Repository navigation
chore(deps): update dependency vitest to v3 [security] - #39
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
📝 WalkthroughWalkthroughThis pull request updates the ChangesVitest dependency bump
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@package.json`:
- Line 100: The package.json currently declares "vitest" which is incompatible
with the pinned "vite" ^5.0.8; update package.json to resolve the toolchain
mismatch by either upgrading "vite" to a 6.x+ release and ensuring CI/local Node
runtime is Node 20+ (and then validate Storybook/builder and any Vite-based
config), or downgrade/pin "vitest" to a version that supports Vite 5 (e.g., a
Vitest 3.x release); edit the "vitest" and "vite" entries in package.json
accordingly and run installs and CI tests to confirm the change.
- Line 100: Update package.json to align testing and bundler versions: bump the
`@vitest/coverage-v8` dependency to the vitest v4-compatible major (match vitest
^4.x), and update the vite version range to one of vitest@4’s supported ranges
(e.g., ^6 || ^7) so peer deps match; in short, change the `@vitest/coverage-v8`
entry to the v4-compatible release and adjust the vite entry from ^5.0.8 to a
vitest-4-compatible range (e.g., ^6 || ^7) to resolve the peer dependency
mismatch with vitest and ensure coverage integration works with vitest run
--coverage.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 280ae069-51f8-4385-b931-250b7349b433
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (1)
package.json
renovate
Bot
force-pushed
the
renovate/npm-vitest-vulnerability
branch
from
June 8, 2026 18:16
57fbd80 to
395674f
Compare
renovate
Bot
changed the title
|
Tip All tests passed and all changes approved!🟢 UI Tests: 113 tests unchanged |
renovate
Bot
force-pushed
the
renovate/npm-vitest-vulnerability
branch
from
June 11, 2026 13:46
395674f to
e702e08
Compare
renovate
Bot
force-pushed
the
renovate/npm-vitest-vulnerability
branch
2 times, most recently
from
July 16, 2026 23:55
ebde2a7 to
aab9084
Compare
renovate
Bot
force-pushed
the
renovate/npm-vitest-vulnerability
branch
2 times, most recently
from
July 30, 2026 18:00
bfc03d2 to
a991fea
Compare
renovate
Bot
force-pushed
the
renovate/npm-vitest-vulnerability
branch
4 times, most recently
from
August 8, 2026 16:54
6965c89 to
b05271d
Compare
renovate
Bot
force-pushed
the
renovate/npm-vitest-vulnerability
branch
from
September 7, 2026 21:59
b05271d to
561ac61
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
^1.2.0→^3.0.0When Vitest UI server is listening, arbitrary file can be read and executed
CVE-2026-47429 / GHSA-5xrq-8626-4rwp
More information
Details
Summary
Arbitrary file can be read on Windows when Vitest UI server is listening, especially when exposed to the network.
Impact
Only users that match either of the following conditions are affected:
--api.hostorapi.hostconfig option)Details
The API handler for
/__vitest_attachment__uses the deprecatedisFileServingAllowedincorrectly.https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/ui/node/index.ts#L77
The function expects the passed value to use
cleanUrlafter the check before file system related operation.Because of this, it is possible to bypass the check by
\\?\\..\\. This is not possible on Linux as Linux errors if a directory named?does not exist.A similar problem exists in other places as well.
That said, this
isFileServingAllowedcheck does not actually prevent the API to be abused. Since the API has rerun feature and file write feature, it's possible to run arbitrary script by writing a script as a test file usingsaveTestFileand running it usingrerun. This means exposing the API / Vitest UI is equivalent to giving script execution access.On the browser mode side, there're
readFile/writeFile/saveSnapshotFile. So exposing the browser mode is equivalent to giving file read / write access.PoC
curl http://localhost:51204/__vitest__/curl "http://localhost:51204/__vitest_attachment__?path=C:\\path\\to\\project\\?\\..\\..\\secret.txt&contentType=text/plain&token=$TOKEN"(TOKEN is the API token)secret.txtthat is outside the project directoryMitigations
Vitest now ships two configuration flags,
allowWriteandallowExec, that gate the privileged operations exploited by this vulnerability. Both are disabled by default whenever the API server is bound to a non-localhosthost, ensuring that exposing the server to the network no longer implicitly grants write or execute capabilities to remote clients.When these flags are disabled, the UI also enters a read-only mode: in-browser code editing and test file execution are turned off, removing the attack surface that allowed remote code execution. Many Browser Mode features are also disabled, like attachments, artifacts or snapshots. See
browser.api.Users who require the full interactive UI on a networked host must explicitly opt in by setting
allowWriteand/orallowExectotrue.Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
vitest-dev/vitest (vitest)
v3.2.6Compare Source
🐞 Bug Fixes
View changes on GitHub
v3.2.5Compare Source
🚀 Features
allowWriteandallowExecoptions toapi[backport to v3] - by @hi-ogawa and Codex in #10445 (af88b)🐞 Bug Fixes
cdpAPI whenallowWrite/allowExec: false[backport to v3] - by @hi-ogawa and Codex in #10456 (385a1)View changes on GitHub
v3.2.4Compare Source
🐞 Bug Fixes
vitest run --watchshould be watch-mode - by @AriPerkkio in #8128 (657e8)--shard x/<count>exceeds count of test files - by @AriPerkkio in #8112 (8a18c)minWorkerswhen onlymaxWorkersspecified - by @AriPerkkio in #8110 (14dc0)task.metashould be available in custom reporter's errors - by @AriPerkkio in #8115 (27df6)View changes on GitHub
v3.2.3Compare Source
🚀 Features
🐞 Bug Fixes
expect.anyreturn type - by @sheremet-va in #8129 (47514)process.send()- by @AriPerkkio in #8125 (dfe81)View changes on GitHub
v3.2.2Compare Source
🚀 Features
🐞 Bug Fixes
createTesterscall on the main thread - by @sheremet-va in #8101 (142c7)vitest-browser-*packages - by @sheremet-va in #8103 (247ef)toEqual- by @dubzzz in #8094 (02ec8)dotreporter to work in non interactive terminals - by @bstephen1 and @AriPerkkio in #7994 (6db9f)View changes on GitHub
v3.2.1Compare Source
🐞 Bug Fixes
DeeplyAllowMatchers- by @sheremet-va in #8078 (30ab4)View changes on GitHub
v3.2.0Compare Source
🚀 Features
ctx.signal- by @sheremet-va in #7878 (e761f)test.name- by @AriPerkkio in #7809 (4af5d)vi.mockObjectto automock any object - by @hi-ogawa and @sheremet-va in #7761 (465bd)watchTriggerPatternsoption - by @sheremet-va in #7778 (a0675)workspacein favor ofprojects- by @sheremet-va and @AriPerkkio in #7923 (41beb)sequence.groupOrderoption - by @sheremet-va in #7852 (d1a1d)connectoption forplaywrightbrowser provider - by @egfx-notifications and @sheremet-va in #7915 (029c0)screenshot.saveoption - by @sheremet-va in #7777 (d9f51)onWritePathoption togithub-actions- by @nwalters512 and @AriPerkkio in #8015 (abd3b)🐞 Bug Fixes
micromatchwithpicomatch- by @sapphi-red in #7951 (df076)anytypes toAsymmetricMatcher<unknown>, withDeeplyAllowMatchers<T>- by @JoshuaKGoldberg in #7016 (8ec44)stackproperties - by @sheremet-va in #7995 (330f9)toJSONserialisation - by @sheremet-va in #8053 (3bdf0)uploadfiles relative to the project root - by @sheremet-va in #8042 (b9a31)thistype tolocators.extend- by @sheremet-va in #8069 (70fb0)--silentvalues properly - by @AriPerkkio in #8055 (8fad7)@types/chai- by @hi-ogawa in #7937 (525f5)vitest listcommand - by @sheremet-va in #7933 (ba6da)__vite_ssr_exportName__- by @hi-ogawa in #7925 (76091)getWorkerMemoryLimitpriority for vmForks - by @pengooseDev in #7960 (5a91e)View changes on GitHub
v3.1.4Compare Source
🐞 Bug Fixes
View changes on GitHub
v3.1.3Compare Source
🐞 Bug Fixes
inline: trueis set - by @sheremet-va in #7856 (a83f3)--merge-reportsto show each total run times - by @AriPerkkio in #7877 (d613b)View changes on GitHub
v3.1.2Compare Source
🐞 Bug Fixes
chaivariable invitest/globals(fix: #7474) - by @Jay-Karia in #7771 and #7474 (d9297)test.excludewhen same object passed incoverage.exclude- by @AriPerkkio in #7774 (c3751)envionmentOptions- by @hi-ogawa in #7795 (67430)awaitprofiler calls - by @AriPerkkio in #7763 (795a6)🏎 Performance
View changes on GitHub
v3.1.1Compare Source
🐞 Bug Fixes
View changes on GitHub
v3.1.0Compare Source
🚀 Features
%$option to add number of the test to its title - by @kemuridama in #7412 (df347)diff.maxDepthoption and set non-Infinityvalue as a default to reduce crash - by @hi-ogawa in #7481 (eacab)test.each/fortitle formatting - by @hi-ogawa in #7522 (ea3d6)--configLoaderCLI option - by @Carnageous and @hi-ogawa in #7574 (2a852)vitest-browser-littovitest init browserand docs - by @EskiMojo14 and @hi-ogawa in #7705 (5659a)and,orandfilterlocators - by @sheremet-va and @AriPerkkio in #7463 (63949)--silent=passed-onlyto log failed tasks only - by @AriPerkkio in #7530 (f9e1c)test.scopedto overridetest.extendfixtures per-suite - by @sheremet-va in #7233 (e5851)context.skip(boolean)- by @sheremet-va and @AriPerkkio in #7659 (6adec)🐞 Bug Fixes
diff.expand: falseas default - by @hi-ogawa in #7697 (f3420)--hideSkippedTestsshould hide suites too - by @AriPerkkio in #7695 (ba9b5)🏎 Performance
View changes on GitHub
v3.0.9Compare Source
🐞 Bug Fixes
ctx.skip()asnever- by @sirlancelot in #7608 (09f35)resolveConfigAPI - by @hi-ogawa in #7623 (db14a)toHaveBeenCalledWith(asymmetricMatcher)withundefinedarguments - by @hi-ogawa in #7624 (0fb21)getState().testPathduring collection with no isolation - by @hi-ogawa in #7640 (3fb3f)coverage.all- by @AriPerkkio in #7597 (422ba)buildStart- by @hi-ogawa in #7652 (29f5a)removeEventListeneris bound to worker - by @joelgallant in #7631 (ff42b)View changes on GitHub
v3.0.8Compare Source
🐞 Bug Fixes
@vitest/spy- by @mrginglymus in #7575 (7f7ff)Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.