fix(security): bump vitest and @vitest/coverage-v8 together to ^3.2.6 - #14
Merged
Conversation
Clears GHSA-5xrq-8626-4rwp (CVSS 9.8), 'When Vitest UI server is listening, arbitrary file can be read and executed'. Development scope: it only bites when someone runs vitest --ui locally, it never ships. Patched because it is trivial and this single advisory accounts for 93 percent of the estate's critical count. Dependabot could not land this. It opens one PR for vitest and a separate one for @vitest/coverage-v8, and the two share a peer constraint, so neither merges alone (ERESOLVE). They have to move in lockstep. npm audit fix is applied on top because the vitest 3.x tree pulls in vulnerable js-yaml, which fails an 'npm audit --audit-level=high' CI gate. Verified in a clean-room checkout for THIS repo specifically: npm ci, then every script this repo defines among lint/typecheck/test/coverage/build/demo, then the audit gate. All green before this commit was created. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears GHSA-5xrq-8626-4rwp (CVSS 9.8).
Why Dependabot could not do this: it opens one PR for
vitestand a separate one for@vitest/coverage-v8. They share a peer constraint, so neither merges alone (ERESOLVE). They must move in lockstep. That is why the Dependabot PRs on this repo show red CI.npm audit fixis applied on top because the vitest 3.x tree pulls in vulnerablejs-yaml, which trips annpm audit --audit-level=highgate.Scope, stated honestly: this is a development dependency. The advisory only bites when someone runs
vitest --uilocally. It never ships. It is worth doing because it is trivial and because this one advisory is 93% of the estate's entire critical alert count.Verified in a clean-room checkout of this repo specifically:
npm ci, then every script this repo defines among lint/typecheck/test/coverage/build/demo, then the audit gate. All green before the commit was made. Remaining criticals after:0.🤖 Generated with Claude Code