chore(deps): update dependency vitest to v4 [security] by renovate[bot] · Pull Request #293 · Innei/bump-version

renovate · 2026-09-11T02:52:08Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
vitest (source)	`3.2.6` → `4.1.11`

Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

CVE-2026-84373 / GHSA-82fw-gwwq-j7x9

More information

Details

Summary

@vitest/mocker registers a redirect mock's target path without validating it
against the dev server's file-serving allowlist. An attacker who can reach the
dev server's WebSocket can register a redirect mock pointing outside the project
root; when the mocked module is requested, the plugin's load hook returns
readFile(<attacker path>) as the module source, disclosing local files.

This is exploitable without authentication only through the public
mockerPlugin / standalone interceptorPlugin exports (used by third-party dev
servers), which register the handler on Vite's unauthenticated HMR socket.
Vitest's own browser mode registers mocks over a token-authenticated RPC and
is not remotely reachable by default (see Scope).

Affected code

packages/mocker/src/node/interceptorPlugin.ts.

The load hook is the file-read sink:

if (mock.type === 'redirect') {
  return readFile(mock.redirect, 'utf-8')
}

mock.redirect is derived from client input at registration time with no
boundary check:

if (event.type === 'redirect') {
  const redirectUrl = new URL(event.redirect)
  event.redirect = join(server.config.root, redirectUrl.pathname)
}
registry.register(event)

There is no server.fs.allow / server.fs.deny check and no assertion that the
resolved path stays within the project root.

Registration paths and trust boundaries

Public mockerPlugin / interceptorPlugin (unauthenticated). In
configureServer, the plugin registers server.ws.on('vitest:interceptor:register', …)
on Vite's HMR WebSocket. That socket performs no token, Origin, or same-origin
check, so any client that can reach it can register a redirect mock. This is
the path the "unauthenticated" impact applies to.
Vitest browser mode (authenticated). Mocks register over the browser RPC
(registerMock), which sits behind a per-run token (isValidApiRequest, a
random api.token). The interceptor's configureServer socket is not used for
registration here (in v5 it does not run at all, as the plugin is injected per
environment). The same missing boundary check exists on the authenticated RPC
path, but reaching it requires the token, so it is not a remote-unauthenticated
read.

Path handling

new URL(redirect).pathname combined with join(root, pathname) does not
confine reads to the root:

Special/hierarchical schemes (file:, http:) are normalized by WHATWG URL,
so .. segments are collapsed and the result stays under the root. Payloads of
the form file:///../../etc/passwd do not escape.
A non-special (opaque) scheme preserves .. in pathname, so
join(root, "../../…/etc/passwd") resolves outside the root and reads an
arbitrary file.

Even without escaping the root, the missing server.fs check allows reading any
in-root file the dev server would otherwise refuse to serve (for example an
in-root .env or source that is denied by server.fs.deny).

Scope / preconditions

This is a development-server issue. The dev server binds to localhost by
default and is not reachable from the network unless the developer exposes it
(server.host / 0.0.0.0, a LAN bind, or a proxy).
A raw (non-browser) client against a reachable server bypasses browser origin
and CORS protections entirely and can both register the mock and read the
response.
A browser-based drive-by against a localhost server is substantially mitigated
by Vite defaults: the default CORS origin allowlist is limited to localhost
origins, and server.allowedHosts blocks DNS-rebinding, so a cross-origin page
cannot read the file contents back.

Impact

Disclosure of local files readable by the dev-server process (source, in-root
.env/secrets, and, via the opaque-scheme payload, files outside the project
root). No integrity or availability impact.

Affected versions

Present since @vitest/mocker was introduced.

Affected: @vitest/mocker >= 2.1.0 (shipped in vitest and
@vitest/browser >= 2.1.0), through 4.1.x and the 5.0.0 pre-releases.
Fixed: Vitest 4.1.11 and 5.0.0. Older majors (2.1.x, 3.x) are not
maintained and are not planned to receive the fix.

Fix

Validate the resolved redirect target against Vite's file-serving allowlist
(isFileLoadingAllowed) before registering it, at every registration site, and
stop registering the interceptor WebSocket events in Vitest's browser mode
(mocks there flow through the authenticated RPC).

Severity

CVSS Score: 5.9 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

vitest-dev/vitest (vitest)

`v4.1.11`

Compare Source

🐞 Bug Fixes

Revive global concurrency limit for test lifecycle [backport to v4] - by @sheremet-va and @hi-ogawa in #10992 (5146d)
browser:
- Encode iframeId in tester iframe URL [backport to v4] - by @sheremet-va, Pduhard and Claude Opus 4.8 in #10955 (10b2c)
- Trigger playwright/chromium gc on lower disk availability [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode in #10951 (9851d)
mocker:
- Restrict redirect mocks to the fs allowlist [backport to v4] - by @sheremet-va in #10974 (fe5a1)

View changes on GitHub

`v4.1.10`

Compare Source

🐞 Bug Fixes

browser: Check fs access in builtin commands [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in #10680 (5c18d)
vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4] - by @SveLil and @hi-ogawa in #10661 (bae52)

View changes on GitHub

`v4.1.9`

Compare Source

🐞 Bug Fixes

Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in #10546 (a5180)
browser:
- Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in #10555 (7fb29)
- Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in #10497 and #10556 (fbc62)
mocker:
- Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in #10548 (2c955)
pool:
- Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in #10543 and #10564 (934b0)

View changes on GitHub

`v4.1.8`

Compare Source

🐞 Bug Fixes

browser:
- Disable client cdp API when allowWrite/allowExec: false [backport to v4] - by @hi-ogawa and Codex in #10450 (e4067)
- Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4] - by @toxik and @Zelys-DFKH in #10474 (675b4)

View changes on GitHub

`v4.1.7`

Compare Source

🐞 Bug Fixes

runner: Limit concurrency per task branch in addition to per leaf callbacks (backport) - by @hi-ogawa in #10384 (4f0f2)

View changes on GitHub

`v4.1.6`

Compare Source

🐞 Bug Fixes

browser: Provide project reference in ToMatchScreenshotResolvePath - by @macarie and @sheremet-va in #10138 (31882)
Global sequence.concurrent: true with top-level test(..., { concurrent: false }) + depreacte sequential test API and options - by @hi-ogawa, Codex and @sheremet-va in #10196 (2847d)
browser: Simplify orchestrator otel carrier - by @hi-ogawa in #10285 (18af9)

🏎 Performance

Stringify diff objects only once - by @sheremet-va in #10276 (9f7b1)

View changes on GitHub

`v4.1.5`

Compare Source

🚀 Experimental Features

coverage: Istanbul to support instrumenter option - by @BartWaardenburg and @AriPerkkio in #10119 (0e0ff)

🐞 Bug Fixes

--project negation excludes browser instances - by @felamaslen in #10131 (9423d)
Project color label on html reporter - by @hi-ogawa in #10142 (596f7)
Fix vi.defineHelper called as object method - by @hi-ogawa in #10163 (122c2)
Alias agent reporter to minimal - by @sheremet-va in #10157 (663b9)
Respect diff config options in soft assertions - by @Copilot, sheremet-va and @sheremet-va in #8696 (9787d)
Respect diff config options in soft assertions " - by @sheremet-va in #8696 (7dc6d)
ast-collect: Recognize _vi_import prefix in static test discovery - by @Yejneshwar in #10129 (32546)
coverage: Descriptive error message when reports directory is removed during test run - by @DaveT1991 and @AriPerkkio in #10117 (14133)
snapshot: Increase default snapshot max output length - by @hi-ogawa and Codex in #10150 (21e66)
ui: Fix jsx/tsx syntax highlight - by @hi-ogawa in #10152 (f1b1f)
web-worker: Support MessagePort objects referenced inside postMessage data - by @whitphx and Claude Opus 4.6 (1M context) in #9927 and #10124 (7ad7d)
api: Make test-specification options writable - by @sheremet-va in #10154 (6abd5)

View changes on GitHub

`v4.1.4`

Compare Source

🚀 Features

coverage:
- Default to text reporter skipFull if agent detected - by @hi-ogawa in #10018 (53757)
experimental:
- Expose assertion as a public field - by @sheremet-va in #10095 (a120e)
- Support aria snapshot - by @hi-ogawa, Claude Opus 4.6 (1M context), @AriPerkkio, Codex and @sheremet-va in #9668 (d4fbb)
reporter:
- Add filterMeta option to json reporter - by @nami8824 and @sheremet-va in #10078 (b77de)

🐞 Bug Fixes

Use "black" foreground for labeled terminal message to ensure contrast - by @hi-ogawa in #10076 (203f0)
Make expect(..., message) consistent as error message prefix - by @hi-ogawa and Codex in #10068 (a1b5f)
Do not hoist imports whose names match class properties . - by @SunsetFi in #10093 and #10094 (0fc4b)
browser: Spread user server options into browser Vite server in project - by @GoldStrikeArch in #10049 (65c9d)

View changes on GitHub

`v4.1.3`

Compare Source

🚀 Experimental Features

Add experimental.preParse flag - by @sheremet-va in #10070 (78273)
Support browser.locators.exact option - by @sheremet-va in #10013 (48799)
Add TestAttachment.bodyEncoding - by @hi-ogawa in #9969 (89ca0)
Support custom snapshot matcher - by @hi-ogawa, Claude Sonnet 4.6 and Codex in #9973 (59b0e)

🐞 Bug Fixes

Advance fake timers with expect.poll interval - by @hi-ogawa and Claude Sonnet 4.6 in #10022 (3f5bf)
Add @vitest/coverage-v8 and @vitest/coverage-istanbul as optional dependency - by @alan-agius4 in #10025 (146d4)
Fix defineHelper for webkit async stack trace + update playwright 1.59.0 - by @hi-ogawa in #10036 (5a5fa)
Fix suite hook throwing errors for unused auto test-scoped fixture - by @hi-ogawa and Claude Sonnet 4.6 in #10035 (39865)
expect:
- Remove JestExtendError.context from verbose error reporting - by @hi-ogawa in #9983 (66751)
- Don't leak "runner" types - by @sheremet-va in #10004 (ec204)
snapshot:
- Fix flagging obsolete snapshots for snapshot properties mismatch - by @hi-ogawa and Claude Sonnet 4.6 in #9986 (6b869)
- Export custom snapshot matcher helper from vitest - by @hi-ogawa and Codex in #10042 (691d3)
ui:
- Don't leak vite types - by @sheremet-va in #10005 (fdff1)
vm:
- Fix external module resolve error with deps optimizer query - by @hi-ogawa and Claude Sonnet 4.6 in #10024 (9dbf4)

View changes on GitHub

`v4.1.2`

Compare Source

This release bumps Vitest's flatted version and removes version pinning to resolve flatted's CVE related issues (#9975).

🐞 Bug Fixes

Don't resolve setupFiles from parent directory - by @hi-ogawa in #9960 (7aa93)
Ensure sequential mock/unmock resolution - by @hi-ogawa and Claude Opus 4.6 in #9830 (7c065)
browser: Take failure screenshot if toMatchScreenshot can't capture a stable screenshot - by @macarie in #9847 (faace)
coverage: Correct coverageConfigDefaults values and types - by @Arthie in #9940 (b3c99)
pretty-format: Fix output limit over counting - by @hi-ogawa in #9965 (d3b7a)
Disable colors if agent is detected - by @sheremet-va and @AriPerkkio in #9851 (6f97b)

View changes on GitHub

`v4.1.1`

Compare Source

🚀 Features

experimental:
- Expose matchesTagsFilter to test if the current filter matches tags - by @sheremet-va in #9913 (eec53)
- Introduce experimental.vcsProvider - by @sheremet-va in #9928 (56115)

🐞 Bug Fixes

Mark TestProject.testFilesList internal properly - by @sapphi-red in #9867 (54f26)
Detect fixture that returns without calling use - by @oilater in #9831 and #9861 (633ae)
Drop vite 8.beta support - by @AriPerkkio in #9862 (b78f5)
Type regression in vi.mocked() static class methods - by @purepear and @hi-ogawa in #9857 (90926)
Properly re-evaluate actual modules of mocked external - by @hi-ogawa in #9898 (ae5ec)
Preserve coverage report when html reporter overlaps - by @hi-ogawa in #9889 (2d81a)
Provide vi.advanceTimers to the preview provider - by @sheremet-va in #9891 (1bc3e)
Don't leak event listener in playwright provider - by @sheremet-va in #9910 (d9355)
Open browser in --standalone mode without running tests - by @sheremet-va in #9911 (e78ad)
Guard disposable and optional body - by @sheremet-va in #9912 (6fdb2)
Resolve retry.condition RegExp serialization issue - by @nstepien and @hi-ogawa in #9942 (7b605)
collect:
- Don't treat extra props on test return as tests - by @sheremet-va in #9871 (141e7)
coverage:
- Simplify provider types - by @AriPerkkio in #9931 (aaf9f)
- Load built-in provider without module runner - by @AriPerkkio in #9939 (bf892)
expect:
- Soft assertions continue after .resolves/.rejects promise errors - by @mixelburg, Maks Pikov, Claude Opus 4.6 (1M context) and @hi-ogawa in #9843 (6d74b)
- Fix sinon-chai style API - by @hi-ogawa in #9943 (0f08d)
pretty-format:
- Limit output for large object - by @hi-ogawa and Claude Opus 4.6 (1M context) in #9949 (0d5f9)

View changes on GitHub

`v4.1.0`

Compare Source

Vitest 4.1 is out!

This release page lists all changes made to the project during the 4.1 beta. To get a review of all the new features, read our blog post.

🚀 Features

Return a disposable from doMock() - by @kirkwaiblinger in #9332 (e3e65)
Added chai style assertions - by @ronnakamoto and @sheremet-va in #8842 (841df)
Update to sinon/fake-timers v15 and add setTickMode to timer controls - by @atscott and @sheremet-va in #8726 (4b480)
Expose matcher types - by @sheremet-va in #9448 (3e4b9)
Add toTestSpecification to reported tasks - by @sheremet-va in #9464 (1a470)
Show a warning if vi.mock or vi.hoisted are declared outside of top level of the module - by @sheremet-va in #9387 (5db54)
Track and display expectedly failed tests (.fails) in UI and CLI - by @Copilot, sheremet-va and @sheremet-va in #9476 (77d75)
Support tags - by @sheremet-va in #9478 (de7c8)
Implement aroundEach and aroundAll hooks - by @sheremet-va in #9450 (2a8cb)
Stabilize experimental features - by @sheremet-va in #9529 (b5fd2)
Accept new or all in --update flag - by @sheremet-va in #9543 (a5acf)
Support meta in test options - by @sheremet-va in #9535 (7d622)
Support type inference with a new test.extend syntax - by @sheremet-va in #9550 (e5385)
Support vite 8 beta, fix type issues in the config with different vite versions - by @sheremet-va in #9587 (99028)
Add assertion helper to hide internal stack traces - by @hi-ogawa and Claude Opus 4.6 in #9594 (eeb0a)
Store failure screenshots using artifacts API - by @macarie in #9588 (24603)
Allow vitest list to statically collect tests instead of running files to collect them - by @sheremet-va in #9630 (7a8e7)
Add --detect-async-leaks - by @AriPerkkio in #9528 (c594d)
Implement mockThrow and mockThrowOnce - by @thor-juhasz and @sheremet-va in #9512 (61917)
Support update: "none" and add docs about snapshots behavior on CI - by @hi-ogawa in #9700 (05f18)
Support playwright launchOptions with connectOptions - by @hi-ogawa in #9702 (f0ff1)
Add page/locator.mark API to enhance playwright trace - by @hi-ogawa in #9652 (d0ee5)
api:
- Support tests starting or ending with test in experimental_parseSpecification - by @jgillick and Jeremy Gillick in #9235 (2f367)
- Add filters to createSpecification - by @sheremet-va in #9336 (c8e6c)
- Expose runTestFiles as alternative to runTestSpecifications - by @sheremet-va in #9443 (43d76)
- Add allowWrite and allowExec options to api - by @sheremet-va in #9350 (20e00)
- Allow passing down test cases to toTestSpecification - by @sheremet-va in #9627 (6f17d)
browser:
- Add userEvent.wheel API - by @macarie in #9188 (66080)
- Add filterNode option to prettyDOM for filtering browser assertion error output - by @Copilot, sheremet-va and @sheremet-va in #9475 (d3220)
- Support playwright persistent context - by @hi-ogawa, Claude Opus 4.6 and @sheremet-va in #9229 (f865d)
- Added detailsPanelPosition option and button - by @shairez in #9525 (c8a31)
- Use BlazeDiff instead of pixelmatch - by @macarie in #9514 (30936)
- Add findElement and enable strict mode in webdriverio and preview - by @sheremet-va in #9677 (c3f37)
cli:
- Add @bomb.sh/tab completions - by @AmirSa12 and @sheremet-va in #8639 (200f3)
coverage:
- Support ignore start/stop ignore hints - by @AriPerkkio in #9204 (e59c9)
- Add coverage.changed option to report only changed files - by @kykim00 and @AriPerkkio in #9521 (1d939)
experimental:
- Add onModuleRunner hook to worker.init - by @sheremet-va in #9286 (e977f)
- Option to disable the module runner - by @sheremet-va and @AriPerkkio in #9210 (9be61)
- Add importDurations: { limit, print } options - by @hi-ogawa, Claude Opus 4.6 and @sheremet-va in #9401 (7e10f)
- Add print and fail thresholds for importDurations - by @hi-ogawa and Claude Opus 4.6 in #9533 (3f7a5)
fixtures:
- Pass down file context to beforeAll/afterAll - by @sheremet-va in #9572 (c8339)
reporters:
- Add agent reporter to reduce ai agent token usage - by @cpojer in #9779 (3e9e0)
runner:
- Enhance retry options - by @MazenSamehR, Matan Shavit, @AriPerkkio and @sheremet-va in #9370 (9e4cf)
ui:
- Allow run individual test/suites - by @userquin in #9465 (73b10)
- Add project filter/sort support - by @userquin in #8689 (0c7ea)
- Add duration sorting to explorer - by @julianhahn and @cursoragent in #9603 (209b1)
- Implement filter for slow tests - by @DerYeger and @userquin in #9705 (8880c)
vitest:
- Add run summary in GitHub Actions Reporter - by @macarie and jhnance in #9579 (96bfc)

🐞 Bug Fixes

Deprecate several vitest/* entry points - by @sheremet-va in #9347 (fd459)
Use meta.url in createRequire - by @sheremet-va in #9441 (e3422)
Preact browser mode init example of render function not async - by @WuMingDao in #9375 (2bea5)
Deprecate unused types in matcher context - by @sheremet-va in #9449 (20f87)
Handle external/noExternal during configEnvironment hook - by @hi-ogawa and Claude Opus 4.6 in #9508 (59ea2)
Replace default ssr environment runner with Vitest server module runner - by @hi-ogawa and Claude Opus 4.6 in #9506 (cd5db)
Propagate experimental CLI options to child projects - by @hi-ogawa and Claude Opus 4.6 in #9531 (b624f)
Show a warning when browser.isolate is used - by @sheremet-va in #9410 (3d48e)
Fix vi.mock({ spy: true }) node v8 coverage - by @hi-ogawa, hi-ogawa and Claude Opus 4.6 in #9541 (687b6)
Don't show internal ssr handler in errors - by @sheremet-va in #9547 (76c43)
Close vitest if it failed to start - by @sheremet-va in #9573 (728ba)
Fix ssr environment runner in project - by @hi-ogawa in #9584 (09006)
Trim trailing white spaces in code block - by @hi-ogawa in #9591 (f78be)
Support inline snapshot inside test.for/each - by @hi-ogawa in #9590 (615fd)
Apply source maps for external module stack trace - by @hi-ogawa in #9152 (79e20)
Remove the .name from statically collected test - by @sheremet-va in #9596 (b66ff)
Don't suppress warnings on pnp - by @sheremet-va in #9602 (89cbd)
Support snapshot with expect.soft - by @iumehara, @hi-ogawa and Claude Opus 4.6 in #9231 (3eb2c)
Log seed when only sequence.shuffle.tests is enabled - by @kaigritun, Kai Gritun and @sheremet-va in #9576 (8182b)
Externalize expect/src/utils from vitest - by @hi-ogawa in #9616 [(48739)](https://redirect.github.

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

safedep · 2026-09-11T02:52:12Z

SafeDep Report Summary

Package Details

Package	Malware	Vulnerability	Risky License	Report
`@standard-schema/spec @ 1.1.0` _{pnpm-lock.yaml}				🔗
`@vitest/expect @ 4.1.11` _{pnpm-lock.yaml}				🔗
`@vitest/mocker @ 4.1.11` _{pnpm-lock.yaml}				🔗
`@vitest/pretty-format @ 4.1.11` _{pnpm-lock.yaml}				🔗
`@vitest/runner @ 4.1.11` _{pnpm-lock.yaml}				🔗
`@vitest/snapshot @ 4.1.11` _{pnpm-lock.yaml}				🔗
`@vitest/spy @ 4.1.11` _{pnpm-lock.yaml}				🔗
`@vitest/utils @ 4.1.11` _{pnpm-lock.yaml}				🔗
`chai @ 6.2.2` _{pnpm-lock.yaml}				🔗
`es-module-lexer @ 2.3.2` _{pnpm-lock.yaml}				🔗
`expect-type @ 1.4.0` _{pnpm-lock.yaml}				🔗
`fdir @ 6.5.0` _{pnpm-lock.yaml}				🔗
`magic-string @ 0.30.21` _{pnpm-lock.yaml}				🔗
`obug @ 2.2.1` _{pnpm-lock.yaml}				🔗
`picomatch @ 4.0.7` _{pnpm-lock.yaml}				🔗
`std-env @ 4.2.0` _{pnpm-lock.yaml}				🔗
`tinyexec @ 1.3.1` _{pnpm-lock.yaml}				🔗
`tinyglobby @ 0.2.17` _{pnpm-lock.yaml}				🔗
`tinyrainbow @ 3.1.1` _{pnpm-lock.yaml}				🔗
`vitest @ 4.1.11` _{pnpm-lock.yaml}				🔗

View complete scan results →

_{This report is generated by SafeDep GitHub App}

chore(deps): update dependency vitest to v4 [security]

8d77347

renovate Bot added the renovate label Sep 11, 2026

Navigation Menu

chore(deps): update dependency vitest to v4 [security] - #293

chore(deps): update dependency vitest to v4 [security]#293
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-vitest-vulnerability

renovate Bot commented Sep 11, 2026

Uh oh!

safedep Bot commented Sep 11, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Sep 11, 2026

Vitest: Path Traversal / Arbitrary File Read via @​vitest/mocker Redirect Mock

Details

Summary

Affected code

Registration paths and trust boundaries

Path handling

Scope / preconditions

Impact

Affected versions

Fix

Severity

References

Release Notes

🐞 Bug Fixes

🐞 Bug Fixes

🐞 Bug Fixes

🐞 Bug Fixes

🐞 Bug Fixes

🐞 Bug Fixes

🏎 Performance

🚀 Experimental Features

🐞 Bug Fixes

🚀 Features

🐞 Bug Fixes

🚀 Experimental Features

🐞 Bug Fixes

🐞 Bug Fixes

🚀 Features

🐞 Bug Fixes

🚀 Features

🐞 Bug Fixes

Configuration

Uh oh!

safedep Bot commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

SafeDep Report Summary

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

safedep Bot commented Sep 11, 2026 •

edited

Loading