Repository navigation
Update dependency vitest to v4.1.11 [SECURITY] (2.x) - #702
renovate[bot] wants to merge 1 commit into
Conversation
|
Code ReviewRisk: Medium — issues that should be addressed before merge. Updates the eslint plugin package's direct Vitest development dependency from 4.1.2 to 4.1.11. The lockfile was not regenerated, so the security update is not reproducible through the repository's locked installation. 1 issue found:
Still open from earlier reviews (1 finding):
Review usage: 40,457 in (31,116 cached) / 891 out tokens — $0.0040 (openrouter/openai/gpt-5.6-luna, thinking: low) Reviewed by @weareikko/code-review v0.11.1 for commit d6c683e. Previous review runsPrevious run archived 2026-11-03T04:16:06ZCode ReviewRisk: Medium — issues that should be addressed before merge. This MR updates the eslint plugin package's Vitest development dependency from 4.1.2 to 4.1.11. The corresponding lockfile entry and related Vitest packages remain at their previous versions, and other workspace test dependencies are not updated. 1 issue found:
Review usage: 40,709 in (31,328 cached) / 1,062 out tokens — $0.0042 (openrouter/openai/gpt-5.6-luna, thinking: low) Reviewed by @weareikko/code-review v0.11.1 for commit 16624a4. Previous run archived 2026-10-28T16:15:57ZCode ReviewRisk: Low — The dependency update is isolated to the ESLint plugin development toolchain and introduces no blocking issues. Updates the Review usage: 5,954 in (4,434 cached) / 259 out tokens — $0.0008 (openrouter/openai/gpt-5.6-luna, thinking: low) Reviewed by @weareikko/code-review v0.11.0 for commit ce86c2c. Previous run archived 2026-10-28T16:04:31ZCode ReviewRisk: Low — The dependency update is isolated to the ESLint plugin package and introduces no blocking issues. Updates the package's Vitest development dependency from Review usage: 5,949 in (4,428 cached) / 203 out tokens — $0.0007 (openrouter/openai/gpt-5.6-luna, thinking: low) Reviewed by @weareikko/code-review v0.10.3 for commit 74b15aa. Previous run archived 2026-10-15T19:25:04ZCode ReviewRisk: Low — no blocking issues; safe to merge aside from nits. Updates the Review usage: 8,702 in / 415 out tokens — $0.0027 (openrouter/openai/gpt-5.6-luna, thinking: low) Reviewed by @weareikko/code-review v0.10.3 for commit 2cf00fa. Previous run archived 2026-10-15T19:15:10ZCode ReviewRisk: Low — The dependency update is narrowly scoped and introduces no demonstrable defects; it is safe to merge. Updates the Review usage: 5,936 in / 245 out tokens — $0.0018 (openrouter/openai/gpt-5.6-luna, thinking: low) Reviewed by @weareikko/code-review v0.10.3 for commit 56c2dc5. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## 2.x #702 +/- ##
======================================
Coverage ? 86.42%
Complexity ? 145
======================================
Files ? 12
Lines ? 523
Branches ? 0
======================================
Hits ? 452
Misses ? 71
Partials ? 0
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
2cf00fa to
74b15aa
Compare
ce86c2c to
16624a4
Compare
renovate
Bot
changed the title
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| @@ -41,7 +41,7 @@ | |||
| "esbuild": "0.27.4", | |||
| "eslint": "9.34.0", | |||
There was a problem hiding this comment.
issue: Synchronize the lockfile with the Vitest update
package-lock.json still records packages/eslint-plugin-ui with vitest at 4.1.2, while this manifest requires 4.1.11. A clean npm ci installation therefore detects an out-of-sync workspace lockfile and fails. Regenerate and commit package-lock.json so it records Vitest 4.1.11 and its resolved dependency tree.
Confidence: high.
Reviewed by @weareikko/code-review v0.11.1 for commit 16624a4.
16624a4 to
d6c683e
Compare
| "eslint": "9.34.0", | ||
| "typescript": "6.0.2", | ||
| "vitest": "4.1.2" | ||
| "vitest": "4.1.11" |
There was a problem hiding this comment.
issue: Regenerate the lockfile for Vitest 4.1.11
package-lock.json still records packages/eslint-plugin-ui with vitest: 4.1.2 and resolves node_modules/vitest plus @vitest/mocker at 4.1.2. A locked install therefore retains the vulnerable version and does not apply the security update. Regenerate and commit package-lock.json so its workspace entry and resolved Vitest tree match 4.1.11.
Confidence: high.
Reviewed by @weareikko/code-review v0.11.1 for commit d6c683e.
This PR contains the following updates:
4.1.2→4.1.11Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock
CVE-2026-84373 / GHSA-82fw-gwwq-j7x9
More information
Details
Summary
@vitest/mockerregisters a redirect mock's target path without validating itagainst the dev server's file-serving allowlist. An attacker who can reach the
dev server's WebSocket can register a redirect mock pointing outside the project
root; when the mocked module is requested, the plugin's
loadhook returnsreadFile(<attacker path>)as the module source, disclosing local files.This is exploitable without authentication only through the public
mockerPlugin/ standaloneinterceptorPluginexports (used by third-party devservers), which register the handler on Vite's unauthenticated HMR socket.
Vitest's own browser mode registers mocks over a token-authenticated RPC and
is not remotely reachable by default (see Scope).
Affected code
packages/mocker/src/node/interceptorPlugin.ts.The
loadhook is the file-read sink:mock.redirectis derived from client input at registration time with noboundary check:
There is no
server.fs.allow/server.fs.denycheck and no assertion that theresolved path stays within the project root.
Registration paths and trust boundaries
mockerPlugin/interceptorPlugin(unauthenticated). InconfigureServer, the plugin registersserver.ws.on('vitest:interceptor:register', …)on Vite's HMR WebSocket. That socket performs no token, Origin, or same-origin
check, so any client that can reach it can register a redirect mock. This is
the path the "unauthenticated" impact applies to.
(
registerMock), which sits behind a per-run token (isValidApiRequest, arandom
api.token). The interceptor'sconfigureServersocket is not used forregistration here (in v5 it does not run at all, as the plugin is injected per
environment). The same missing boundary check exists on the authenticated RPC
path, but reaching it requires the token, so it is not a remote-unauthenticated
read.
Path handling
new URL(redirect).pathnamecombined withjoin(root, pathname)does notconfine reads to the root:
file:,http:) are normalized by WHATWG URL,so
..segments are collapsed and the result stays under the root. Payloads ofthe form
file:///../../etc/passwddo not escape...inpathname, sojoin(root, "../../…/etc/passwd")resolves outside the root and reads anarbitrary file.
Even without escaping the root, the missing
server.fscheck allows reading anyin-root file the dev server would otherwise refuse to serve (for example an
in-root
.envor source that is denied byserver.fs.deny).Scope / preconditions
localhostbydefault and is not reachable from the network unless the developer exposes it
(
server.host/0.0.0.0, a LAN bind, or a proxy).and CORS protections entirely and can both register the mock and read the
response.
by Vite defaults: the default CORS origin allowlist is limited to
localhostorigins, and
server.allowedHostsblocks DNS-rebinding, so a cross-origin pagecannot read the file contents back.
Impact
Disclosure of local files readable by the dev-server process (source, in-root
.env/secrets, and, via the opaque-scheme payload, files outside the projectroot). No integrity or availability impact.
Affected versions
Present since
@vitest/mockerwas introduced.@vitest/mocker>= 2.1.0 (shipped invitestand@vitest/browser>= 2.1.0), through 4.1.x and the 5.0.0 pre-releases.maintained and are not planned to receive the fix.
Fix
Validate the resolved redirect target against Vite's file-serving allowlist
(
isFileLoadingAllowed) before registering it, at every registration site, andstop registering the interceptor WebSocket events in Vitest's browser mode
(mocks there flow through the authenticated RPC).
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
vitest-dev/vitest (vitest)
v4.1.11Compare Source
🐞 Bug Fixes
View changes on GitHub
v4.1.10Compare Source
🐞 Bug Fixes
View changes on GitHub
v4.1.9Compare Source
🐞 Bug Fixes
importOriginalwith optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in #10546 (a5180)View changes on GitHub
v4.1.8Compare Source
🐞 Bug Fixes
cdpAPI whenallowWrite/allowExec: false[backport to v4] - by @hi-ogawa and Codex in #10450 (e4067)View changes on GitHub
v4.1.7Compare Source
🐞 Bug Fixes
View changes on GitHub
v4.1.6Compare Source
🐞 Bug Fixes
ToMatchScreenshotResolvePath- by @macarie and @sheremet-va in #10138 (31882)sequence.concurrent: truewith top-leveltest(..., { concurrent: false })+ depreactesequentialtest API and options - by @hi-ogawa, Codex and @sheremet-va in #10196 (2847d)🏎 Performance
View changes on GitHub
v4.1.5Compare Source
🚀 Experimental Features
instrumenteroption - by @BartWaardenburg and @AriPerkkio in #10119 (0e0ff)🐞 Bug Fixes
vi.defineHelpercalled as object method - by @hi-ogawa in #10163 (122c2)agentreporter tominimal- by @sheremet-va in #10157 (663b9)View changes on GitHub
v4.1.4Compare Source
🚀 Experimental Features
skipFullif agent detected - by @hi-ogawa in #10018 (53757)assertionas a public field - by @sheremet-va in #10095 (a120e)🐞 Bug Fixes
expect(..., message)consistent as error message prefix - by @hi-ogawa and Codex in #10068 (a1b5f)View changes on GitHub
v4.1.3Compare Source
🚀 Experimental Features
experimental.preParseflag - by @sheremet-va in #10070 (78273)browser.locators.exactoption - by @sheremet-va in #10013 (48799)TestAttachment.bodyEncoding- by @hi-ogawa in #9969 (89ca0)🐞 Bug Fixes
expect.pollinterval - by @hi-ogawa and Claude Sonnet 4.6 in #10022 (3f5bf)@vitest/coverage-v8and@vitest/coverage-istanbulas optional dependency - by @alan-agius4 in #10025 (146d4)defineHelperfor webkit async stack trace + update playwright 1.59.0 - by @hi-ogawa in #10036 (5a5fa)JestExtendError.contextfrom verbose error reporting - by @hi-ogawa in #9983 (66751)vitest- by @hi-ogawa and Codex in #10042 (691d3)View changes on GitHub
Configuration
📅 Schedule: (UTC)
* 0-3 * * 1)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.