging: Clear indicators when anonymization is applied
• TypeScript Support: Full type definitions included
• Vitest 4.x Compatible: Tested with Vitest ^4.0.0

Reporter Types

This library provides two types of reporters:

• Standalone reporters (json-anonymizer, lcov-anonymizer): Generate coverage output directly via Istanbul hooks. They replace the standard json and lcov reporters entirely.
• Post-processing reporter (clover-anonymizer): Reads and anonymizes a pre-existing clover.xml file. The standard 'clover' reporter must be listed before the anonymizer in the reporter array.

Installation

Install the Package

npm install --save-dev @cavalierblanc/vitest-anonymized-reporters

Peer Dependencies

This package requires Vitest and the V8 coverage provider:

npm install --save-dev vitest@^4.0.0 @vitest/coverage-v8@^4.0.0

Usage

Configure the reporters in your vitest.config.ts under test.coverage.reporter:

export default defineConfig({
  test: {
    coverage: {
      enabled: true,
      provider: 'v8',
      reporter: [
        'text',
        ['html', { subdir: 'coverage' }],
        // Clover: standard reporter MUST precede the anonymizer
        'clover',
        ['@cavalierblanc/vitest-anonymized-reporters/reporters/clover-anonymizer', {}],
        // LCOV and JSON: standalone anonymized reporters (no upstream required)
        ['@cavalierblanc/vitest-anonymized-reporters/reporters/lcov-anonymizer', {}],
        ['@cavalierblanc/vitest-anonymized-reporters/reporters/json-anonymizer', {}],
      ],
      reportsDirectory: 'data/reports/test/unit',
    },
  },
});

Important: Clover Reporter Ordering

The clover-anonymizer is a post-processor — it reads the clover.xml generated by Istanbul's built-in 'clover' reporter and rewrites all file paths to relative paths. If the standard 'clover' reporter is omitted, no clover.xml file will exist and the anonymizer will silently skip processing.

The lcov-anonymizer and json-anonymizer reporters are standalone — they hook into Istanbul's coverage tree directly and produce anonymized output without requiring an upstream reporter.

Output Files

When configured as shown above, the following anonymized files are generated in reportsDirectory:

| Reporter | Default Output File | Description | |----------------------|------------------------|-----------------------------------------------| | clover-anonymizer | clover.xml | Anonymized Clover XML (overwrites in-place) | | lcov-anonymizer | lcov.info | Anonymized LCOV info | | json-anonymizer | coverage-final.json | Anonymized JSON coverage |

All output filenames can be customized via the file option in each reporter's configuration.

Requirements

• Node.js >= 24.5.0
• npm >= 11.5.0

License

MIT © 2026 Cavalier Blanc Inc.