Update dependency vitest to v4 [SECURITY]#779
Conversation
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a208dcc451
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| "size-limit": "^11.2.0", | ||
| "viem": "^2.33.2", | ||
| "vitest": "^3.1.3" | ||
| "vitest": "^4.0.0" |
There was a problem hiding this comment.
In the vitest workspaces, CI runs run test --coverage in .github/workflows/ci.yml lines 236-241, so this bump also needs the V8 coverage provider to be on Vitest 4. Yarn already reports the new vitest@4.1.8 peer request as unmet because these packages still install @vitest/coverage-v8@3.1.3 from yarn.lock; when the coverage job appends --coverage, Vitest loads that incompatible 3.x provider. Please bump @vitest/coverage-v8 to the matching 4.x range in core/actions/viem-account-ledger along with this Vitest major upgrade.
Useful? React with 👍 / 👎.
size-limit report 📦
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #779 +/- ##
==========================================
+ Coverage 69.61% 69.89% +0.28%
==========================================
Files 150 117 -33
Lines 7075 6156 -919
Branches 1163 1032 -131
==========================================
- Hits 4925 4303 -622
+ Misses 2080 1765 -315
- Partials 70 88 +18
🚀 New features to boost your workflow:
|
This PR contains the following updates:
^3.1.3→^4.0.0When Vitest UI server is listening, arbitrary file can be read and executed
CVE-2026-47429 / GHSA-5xrq-8626-4rwp
More information
Details
Summary
Arbitrary file can be read on Windows when Vitest UI server is listening, especially when exposed to the network.
Impact
Only users that match either of the following conditions are affected:
--api.hostorapi.hostconfig option)Details
The API handler for
/__vitest_attachment__uses the deprecatedisFileServingAllowedincorrectly.https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/ui/node/index.ts#L77
The function expects the passed value to use
cleanUrlafter the check before file system related operation.Because of this, it is possible to bypass the check by
\\?\\..\\. This is not possible on Linux as Linux errors if a directory named?does not exist.A similar problem exists in other places as well.
That said, this
isFileServingAllowedcheck does not actually prevent the API to be abused. Since the API has rerun feature and file write feature, it's possible to run arbitrary script by writing a script as a test file usingsaveTestFileand running it usingrerun. This means exposing the API / Vitest UI is equivalent to giving script execution access.On the browser mode side, there're
readFile/writeFile/saveSnapshotFile. So exposing the browser mode is equivalent to giving file read / write access.PoC
curl http://localhost:51204/__vitest__/curl "http://localhost:51204/__vitest_attachment__?path=C:\\path\\to\\project\\?\\..\\..\\secret.txt&contentType=text/plain&token=$TOKEN"(TOKEN is the API token)secret.txtthat is outside the project directoryMitigations
Vitest now ships two configuration flags,
allowWriteandallowExec, that gate the privileged operations exploited by this vulnerability. Both are disabled by default whenever the API server is bound to a non-localhosthost, ensuring that exposing the server to the network no longer implicitly grants write or execute capabilities to remote clients.When these flags are disabled, the UI also enters a read-only mode: in-browser code editing and test file execution are turned off, removing the attack surface that allowed remote code execution. Many Browser Mode features are also disabled, like attachments, artifacts or snapshots. See
browser.api.Users who require the full interactive UI on a networked host must explicitly opt in by setting
allowWriteand/orallowExectotrue.Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
vitest-dev/vitest (vitest)
v4.1.0Compare Source
Vitest 4.1 is out!
This release page lists all changes made to the project during the 4.1 beta. To get a review of all the new features, read our blog post.
🚀 Features
setTickModeto timer controls - by @atscott and @sheremet-va in #8726 (4b480)toTestSpecificationto reported tasks - by @sheremet-va in #9464 (1a470)vi.mockorvi.hoistedare declared outside of top level of the module - by @sheremet-va in #9387 (5db54)aroundEachandaroundAllhooks - by @sheremet-va in #9450 (2a8cb)neworallin--updateflag - by @sheremet-va in #9543 (a5acf)metain test options - by @sheremet-va in #9535 (7d622)test.extendsyntax - by @sheremet-va in #9550 (e5385)vitest listto statically collect tests instead of running files to collect them - by @sheremet-va in #9630 (7a8e7)--detect-async-leaks- by @AriPerkkio in #9528 (c594d)mockThrowandmockThrowOnce- by @thor-juhasz and @sheremet-va in #9512 (61917)update: "none"and add docs about snapshots behavior on CI - by @hi-ogawa in #9700 (05f18)launchOptionswithconnectOptions- by @hi-ogawa in #9702 (f0ff1)page/locator.markAPI to enhance playwright trace - by @hi-ogawa in #9652 (d0ee5)testinexperimental_parseSpecification- by @jgillick and Jeremy Gillick in #9235 (2f367)createSpecification- by @sheremet-va in #9336 (c8e6c)runTestFilesas alternative torunTestSpecifications- by @sheremet-va in #9443 (43d76)allowWriteandallowExecoptions toapi- by @sheremet-va in #9350 (20e00)toTestSpecification- by @sheremet-va in #9627 (6f17d)userEvent.wheelAPI - by @macarie in #9188 (66080)filterNodeoption to prettyDOM for filtering browser assertion error output - by @Copilot, sheremet-va and @sheremet-va in #9475 (d3220)detailsPanelPositionoption and button - by @shairez in #9525 (c8a31)findElementand enable strict mode in webdriverio and preview - by @sheremet-va in #9677 (c3f37)ignore start/stopignore hints - by @AriPerkkio in #9204 (e59c9)coverage.changedoption to report only changed files - by @kykim00 and @AriPerkkio in #9521 (1d939)onModuleRunnerhook toworker.init- by @sheremet-va in #9286 (e977f)importDurations: { limit, print }options - by @hi-ogawa, Claude Opus 4.6 and @sheremet-va in #9401 (7e10f)importDurations- by @hi-ogawa and Claude Opus 4.6 in #9533 (3f7a5)beforeAll/afterAll- by @sheremet-va in #9572 (c8339)agentreporter to reduce ai agent token usage - by @cpojer in #9779 (3e9e0)retryoptions - by @MazenSamehR, Matan Shavit, @AriPerkkio and @sheremet-va in #9370 (9e4cf)🐞 Bug Fixes
meta.urlincreateRequire- by @sheremet-va in #9441 (e3422)external/noExternalduringconfigEnvironmenthook - by @hi-ogawa and Claude Opus 4.6 in #9508 (59ea2)browser.isolateis used - by @sheremet-va in #9410 (3d48e)vi.mock({ spy: true })node v8 coverage - by @hi-ogawa, hi-ogawa and Claude Opus 4.6 in #9541 (687b6).namefrom statically collected test - by @sheremet-va in #9596 (b66ff)expect.soft- by @iumehara, @hi-ogawa and Claude Opus 4.6 in #9231 (3eb2c)sequence.shuffle.testsis enabled - by @kaigritun, Kai Gritun and @sheremet-va in #9576 (8182b)expect/src/utilsfromvitest- by @hi-ogawa in #9616 (48739)--detect-async-leaks- by @AriPerkkio in #9638 (9fd4c)aroundEach/Allwhen inneraroundEach/Allthrows - by @hi-ogawa in #9657 (4ec6c)aroundEach/Allsetup timed out - by @hi-ogawa in #9670 (bb013)VitestRunnerConfigoptional fields withSerializedConfig- by @hi-ogawa in #9661 (79520)toBe*spy assertions in favor oftoHaveBeen*(andtoThrowError) - by @sheremet-va in #9665 (4d390)aroundEach/Allerrors but aggregate them on runner - by @hi-ogawa in #9673 (b6365)resolves/rejectschained assertion error - by @hi-ogawa in #9679 (c6151)maxConcurrency- by @hi-ogawa in #9653 (16d13)resolve.conditionsfor externals - by @hi-ogawa in #9717 (1d498)mockObjectchange backwards compatible - by @sheremet-va in #9744 (84c69)URL.nameon jsdom - by @hi-ogawa in #9767 (031f3)vi.importActual()for virtual modules - by @hi-ogawa and Claude Opus 4.6 in #9772 (1e89e)FixtureAccessErrorif suite hook accesses undefined fixture - by @sheremet-va in #9786 (fc2ce)loadortransformoriginal module - by @hi-ogawa and Claude Opus 4.6 in #9774 (a8216)hideSkippedTestsshould not hidetest.todo- by @oilater in #9562 and #9781 (8181e)beforeEachhooks - by @hi-ogawa and Claude Opus 4.6 in #9826 (99e52)performance.nowto measure test timeout duration - by @hi-ogawa and Claude Opus 4.6 in #9795 (f48a6)toMatchScreenshotpasses - by @macarie in #9289 (46aab)toMatchScreenshot- by @macarie in #9552 (83ca0)--remote-debugging-addressfrom chrome args - by @hi-ogawa and @AriPerkkio in #9712 (f09bb)ensureAwaited- by @sheremet-va in #9732 (97685)getCDPSessionandcdp()- by @AriPerkkio in #9716 (689a2)deepEqualin the config because it's not serializable - by @sheremet-va in #9666 (9ee99)thresholds.autoUpdateto preserve ending whitespace - by @AriPerkkio in #9436 (7e534)/config/#optionhash links causing hydration errors - by @hi-ogawa, Claude Opus 4.6 and @sheremet-va in #9610 (a603c)toMatchObject(Map/Set)should expectMap/Seton left hand side - by @hi-ogawa and Claude Opus 4.6 in #9532 (381da)toThrowand make Error detection robust - by @hi-ogawa and Claude Opus 4.6 in #9570 (de215)dotreporter leaves pending tests - by @AriPerkkio in #9684 (4d793)undefined- by @sheremet-va in #9511 (6f181)bench.reportersno longer gives type errors when passing file name string paths - by @Bertie690 in #9695 (093c8)🏎 Performance
View changes on GitHub
v4.0.18Compare Source
🚀 Experimental Features
onModuleRunnerhook toworker.init- by @sheremet-va in #9286 (ea837)🐞 Bug Fixes
meta.urlincreateRequire- by @sheremet-va in #9441 (e0572)View changes on GitHub
v4.0.17Compare Source
🚀 Features
🐞 Bug Fixes
addEventHandler#9371 - by @ThibautMarechal in #9372 and #9371 (40841)process.envandimport.meta.envdefines in inline project - by @hi-ogawa in #9239 (b70c9)ErrorEvent.messagewhen unhandledErrorEvent.erroris null - by @hi-ogawa in #9322 (5d84e)fileParallelismon an instance - by @sheremet-va in #9328 (15006)istanbul-lib-source-mapsusage - by @AriPerkkio in #9344 (b0940)View changes on GitHub
v4.0.16Compare Source
🐞 Bug Fixes
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.