Update vitest 4.1.4 → 4.1.5 (patch)

[depfu]

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ vitest (4.1.4 → 4.1.5) · Repo

Release Notes

4.1.5

   🚀 Experimental Features

• coverage: Istanbul to support instrumenter option  -  by @BartWaardenburg and @AriPerkkio in #10119 (0e0ff)

   🐞 Bug Fixes

• --project negation excludes browser instances  -  by @felamaslen in #10131 (9423d)
• Project color label on html reporter  -  by @hi-ogawa in #10142 (596f7)
• Fix vi.defineHelper called as object method  -  by @hi-ogawa in #10163 (122c2)
• Alias agent reporter to minimal  -  by @sheremet-va in #10157 (663b9)
• Respect diff config options in soft assertions  -  by @Copilot, sheremet-va and @sheremet-va in #8696 (9787d)
• Respect diff config options in soft assertions "  -  by @sheremet-va in #8696 (7dc6d)
• ast-collect: Recognize _vi_import prefix in static test discovery  -  by @Yejneshwar in #10129 (32546)
• coverage: Descriptive error message when reports directory is removed during test run  -  by @DaveT1991 and @AriPerkkio in #10117 (14133)
• snapshot: Increase default snapshot max output length  -  by @hi-ogawa and Codex in #10150 (21e66)
• ui: Fix jsx/tsx syntax highlight  -  by @hi-ogawa in #10152 (f1b1f)
• web-worker: Support MessagePort objects referenced inside postMessage data  -  by @whitphx and Claude Opus 4.6 (1M context) in #9927 and #10124 (7ad7d)
• api: Make test-specification options writable  -  by @sheremet-va in #10154 (6abd5)

    View changes on GitHub

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

✳️ @​vitest/coverage-v8 (4.1.4 → 4.1.5) · Repo

Release Notes

4.1.5

   🚀 Experimental Features

• coverage: Istanbul to support instrumenter option  -  by @BartWaardenburg and @AriPerkkio in #10119 (0e0ff)

   🐞 Bug Fixes

• --project negation excludes browser instances  -  by @felamaslen in #10131 (9423d)
• Project color label on html reporter  -  by @hi-ogawa in #10142 (596f7)
• Fix vi.defineHelper called as object method  -  by @hi-ogawa in #10163 (122c2)
• Alias agent reporter to minimal  -  by @sheremet-va in #10157 (663b9)
• Respect diff config options in soft assertions  -  by @Copilot, sheremet-va and @sheremet-va in #8696 (9787d)
• Respect diff config options in soft assertions "  -  by @sheremet-va in #8696 (7dc6d)
• ast-collect: Recognize _vi_import prefix in static test discovery  -  by @Yejneshwar in #10129 (32546)
• coverage: Descriptive error message when reports directory is removed during test run  -  by @DaveT1991 and @AriPerkkio in #10117 (14133)
• snapshot: Increase default snapshot max output length  -  by @hi-ogawa and Codex in #10150 (21e66)
• ui: Fix jsx/tsx syntax highlight  -  by @hi-ogawa in #10152 (f1b1f)
• web-worker: Support MessagePort objects referenced inside postMessage data  -  by @whitphx and Claude Opus 4.6 (1M context) in #9927 and #10124 (7ad7d)
• api: Make test-specification options writable  -  by @sheremet-va in #10154 (6abd5)

    View changes on GitHub

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

✳️ vite (8.0.8 → 8.0.9) · Repo · Changelog

Release Notes

8.0.9

Please refer to CHANGELOG.md for details.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​vitest/expect (indirect, 4.1.4 → 4.1.5) · Repo

Release Notes

4.1.5

   🚀 Experimental Features

• coverage: Istanbul to support instrumenter option  -  by @BartWaardenburg and @AriPerkkio in #10119 (0e0ff)

   🐞 Bug Fixes

• --project negation excludes browser instances  -  by @felamaslen in #10131 (9423d)
• Project color label on html reporter  -  by @hi-ogawa in #10142 (596f7)
• Fix vi.defineHelper called as object method  -  by @hi-ogawa in #10163 (122c2)
• Alias agent reporter to minimal  -  by @sheremet-va in #10157 (663b9)
• Respect diff config options in soft assertions  -  by @Copilot, sheremet-va and @sheremet-va in #8696 (9787d)
• Respect diff config options in soft assertions "  -  by @sheremet-va in #8696 (7dc6d)
• ast-collect: Recognize _vi_import prefix in static test discovery  -  by @Yejneshwar in #10129 (32546)
• coverage: Descriptive error message when reports directory is removed during test run  -  by @DaveT1991 and @AriPerkkio in #10117 (14133)
• snapshot: Increase default snapshot max output length  -  by @hi-ogawa and Codex in #10150 (21e66)
• ui: Fix jsx/tsx syntax highlight  -  by @hi-ogawa in #10152 (f1b1f)
• web-worker: Support MessagePort objects referenced inside postMessage data  -  by @whitphx and Claude Opus 4.6 (1M context) in #9927 and #10124 (7ad7d)
• api: Make test-specification options writable  -  by @sheremet-va in #10154 (6abd5)

    View changes on GitHub

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​vitest/mocker (indirect, 4.1.4 → 4.1.5) · Repo

Release Notes

4.1.5

   🚀 Experimental Features

• coverage: Istanbul to support instrumenter option  -  by @BartWaardenburg and @AriPerkkio in #10119 (0e0ff)

   🐞 Bug Fixes

• --project negation excludes browser instances  -  by @felamaslen in #10131 (9423d)
• Project color label on html reporter  -  by @hi-ogawa in #10142 (596f7)
• Fix vi.defineHelper called as object method  -  by @hi-ogawa in #10163 (122c2)
• Alias agent reporter to minimal  -  by @sheremet-va in #10157 (663b9)
• Respect diff config options in soft assertions  -  by @Copilot, sheremet-va and @sheremet-va in #8696 (9787d)
• Respect diff config options in soft assertions "  -  by @sheremet-va in #8696 (7dc6d)
• ast-collect: Recognize _vi_import prefix in static test discovery  -  by @Yejneshwar in #10129 (32546)
• coverage: Descriptive error message when reports directory is removed during test run  -  by @DaveT1991 and @AriPerkkio in #10117 (14133)
• snapshot: Increase default snapshot max output length  -  by @hi-ogawa and Codex in #10150 (21e66)
• ui: Fix jsx/tsx syntax highlight  -  by @hi-ogawa in #10152 (f1b1f)
• web-worker: Support MessagePort objects referenced inside postMessage data  -  by @whitphx and Claude Opus 4.6 (1M context) in #9927 and #10124 (7ad7d)
• api: Make test-specification options writable  -  by @sheremet-va in #10154 (6abd5)

    View changes on GitHub

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​vitest/pretty-format (indirect, 4.1.4 → 4.1.5) · Repo

Release Notes

4.1.5

   🚀 Experimental Features

• coverage: Istanbul to support instrumenter option  -  by @BartWaardenburg and @AriPerkkio in #10119 (0e0ff)

   🐞 Bug Fixes

• --project negation excludes browser instances  -  by @felamaslen in #10131 (9423d)
• Project color label on html reporter  -  by @hi-ogawa in #10142 (596f7)
• Fix vi.defineHelper called as object method  -  by @hi-ogawa in #10163 (122c2)
• Alias agent reporter to minimal  -  by @sheremet-va in #10157 (663b9)
• Respect diff config options in soft assertions  -  by @Copilot, sheremet-va and @sheremet-va in #8696 (9787d)
• Respect diff config options in soft assertions "  -  by @sheremet-va in #8696 (7dc6d)
• ast-collect: Recognize _vi_import prefix in static test discovery  -  by @Yejneshwar in #10129 (32546)
• coverage: Descriptive error message when reports directory is removed during test run  -  by @DaveT1991 and @AriPerkkio in #10117 (14133)
• snapshot: Increase default snapshot max output length  -  by @hi-ogawa and Codex in #10150 (21e66)
• ui: Fix jsx/tsx syntax highlight  -  by @hi-ogawa in #10152 (f1b1f)
• web-worker: Support MessagePort objects referenced inside postMessage data  -  by @whitphx and Claude Opus 4.6 (1M context) in #9927 and #10124 (7ad7d)
• api: Make test-specification options writable  -  by @sheremet-va in #10154 (6abd5)

    View changes on GitHub

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​vitest/runner (indirect, 4.1.4 → 4.1.5) · Repo

Release Notes

4.1.5

   🚀 Experimental Features

• coverage: Istanbul to support instrumenter option  -  by @BartWaardenburg and @AriPerkkio in #10119 (0e0ff)

   🐞 Bug Fixes

• --project negation excludes browser instances  -  by @felamaslen in #10131 (9423d)
• Project color label on html reporter  -  by @hi-ogawa in #10142 (596f7)
• Fix vi.defineHelper called as object method  -  by @hi-ogawa in #10163 (122c2)
• Alias agent reporter to minimal  -  by @sheremet-va in #10157 (663b9)
• Respect diff config options in soft assertions  -  by @Copilot, sheremet-va and @sheremet-va in #8696 (9787d)
• Respect diff config options in soft assertions "  -  by @sheremet-va in #8696 (7dc6d)
• ast-collect: Recognize _vi_import prefix in static test discovery  -  by @Yejneshwar in #10129 (32546)
• coverage: Descriptive error message when reports directory is removed during test run  -  by @DaveT1991 and @AriPerkkio in #10117 (14133)
• snapshot: Increase default snapshot max output length  -  by @hi-ogawa and Codex in #10150 (21e66)
• ui: Fix jsx/tsx syntax highlight  -  by @hi-ogawa in #10152 (f1b1f)
• web-worker: Support MessagePort objects referenced inside postMessage data  -  by @whitphx and Claude Opus 4.6 (1M context) in #9927 and #10124 (7ad7d)
• api: Make test-specification options writable  -  by @sheremet-va in #10154 (6abd5)

    View changes on GitHub

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​vitest/snapshot (indirect, 4.1.4 → 4.1.5) · Repo

Release Notes

4.1.5

   🚀 Experimental Features

• coverage: Istanbul to support instrumenter option  -  by @BartWaardenburg and @AriPerkkio in #10119 (0e0ff)

   🐞 Bug Fixes

• --project negation excludes browser instances  -  by @felamaslen in #10131 (9423d)
• Project color label on html reporter  -  by @hi-ogawa in #10142 (596f7)
• Fix vi.defineHelper called as object method  -  by @hi-ogawa in #10163 (122c2)
• Alias agent reporter to minimal  -  by @sheremet-va in #10157 (663b9)
• Respect diff config options in soft assertions  -  by @Copilot, sheremet-va and @sheremet-va in #8696 (9787d)
• Respect diff config options in soft assertions "  -  by @sheremet-va in #8696 (7dc6d)
• ast-collect: Recognize _vi_import prefix in static test discovery  -  by @Yejneshwar in #10129 (32546)
• coverage: Descriptive error message when reports directory is removed during test run  -  by @DaveT1991 and @AriPerkkio in #10117 (14133)
• snapshot: Increase default snapshot max output length  -  by @hi-ogawa and Codex in #10150 (21e66)
• ui: Fix jsx/tsx syntax highlight  -  by @hi-ogawa in #10152 (f1b1f)
• web-worker: Support MessagePort objects referenced inside postMessage data  -  by @whitphx and Claude Opus 4.6 (1M context) in #9927 and #10124 (7ad7d)
• api: Make test-specification options writable  -  by @sheremet-va in #10154 (6abd5)

    View changes on GitHub

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​vitest/spy (indirect, 4.1.4 → 4.1.5) · Repo

Release Notes

4.1.5

   🚀 Experimental Features

• coverage: Istanbul to support instrumenter option  -  by @BartWaardenburg and @AriPerkkio in #10119 (0e0ff)

   🐞 Bug Fixes

• --project negation excludes browser instances  -  by @felamaslen in #10131 (9423d)
• Project color label on html reporter  -  by @hi-ogawa in #10142 (596f7)
• Fix vi.defineHelper called as object method  -  by @hi-ogawa in #10163 (122c2)
• Alias agent reporter to minimal  -  by @sheremet-va in #10157 (663b9)
• Respect diff config options in soft assertions  -  by @Copilot, sheremet-va and @sheremet-va in #8696 (9787d)
• Respect diff config options in soft assertions "  -  by @sheremet-va in #8696 (7dc6d)
• ast-collect: Recognize _vi_import prefix in static test discovery  -  by @Yejneshwar in #10129 (32546)
• coverage: Descriptive error message when reports directory is removed during test run  -  by @DaveT1991 and @AriPerkkio in #10117 (14133)
• snapshot: Increase default snapshot max output length  -  by @hi-ogawa and Codex in #10150 (21e66)
• ui: Fix jsx/tsx syntax highlight  -  by @hi-ogawa in #10152 (f1b1f)
• web-worker: Support MessagePort objects referenced inside postMessage data  -  by @whitphx and Claude Opus 4.6 (1M context) in #9927 and #10124 (7ad7d)
• api: Make test-specification options writable  -  by @sheremet-va in #10154 (6abd5)

    View changes on GitHub

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​vitest/utils (indirect, 4.1.4 → 4.1.5) · Repo

Release Notes

4.1.5

   🚀 Experimental Features

• coverage: Istanbul to support instrumenter option  -  by @BartWaardenburg and @AriPerkkio in #10119 (0e0ff)

   🐞 Bug Fixes

• --project negation excludes browser instances  -  by @felamaslen in #10131 (9423d)
• Project color label on html reporter  -  by @hi-ogawa in #10142 (596f7)
• Fix vi.defineHelper called as object method  -  by @hi-ogawa in #10163 (122c2)
• Alias agent reporter to minimal  -  by @sheremet-va in #10157 (663b9)
• Respect diff config options in soft assertions  -  by @Copilot, sheremet-va and @sheremet-va in #8696 (9787d)
• Respect diff config options in soft assertions "  -  by @sheremet-va in #8696 (7dc6d)
• ast-collect: Recognize _vi_import prefix in static test discovery  -  by @Yejneshwar in #10129 (32546)
• coverage: Descriptive error message when reports directory is removed during test run  -  by @DaveT1991 and @AriPerkkio in #10117 (14133)
• snapshot: Increase default snapshot max output length  -  by @hi-ogawa and Codex in #10150 (21e66)
• ui: Fix jsx/tsx syntax highlight  -  by @hi-ogawa in #10152 (f1b1f)
• web-worker: Support MessagePort objects referenced inside postMessage data  -  by @whitphx and Claude Opus 4.6 (1M context) in #9927 and #10124 (7ad7d)
• api: Make test-specification options writable  -  by @sheremet-va in #10154 (6abd5)

    View changes on GitHub

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ rolldown (indirect, 1.0.0-rc.15 → 1.0.0-rc.16) · Repo · Changelog

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

Go to the Depfu Dashboard to see the state of your dependencies and to customize how Depfu works.

[sourcery-ai]

Hi @depfu[bot]! 👋

Your private repo does not have access to Sourcery.

Please upgrade to continue using Sourcery ✨

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Free

Run ID: 6afac3db-33f9-41c4-93a9-8f7adcb5cc8a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[deepsource-io]

DeepSource Code Review

We reviewed changes in 7259fad...79e6e41 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Apr 22, 2026 12:25p.m.	Review ↗
Secrets		Apr 22, 2026 12:25p.m.	Review ↗
Code coverage		Apr 22, 2026 12:25p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[github-actions]

Infisical secrets check: 🚨 Secrets leaked!

Caution

The Infisical CLI tool found secrets leaked in your repository.
Please review the scan results and take the necessary actions.
Secrets found: 6

💻 Scan logs

2026-04-22T12:25:52Z INF scanning for exposed secrets...
12:25PM INF 77 commits scanned.
2026-04-22T12:25:53Z INF scan completed in 349ms
2026-04-22T12:25:53Z WRN leaks found: 6

---

🔎 Detected secrets in your GIT history

RuleID	Commit	File	SymlinkFile	Secret	Match	StartLine	EndLine	StartColumn	EndColumn	Author	Message	Date	Email	Fingerprint	Tags	Link
generic-api-key	2e15220	src/pages/Integrations.tsx		REDACTED	"apiKey: ""REDACTED"""	12	12	8	43	deepsource-autofix[bot]	"style: format code with Prettier (#35)\n\nThis commit fixes the style issues introduced in f85b623 according to the output\nfrom Prettier.\n\nDetails: None\n\nCo-authored-by: deepsource-autofix[bot] <62050782+deepsource-autofix[bot]@users.noreply.github.com>\nCo-authored-by: gstraccini[bot] <150967461+gstraccini[bot]@users.noreply.github.com>\nCo-authored-by: Guilherme Branco Stracini guilherme@guilhermebranco.com.br"	2025-09-04T11:22:37Z	62050782+deepsource-autofix[bot]@users.noreply.github.com	2e15220:src/pages/Integrations.tsx:generic-api-key:12		gstraccini-bot-portal/src/pages/Integrations.tsx Line 12 in 2e15220 apiKey: "sonar_12345678901234567890",
generic-api-key	2e15220	src/mockData.ts		REDACTED	"apiKey: ""REDACTED"""	505	505	6	41	deepsource-autofix[bot]	"style: format code with Prettier (#35)\n\nThis commit fixes the style issues introduced in f85b623 according to the output\nfrom Prettier.\n\nDetails: None\n\nCo-authored-by: deepsource-autofix[bot] <62050782+deepsource-autofix[bot]@users.noreply.github.com>\nCo-authored-by: gstraccini[bot] <150967461+gstraccini[bot]@users.noreply.github.com>\nCo-authored-by: Guilherme Branco Stracini guilherme@guilhermebranco.com.br"	2025-09-04T11:22:37Z	62050782+deepsource-autofix[bot]@users.noreply.github.com	2e15220:src/mockData.ts:generic-api-key:505		gstraccini-bot-portal/src/mockData.ts Line 505 in 2e15220 apiKey: "sonar_12345678901234567890",
generic-api-key	2e15220	src/pages/RepositoryDetail.tsx		REDACTED	"apiKey: ""REDACTED"""	124	124	8	43	deepsource-autofix[bot]	"style: format code with Prettier (#35)\n\nThis commit fixes the style issues introduced in f85b623 according to the output\nfrom Prettier.\n\nDetails: None\n\nCo-authored-by: deepsource-autofix[bot] <62050782+deepsource-autofix[bot]@users.noreply.github.com>\nCo-authored-by: gstraccini[bot] <150967461+gstraccini[bot]@users.noreply.github.com>\nCo-authored-by: Guilherme Branco Stracini guilherme@guilhermebranco.com.br"	2025-09-04T11:22:37Z	62050782+deepsource-autofix[bot]@users.noreply.github.com	2e15220:src/pages/RepositoryDetail.tsx:generic-api-key:124		gstraccini-bot-portal/src/pages/RepositoryDetail.tsx Line 124 in 2e15220 apiKey: "sonar_12345678901234567890",
generic-api-key	2e15220	src/pages/RepositoryDetail.tsx		REDACTED	"apiKey: ""REDACTED"""	160	160	8	44	deepsource-autofix[bot]	"style: format code with Prettier (#35)\n\nThis commit fixes the style issues introduced in f85b623 according to the output\nfrom Prettier.\n\nDetails: None\n\nCo-authored-by: deepsource-autofix[bot] <62050782+deepsource-autofix[bot]@users.noreply.github.com>\nCo-authored-by: gstraccini[bot] <150967461+gstraccini[bot]@users.noreply.github.com>\nCo-authored-by: Guilherme Branco Stracini guilherme@guilhermebranco.com.br"	2025-09-04T11:22:37Z	62050782+deepsource-autofix[bot]@users.noreply.github.com	2e15220:src/pages/RepositoryDetail.tsx:generic-api-key:160		gstraccini-bot-portal/src/pages/RepositoryDetail.tsx Line 160 in 2e15220 apiKey: "codacy_12345678901234567890",
generic-api-key	2e15220	src/pages/RepositoryDetail.tsx		REDACTED	"apiKey: ""REDACTED"""	178	178	8	42	deepsource-autofix[bot]	"style: format code with Prettier (#35)\n\nThis commit fixes the style issues introduced in f85b623 according to the output\nfrom Prettier.\n\nDetails: None\n\nCo-authored-by: deepsource-autofix[bot] <62050782+deepsource-autofix[bot]@users.noreply.github.com>\nCo-authored-by: gstraccini[bot] <150967461+gstraccini[bot]@users.noreply.github.com>\nCo-authored-by: Guilherme Branco Stracini guilherme@guilhermebranco.com.br"	2025-09-04T11:22:37Z	62050782+deepsource-autofix[bot]@users.noreply.github.com	2e15220:src/pages/RepositoryDetail.tsx:generic-api-key:178		gstraccini-bot-portal/src/pages/RepositoryDetail.tsx Line 178 in 2e15220 apiKey: "snyk_12345678901234567890",
generic-api-key	2e15220	src/pages/Settings.tsx		REDACTED	"apiKey: ""REDACTED"""	127	127	8	43	deepsource-autofix[bot]	"style: format code with Prettier (#35)\n\nThis commit fixes the style issues introduced in f85b623 according to the output\nfrom Prettier.\n\nDetails: None\n\nCo-authored-by: deepsource-autofix[bot] <62050782+deepsource-autofix[bot]@users.noreply.github.com>\nCo-authored-by: gstraccini[bot] <150967461+gstraccini[bot]@users.noreply.github.com>\nCo-authored-by: Guilherme Branco Stracini guilherme@guilhermebranco.com.br"	2025-09-04T11:22:37Z	62050782+deepsource-autofix[bot]@users.noreply.github.com	2e15220:src/pages/Settings.tsx:generic-api-key:127		gstraccini-bot-portal/src/pages/Settings.tsx Line 127 in 2e15220 apiKey: "sonar_12345678901234567890",

Warning

The above table only displays the first 10 leaked secrets.
You can find the full report here: secrets.csv

---

🐾 Secrets fingerprint

2e1522054d3009edd4cc682e479341776b266eb0:src/pages/Integrations.tsx:generic-api-key:12
2e1522054d3009edd4cc682e479341776b266eb0:src/mockData.ts:generic-api-key:505
2e1522054d3009edd4cc682e479341776b266eb0:src/pages/RepositoryDetail.tsx:generic-api-key:124
2e1522054d3009edd4cc682e479341776b266eb0:src/pages/RepositoryDetail.tsx:generic-api-key:160
2e1522054d3009edd4cc682e479341776b266eb0:src/pages/RepositoryDetail.tsx:generic-api-key:178
2e1522054d3009edd4cc682e479341776b266eb0:src/pages/Settings.tsx:generic-api-key:127

Tip

If you want to ignore these leaked secrets, add the above fingerprint content to a file named .infisicalignore at the repository root level.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vitest@​4.1.4 ⏵ 4.1.5	+1		+1	+2
	@​vitest/​coverage-v8@​4.1.4 ⏵ 4.1.5				+1

View full report

[socket-security]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		Potential code anomaly (AI signal): npm @rolldown/binding-wasm32-wasi is 100.0% likely to have a medium risk anomaly Notes: The JS loader is not itself executing obvious malicious JavaScript (no eval, no external network calls, no hard-coded credentials). However it intentionally grants a WebAssembly module broad privileges: it passes the full process.env into WASI and the worker, and preopens the host filesystem root so the wasm can access the filesystem. It also forwards worker messages into a filesystem proxy function. These design choices make running an untrusted or tampered-with wasm binary dangerous: a malicious wasm could read environment variables, enumerate and modify host files, and exfiltrate data via any network capability inside the wasm or worker. Therefore the module should be treated as high-risk if the wasm artifact (local file or npm package) is not from a trusted source. Recommended mitigations: avoid preopening the root (limit to specific directories), avoid passing full process.env, validate integrity of the wasm binary (signing/checksums), and avoid installing untrusted package replacements. Confidence: 1.00 Severity: 0.60 From: package-lock.json → npm/vitest@4.1.5 → npm/@rolldown/binding-wasm32-wasi@1.0.0-rc.16 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@rolldown/binding-wasm32-wasi@1.0.0-rc.16. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm @rolldown/binding-wasm32-wasi is 100.0% likely to have a medium risk anomaly Notes: This loader establishes a Node.js WASI/worker environment that: 1) passes the entire host process.env into the WASI instance (exposing all environment variables, including secrets, to loaded modules); 2) preopens the filesystem root (granting broad file read/write access under the host’s root directory); and 3) implements importScripts via synchronous fs.readFileSync + eval (allowing any local JS file to be executed in the loader context). If an untrusted or compromised WASM module or script is provided, it can read sensitive environment variables, access or modify arbitrary files, and execute arbitrary JavaScript—posing a moderate security risk. Recommended mitigations: restrict WASI preopens to a minimal directory, limit or sanitize environment variables passed into WASI, and replace or sandbox the eval-based importScripts mechanism. Confidence: 1.00 Severity: 0.60 From: package-lock.json → npm/vitest@4.1.5 → npm/@rolldown/binding-wasm32-wasi@1.0.0-rc.16 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@rolldown/binding-wasm32-wasi@1.0.0-rc.16. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: npm @vitest/expect URLs: Object.is, https://github.com/jestjs/jest/blob/905bcbced3d40cdf7aadc4cdf6fb731c4bb3dbe3/packages/expect-utils/src/utils.ts#L509, http://underscorejs.org, https://nodejs.org/docs/latest-v22.x/api/assert.html#comparison-details, https://github.com/facebook/immutable-js, https://github.com/chaijs/loupe/blob/9b8a6deabcd50adc056a64fb705896194710c5c6/src/index.ts#L29, https://github.com/microsoft/TypeScript/issues/61068, https://github.com/vitest-dev/vitest/issues/6618 Location: Package overview From: package-lock.json → npm/vitest@4.1.5 → npm/@vitest/expect@4.1.5 ℹ Read more on: This package | This alert | What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@vitest/expect@4.1.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: npm @vitest/mocker URLs: https://vitest.dev/guide/mocking/modules#how-it-works, https://vitest.dev/api/vi.html#vi-mock, https://github.com/stacktracejs/error-stack-parser Location: Package overview From: package-lock.json → npm/vitest@4.1.5 → npm/@vitest/mocker@4.1.5 ℹ Read more on: This package | This alert | What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@vitest/mocker@4.1.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: npm @vitest/runner URLs: fixture.name, https://vitest.dev/guide/test-context#suite-level-hooks, https://esbuild.github.io/try/#YgAwLjI0LjAALS1zdXBwb3J0ZWQ6YXN5bmMtYXdhaXQ9ZmFsc2UAZQBlbnRyeS50cwBjb25zdCBvID0gewogIGYxOiBhc3luYyAoKSA9PiB7fSwKICBmMjogYXN5bmMgKGEpID0+IHt9LAogIGYzOiBhc3luYyAoYSwgYikgPT4ge30sCiAgZjQ6IGFzeW5jIGZ1bmN0aW9uKGEpIHt9LAogIGY1OiBhc3luYyBmdW5jdGlvbiBmZihhKSB7fSwKICBhc3luYyBmNihhKSB7fSwKCiAgZzE6IGFzeW5jICgpID0+IHt9LAogIGcyOiBhc3luYyAoeyBhIH0pID0+IHt9LAogIGczOiBhc3luYyAoeyBhIH0sIGIpID0+IHt9LAogIGc0OiBhc3luYyBmdW5jdGlvbiAoeyBhIH0pIHt9LAogIGc1OiBhc3luYyBmdW5jdGlvbiBnZyh7IGEgfSkge30sCiAgYXN5bmMgZzYoeyBhIH0pIHt9LAoKICBoMTogYXN5bmMgKCkgPT4ge30sCiAgLy8gY29tbWVudCBiZXR3ZWVuCiAgaDI6IGFzeW5jIChhKSA9PiB7fSwKfQ, https://vitest.dev/guide/test-tags, https://github.com/vitest-dev/vitest/issues, https://github.com/unocss/unocss/blob/2e74b31625bbe3b9c8351570749aa2d3f799d919/packages/autocomplete/src/parse.ts#L11, vitest.test.id, vitest.test.name, vitest.suite.id, vitest.suite.name, https://vitest.dev/advanced/runner#your-task-function, https://developer.mozilla.org/en-US/docs/Web/API/AbortSignal, https://vitest.dev/guide/test-context#signal, https://vitest.dev/guide/test-context#ontestfailed, https://vitest.dev/guide/test-context#ontestfinished, https://vitest.dev/guide/test-context#skip, https://vitest.dev/guide/test-context#annotate, https://vitest.dev/config/api#api-allowwrite, https://vitest.dev/config/browser/api#api-allowwrite Location: Package overview From: package-lock.json → npm/vitest@4.1.5 → npm/@vitest/runner@4.1.5 ℹ Read more on: This package | This alert | What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@vitest/runner@4.1.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: npm @vitest/spy URLs: https://vitest.dev/api/mock#mock-invocationcallorder, https://vitest.dev/api/mock#mock-results, https://vitest.dev/api/mock#mock-settledresults, https://vitest.dev/guide/browser/#limitations, https://vitest.dev/api/vi#vi-spyon, https://vitest.dev/api/mock#class-support Location: Package overview From: package-lock.json → npm/vitest@4.1.5 → npm/@vitest/spy@4.1.5 ℹ Read more on: This package | This alert | What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@vitest/spy@4.1.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm rolldown is 100.0% likely to have a medium risk anomaly Notes: Overall, this module behaves like a native-binding loader for rolldown. The most meaningful security concerns are (1) environment-variable-driven dynamic requiring of an arbitrary path (NAPI_RS_NATIVE_LIBRARY_PATH) and (2) a WebContainer fallback that can run pnpm to download/install a WASI binding into /tmp and then require it. While there is no direct evidence of classic malware behaviors (exfiltration, reverse shell, persistence) within this fragment, these mechanisms expand the attack surface if the environment or runtime installation process is attacker-influenced. Confidence: 1.00 Severity: 0.60 From: package-lock.json → npm/vitest@4.1.5 → npm/rolldown@1.0.0-rc.16 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rolldown@1.0.0-rc.16. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: npm rolldown URLs: https://rollupjs.org/plugin-development/#generatebundle:~:text=DANGER,this.emitFile., Function.prototype.name, Class.prototype.name, https://github.com/webpack/enhanced-resolve#resolver-options, https://webpack.js.org/configuration/resolve/, https://github.com/defunctzombie/package-browser-field-spec, https://github.com/webpack/enhanced-resolve/pull/285, https://webpack.js.org/configuration/module/#resolvefullyspecified, https://nodejs.org/api/module.html#modulebuiltinmodules, https://github.com/vitejs/vite/pull/20252, https://github.com/nodejs/node/issues/58827, https://nodejs.org/docs/latest/api/esm.html#resolution-algorithm-specification, https://github.com/dividab/tsconfig-paths-webpack-plugin#options, https://www.typescriptlang.org/tsconfig/#experimentalDecorators, https://www.typescriptlang.org/tsconfig/#emitDecoratorMetadata, https://www.typescriptlang.org/tsconfig/#stripInternal, https://oxc.rs/docs/guide/usage/transformer/jsx, https://github.com/facebook/react/tree/v18.3.1/packages/react-refresh, https://oxc.rs/docs/guide/usage/transformer/plugins#styled-components, https://oxc.rs/docs/guide/usage/transformer/typescript, https://oxc.rs/docs/guide/usage/transformer/lowering#target, https://oxc.rs/docs/guide/usage/transformer/global-variable-replacement#define, https://oxc.rs/docs/guide/usage/transformer/global-variable-replacement#inject, https://oxc.rs/docs/guide/usage/transformer/plugins, https://www.typescriptlang.org/docs/handbook/release-notes/typescript-5-5.html#isolated-declarations, https://www.typescriptlang.org/tsconfig/#declaration, https://github.com/npm/cli/issues/4828, output.name, https://rolldown.rs/., https://github.com/streamich/memfs, https://developer.mozilla.org/en-US/docs/Glossary/IIFE, https://github.com/umdjs/umd, https://github.com/tc39/ecma426/blob/main/proposals/debug-id.md, https://cdn.jsdelivr.net/npm/d3@7, comments.legal, https://rolldown.rs/in-depth/directives, https://rolldown.rs/guide/troubleshooting#avoiding-direct-eval, https://rolldown.rs/reference/OutputOptions.globals, https://rolldown.rs/reference/OutputOptions.name, https://rolldown.rs/reference/OutputOptions.exports, https://rolldown.rs/in-depth/non-esm-output-formats#import-meta, https://rolldown.rs/reference/OutputOptions.cleanDir, https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/Property_accessors, https://oxc.rs/docs/guide/usage/transformer/global-variable-replacement.html#inject, https://rolldown.rs/apis/plugin-api/hook-filters, https://rolldown.rs/apis/plugin-api/inter-plugin-communication#custom-resolver-options, https://oxc.rs/docs/guide/usage/minifier/dead-code-elimination#define-pure-functions, https://oxc.rs/docs/guide/usage/minifier/dead-code-elimination#ignoring-global-variable-access-side-effects, https://oxc.rs/docs/guide/usage/minifier/dead-code-elimination#ignoring-invalid-import-statement-side-effects, exports.property, https://rolldown.rs/apis/plugin-api, https://api.example.com, https://esbuild.github.io/api/#loader, https://rolldown.rs/in-depth/module-types, https://github.com/rolldown/rolldown/issues/7258, https://github.com/rolldown/rolldown/tree/main/examples/native-magic-string, https://rolldown.rs/in-depth/lazy-barrel-optimization Location: Package overview From: package-lock.json → npm/vitest@4.1.5 → npm/rolldown@1.0.0-rc.16 ℹ Read more on: This package | This alert | What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rolldown@1.0.0-rc.16. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: npm vite URLs: https://vite.dev/config/server-options.html#server-hmr, http://vite.dev, https://example.com, https://html.spec.whatwg.org/multipage/parsing.html#named-character-reference-state, http://www.w3.org/1999/xhtml, http://www.w3.org/1998/Math/MathML, http://www.w3.org/2000/svg, http://www.w3.org/1999/xlink, http://www.w3.org/XML/1998/namespace, http://www.w3.org/2000/xmlns/, https://dom.spec.whatwg.org/#concept-document-limited-quirks, http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd, https://en.wikipedia.org/wiki/Combining_Diacritical_Marks, https://en.wikipedia.org/wiki/Combining_Diacritical_Marks_for_Symbols, https://mathiasbynens.be/notes/javascript-unicode, http://eev.ee/blog/2015/09/12/dark-corners-of-unicode/, https://en.wikipedia.org/wiki/CamelCase, https://en.wikipedia.org/wiki/Latin-1_Supplement_, https://en.wikipedia.org/wiki/Latin_Extended-A, _.map, https://github.com/rollup/plugins/tree/master/packages/alias#entries, https://github.com/micromatch/anymatch, https://nodejs.org/api/fs.html#fs_class_fs_stats, example.com, foo.example.com, foo.bar.example.com, http://jsonplaceholder.typicode.com, https://github.com/SuperchupuDev/tinyglobby, https://esbuild.github.io/api/#target, https://esbuild.github.io/content-types/#javascript, license.md, https://rollupjs.org/configuration-options/#watch, http://127.0.0.1:8080, config.server.watch, server.environments.client.hot, import.meta.hot, 127.0.0.1, 0.0.0.0 Location: Package overview From: package-lock.json → npm/vitest@4.1.5 → npm/vite@8.0.9 ℹ Read more on: This package | This alert | What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/vite@8.0.9. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: npm vitest URLs: https://html.spec.whatwg.org/#document, https://www.w3.org/TR/DOM-Level-2-HTML/html.html#ID-26809268, https://html.spec.whatwg.org/multipage/webappapis.html#pluginarray, https://html.spec.whatwg.org/#htmltabledatacellelement, https://www.w3.org/TR/DOM-Level-2-HTML/html.html#ID-82915075, https://html.spec.whatwg.org/#htmltableheadercellelement, http://www.ecma-international.org/ecma-262/6.0/index.html#sec-promise.prototype-@@tostringtag, http://www.ecma-international.org/ecma-262/6.0/index.html#sec-%mapiteratorprototype%-@@tostringtag, http://www.ecma-international.org/ecma-262/6.0/index.html#sec-%arrayiteratorprototype%-@@tostringtag, https://heycam.github.io/webidl/#abstract-opdef-converttoint, https://github.com/sinonjs/sinon/issues/1852#issuecomment-419622780, https://developer.mozilla.org/en-US/docs/Web/API/setTimeout#reasons_for_delays_longer_than_specified, https://stackblitz.com/edit/stackblitz-starters-qtlpcc, https://github.com/sinonjs/fake-timers/issues/250, https://vitest.dev/guide/snapshot.html#custom-snapshot-matchers, 0.0.0.0, process.env.CI, https://vitest.dev/config/coverage#coverage-reporter, https://github.com/istanbuljs/nyc#coverage-thresholds, https://github.com/istanbuljs/nyc#ignoring-methods, https://vitest.dev/guide/coverage#custom-coverage-provider, https://en.wikipedia.org/wiki/Random_seed, https://vitest.dev/config/sequence#sequence-hooks, 127.0.0.1:9229, https://vitest.dev/guide/test-tags#syntax, https://github.com/spf13/cobra/issues/1279, task.name, https://vitest.dev/guide/coverage.html#including-and-excluding-files-from-coverage-report, https://istanbul.js.org/docs/advanced/alternative-reporters/, https://vitest.dev/api/advanced/vitest#getsourcemodulediagnostic, https://trace.playwright.dev/, https://vitest.dev/api/browser/commands, https://vitest.dev/config/onunhandlederror, https://vitest.dev/config/browser/screenshotdirectory, https://vitest.dev/config/root, https://vitest.dev/api/#test, https://vitest.dev/api/#describe, https://vitest.dev/config/attachmentsdir, https://superchupu.dev/tinyglobby/comparison, https://vitest.dev/config/include, https://nodejs.org/docs/latest/api/cli.html, https://github.com/nodejs/node/issues/41103, https://vitest.dev/guide/open-telemetry, https://vitest.dev/api/vi#vi-advancetimersbytime, performance.now, Date.now, https://vitest.dev/api/vi#vi-fn, https://vitest.dev/api/mock, https://vitest.dev/api/vi#vi-waitfor, https://vitest.dev/api/vi#vi-mock, https://github.com/vitejs/vite/pull/21585, https://github.com/nodejs/node/blob/7c3dce0/lib/internal/modules/package_json_reader.js, 127.0.0.1, https://vitest.dev/config/browser/api, https://vitest.dev/guide/migration#pool-rework, browser.name, https://vitest.dev/config/browser/provider, http://foo.com, http://foo.com/, https://github.com/vitejs/vite/blob/95020ab49e12d143262859e095025cf02423c1d9/packages/vite/src/node/server/middlewares/error.ts#L25-L36, https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#setting-an-error-message, https://github.com/actions/toolkit/blob/f1d9b4b985e6f0f728b4b766db73498403fd5ca3/packages/core/src/command.ts#L80-L85, https://github.com/, https://github.com/vitest-dev/vitest/issues, https://gist.github.com/john-doherty/b9195065884cdbfd2017a4756e6409cc, https://vitest.dev/guide/snapshot.html, builder.io/qwik, https://playwright.dev, https://webdriver.io, builder.io/qwik/optimizer, qwik.dev/core, https://vitest.dev/config/browser/playwright, https://vitest.dev/config/browser/webdriverio, https://nodejs.org/api/esm.html#https-and-http-imports, 127.0.0.0, https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/context/env-carriers.md, vitest.module.id, https://nodejs.org/api/modules.html#built-in-modules-with-mandatory-node-prefix, vitest.mock.id, vitest.fetched_module.id, https://github.com/vitejs/vite/issues/15438,, https://nodejs.org/api/process.html#signal-events, https://github.com/vitest-dev/vitest/issues/7871, vitest.worker.name, https://github.com/jestjs/jest/blob/25a8785584c9d54a05887001ee7f498d489a5441/packages/jest-worker/src/workers/ChildProcessWorker.ts#L463-L477, https://github.com/tinylibs/tinypool/blob/40b4b3eb926dabfbfd3d0a7e3d1222d4dd1c0d2d/src/runtime/process-worker.ts#L56, https://github.com/vitejs/vite/blob/af2aa09575229462635b7cbb6d248ca853057ba2/packages/vite/src/node/plugins/resolve.ts#L1056-L1080, https://github.com/STRML/async-limiter, https://github.com/nodejs/node/issues/8871#issuecomment-250915913, https://github.com/websockets/ws/issues/1202, https://www.cl.cam.ac.uk/%7Emgk25/ucs/utf8_check.c, https://tools.ietf.org/html/rfc6455#section-9.1, https://github.com/websockets/ws/issues/1869., https://github.com/websockets/ws/issues/1940., https://github.com/vitejs/vite/issues/14328, https://github.com/vitejs/vite/blob/main/packages/vite/src/node/logger.ts?rgh-link-date=2024-10-16T23%3A29%3A19Z, https://github.com/vitejs/vite/pull/15184, https://github.com/unjs/mlly/blob/c5bcca0cda175921344fd6de1bc0c499e73e5dac/src/syntax.ts#L51-L98, https://github.com/broofa/mime/blob/main/README.md#custom-mime-instances, https://vitest.dev/guide/projects, https://vitest.dev/guide/reporters.html#hanging-process-reporter, https://bugzilla.mozilla.org/show_bug.cgi?id=745678, http://en.wikipedia.org/wiki/Operator-precedence_parser, https://github.com/acornjs/acorn/issues/575, https://www.ecma-international.org/ecma-262/8.0/#prod-Pattern, https://www.ecma-international.org/ecma-262/8.0/#prod-Disjunction, https://www.ecma-international.org/ecma-262/8.0/#prod-Alternative, https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-Term, https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-Assertion, https://www.ecma-international.org/ecma-262/8.0/#prod-Quantifier, https://www.ecma-international.org/ecma-262/8.0/#prod-QuantifierPrefix, https://www.ecma-international.org/ecma-262/8.0/#sec-term, https://www.ecma-international.org/ecma-262/8.0/#prod-Atom, https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ExtendedAtom, https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-InvalidBracedQuantifier, https://www.ecma-international.org/ecma-262/8.0/#prod-SyntaxCharacter, https://www.ecma-international.org/ecma-262/8.0/#prod-PatternCharacter, https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ExtendedPatternCharacter, https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-AtomEscape, https://www.ecma-international.org/ecma-262/8.0/#sec-atomescape, https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-CharacterEscape, https://www.ecma-international.org/ecma-262/8.0/#prod-ControlEscape, https://www.ecma-international.org/ecma-262/8.0/#prod-ControlLetter, https://www.ecma-international.org/ecma-262/8.0/#prod-RegExpUnicodeEscapeSequence, https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-IdentityEscape, https://www.ecma-international.org/ecma-262/8.0/#prod-DecimalEscape, https://www.ecma-international.org/ecma-262/8.0/#prod-CharacterClassEscape, https://www.ecma-international.org/ecma-262/8.0/#prod-CharacterClass, https://tc39.es/ecma262/#prod-ClassContents, https://www.ecma-international.org/ecma-262/8.0/#prod-ClassRanges, https://www.ecma-international.org/ecma-262/8.0/#prod-NonemptyClassRanges, https://www.ecma-international.org/ecma-262/8.0/#prod-NonemptyClassRangesNoDash, https://www.ecma-international.org/ecma-262/8.0/#prod-ClassAtom, https://www.ecma-international.org/ecma-262/8.0/#prod-ClassAtomNoDash, https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ClassEscape, https://tc39.es/ecma262/#prod-ClassSetExpression, https://tc39.es/ecma262/#prod-ClassUnion, https://tc39.es/ecma262/#prod-ClassIntersection, https://tc39.es/ecma262/#prod-ClassSubtraction, https://tc39.es/ecma262/#prod-ClassSetRange, https://tc39.es/ecma262/#prod-ClassSetOperand, https://tc39.es/ecma262/#prod-NestedClass, https://tc39.es/ecma262/#prod-ClassStringDisjunction, https://tc39.es/ecma262/#prod-ClassStringDisjunctionContents, https://tc39.es/ecma262/#prod-ClassString, https://tc39.es/ecma262/#prod-NonEmptyClassString, https://tc39.es/ecma262/#prod-ClassSetCharacter, https://tc39.es/ecma262/#prod-ClassSetReservedDoublePunctuator, https://tc39.es/ecma262/#prod-ClassSetSyntaxCharacter, https://tc39.es/ecma262/#prod-ClassSetReservedPunctuator, https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ClassControlLetter, https://www.ecma-international.org/ecma-262/8.0/#prod-HexEscapeSequence, https://www.ecma-international.org/ecma-262/8.0/#prod-DecimalDigits, https://www.ecma-international.org/ecma-262/8.0/#prod-HexDigits, https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-LegacyOctalEscapeSequence, https://www.ecma-international.org/ecma-262/8.0/#prod-OctalDigit, https://www.ecma-international.org/ecma-262/8.0/#prod-Hex4Digits, https://www.ecma-international.org/ecma-262/8.0/#prod-HexDigit, https://github.com/estree/estree/blob/a27003adf4fd7bfad44de9cef372a2eacd527b1c/es5.md#regexpliteral, http://marijnhaverbeke.nl/git/acorn, https://github.com/acornjs/acorn.git, https://github.com/acornjs/acorn/issues, https://github.com/vitejs/vite/pull/20449, vitest.runtime.run, vitest.worker.id Location: Package overview From: package-lock.json → npm/vitest@4.1.5 ℹ Read more on: This package | This alert | What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/vitest@4.1.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[guibranco]

Automatically approved by gstraccini[bot]

[guibranco]

@depfu merge