fix(security): remove CVE-2026-84373 from Vitest lock

[seonghobae]

Reality RED → causal security repair

Issue #568 owns CVE-2026-84373 in protected-source vitest@4.1.9 / @vitest/mocker@4.1.9, fixed on the 4.1.11 line. This lane keeps scanning fail-closed and does not add an ignore, native-addon fallback, or gate weakening.

The repair retained its reality lineage. Initial exact 5864d0bab8273a1512fed282676598be7a53d617 advanced direct vitest and @vitest/coverage-v8 requirements to ^4.1.11 and added test/vitest-security-lock.test.ts. Hosted CI regenerated the canonical lock with repository-pinned Node 24.19.0/npm 11.17.0. Commit f73968496e2162a00645b813bb6051cf96351ec9 promoted that first canonical lock unchanged, after which patch-validator-image exposed a second RED: Rolldown 1.2.7 no longer implicitly supplied @rolldown/binding-wasm32-wasi, while Noema's static validator deliberately requires the WASI binding and rejects native .node runtime payloads.

The minimal repair explicitly pins @rolldown/binding-wasm32-wasi@1.2.7 and binds the root declaration to the resolved Rolldown/WASI versions in the security regression. Hosted regeneration artifact 10089198660 produced the final 70,045-byte lock, SHA-256 0027d45e4e5f5faf03132b8ab8d97a9adc0338b828881a1a821f75018a415049, Git blob 33023ebd5ae4f555779016d65548c20483241446. That exact canonical lock is now committed without retyping registry integrity metadata, and .github/lockfile-change-policy.json is refreshed against protected main@8108bae1128c20b92d79dacaf65c3d9e3d55b758 for the final package-object delta.

Current exact head is 626be6a917a54c17f7a0c26beb40747a24e73299, based on the current protected main. The committed lock has root @rolldown/binding-wasm32-wasi@1.2.7, vitest@^4.1.11, and @vitest/coverage-v8@^4.1.11; the regression rejects vulnerable Vitest/mocker resolution and requires the static WASI binding to stay version-aligned with Rolldown.

Fresh unchanged-exact checks: application CI 34314409205 SUCCESS, reviewer-ci 34314409224 SUCCESS, required Security Scan 34314409226 SUCCESS. patch-validator-image 34314409190 / job 102347505772 is assigned on GitHub-hosted ubuntu-24.04; exact checkout, stale-head refusal, pinned scanner installation, dependency materialization and Buildx setup are SUCCESS and the exact-head image build is in progress. No review threads are currently open.

Keep Draft until the same exact head reaches terminal patch-validator-image SUCCESS, including static/no-native runtime verification, realistic no-network/read-only/non-root smoke, SBOM/vulnerability receipts proving CVE-2026-84373 absent, final exact-source/image receipt verification and post-verification stale-head refusal. Then re-read head/base/reviews and only use the normal merge path. No publication or immutable-release authority is inferred.

Dependabot #571 remains open and Draft. It is not yet a verified successor because it does not independently inherit this lane's coverage-v8 requirement, explicit WASI/static-validator contract, security regression, lock-policy evidence or complete RED→repair lineage.

Summary by CodeRabbit

• 보안 업데이트

  • CVE-2026-84373 대응을 위해 Vitest 및 관련 커버리지 도구를 4.1.11 이상으로 업데이트했습니다.
  • Rolldown WASI 바인딩을 명시적으로 고정해 개발 환경의 버전 일관성을 강화했습니다.

• 테스트

  • 취약한 도구 버전 사용 여부와 WASI 바인딩 버전 일치를 자동으로 검증하는 보안 회귀 테스트를 추가했습니다.

• 문서

  • 위 보안 업데이트 내용을 변경 로그에 반영했습니다.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 8b203cad-32d9-43a8-a021-96b4c86d8c8e

📥 Commits

Reviewing files that changed from the base of the PR and between 8108bae and 626be6a.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (4)

• .github/lockfile-change-policy.json
• CHANGELOG.md
• package.json
• test/vitest-security-lock.test.ts

---

📝 Walkthrough

Walkthrough

Vitest를 4.1.11로 갱신하고 Rolldown WASI 바인딩을 개발 의존성으로 추가했다. lockfile 변경 정책과 관련 패키지 메타데이터를 갱신했다. 최소 버전과 바인딩 정합성을 검증하는 보안 회귀 테스트를 추가했다.

Changes

Vitest 보안 업데이트

Layer / File(s)	Summary
의존성 및 lockfile 정책 갱신 package.json, .github/lockfile-change-policy.json	Vitest와 @vitest/coverage-v8를 ^4.1.11로 갱신했다. @rolldown/binding-wasm32-wasi를 추가했다. Vitest, Rolldown, Vite, Lightningcss 관련 lockfile 다이제스트, 소스, 대상 패키지 정보를 갱신했다.
보안 lockfile 회귀 검증 test/vitest-security-lock.test.ts, CHANGELOG.md	Vitest와 @vitest/mocker의 최소 안전 버전, Rolldown WASI 바인딩과 rolldown의 버전 일치, 루트 개발 의존성 선언을 검증한다. 변경 내용을 changelog에 기록했다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/vitest-cve-2026-84373

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Review (read-only, no code pushed): this lane is currently RED by construction. test/vitest-security-lock.test.ts requires package-lock.json node_modules/vitest and node_modules/@vitest/mocker >= 4.1.11 plus root devDeps ^4.1.11, but the diff updates only package.json + test — package-lock.json still resolves node_modules/vitest@4.1.9 (verified on this exact head). Next GREEN step: refresh the lockfile (npm install for the two bumped entries, smallest compatible delta) and push; do not weaken the new test. Leaving the branch untouched for the owner lane.

[seonghobae]

Fresh repair evidence after protected main advanced via #562:

• non-force reconvergence completed: fix/vitest-cve-2026-84373 now includes previous exact 5864d0bab8273a1512fed282676598be7a53d617 plus protected main@8108bae1128c20b92d79dacaf65c3d9e3d55b758 in merge commit a181d03e634d43305d3ea634e380cb69289d108b;
• the reconverged tree preserves the Vitest >=4.1.11 manifest and hostile lock regression while deliberately leaving the root lock unpromoted, so CI must reproduce the RED rather than hide it;
• the prior exact hosted regeneration artifact is artifact 10086784221, ZIP SHA-256 cf817ce568286640cbbcdb22fc487e46d061b80e47614475bc8920610089f9e5;
• downloaded noema-package-lock-regenerated.json is 66,789 bytes, SHA-256 78c904f85d5e681e5f32a99523e905eb972f1a6faf5849e599c9e0ebb3972341;
• downloaded regeneration diff SHA-256 is 0090daa856577b7e89ba33a207a11718bb2f3f7405bd2742e9ea83137ff0f088.

These values correct the stale/mismatched artifact receipt previously recorded in the PR body. Do not treat the old receipt as current evidence. The lane remains Draft until the regenerated lock is promoted on the current head and the exact-head CI/reviewer/Security/image gates are freshly GREEN.