Repository navigation
chore(app): vitest 4.1.12 closes the two @vitest/mocker advisories - #12241
Closed
MarkusNeusinger wants to merge 2 commits into
Closed
MarkusNeusinger wants to merge 2 commits into
MarkusNeusinger wants to merge 2 commits into
Conversation
Raise vitest and @vitest/coverage-v8 from ^4.1.11 to ^4.1.12 so app/yarn.lock resolves @vitest/mocker 4.1.12, the first patched version for the two open Dependabot alerts on 4.1.11 (code injection through unauthenticated manual mock registration; Windows backslash traversal bypassing the redirect allowlist). Test-time dependency only. The other two alerts on main stay open for reasons outside this change: certifi already is at the fixed 2026.10.19 in uv.lock (the alert is stale), and opentelemetry-api 1.45.1 is unreachable while google-adk, 2.11.0 and 2.12.0 alike, caps it at 1.42.1. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The dependency update is narrowly scoped and internally consistent, with no identified blocking issues; CI results were not independently verified.
No open issues 🎉
What changed in this PR
Updates the frontend test dependencies to Vitest 4.1.12 to address the two reported @vitest/mocker advisories, without changing application code.
Changes:
- Raises
vitestand@vitest/coverage-v8requirements to^4.1.12. - Updates the lockfile consistently across the Vitest dependency family.
- Adds a security changelog fragment describing the fixes.
| File | Description |
|---|---|
changelog.d/vitest-mocker-advisory.md |
Documents the advisory fixes and test-only scope. |
app/yarn.lock |
Locks Vitest packages, including @vitest/mocker, to 4.1.12. |
app/package.json |
Raises the test runner and coverage dependency requirements. |
Review effort: Balanced
7 of 8 tasks
MarkusNeusinger
added a commit
that referenced
this pull request
Oct 23, 2026
## Summary - Raises `vitest` and `@vitest/coverage-v8` in `app/` from ^4.1.11 to ^5.0.5. Test-time dependency only; nothing ships to the site. - `app/yarn.lock` now resolves `@vitest/mocker` 5.0.5, which is outside both open Dependabot advisory ranges (GHSA-qxg6-89mg-rqv8 `< 4.1.12`, GHSA-xp26-3454-mjgp `>= 4.1.11, < 4.1.12`). - **This supersedes #12241** (vitest ^4.1.12 for the same two advisories). The owner merges either #12241 or this PR, not both. - No config or test changes were needed. The Vitest 5 migration guide items that could affect this suite were checked: - `clearMocks` now defaults to `true`: all 1,168 tests still pass. - `vi.mock` / `vi.hoisted` inside functions or `describe` blocks now throw: none in the suite, all tests pass. - `coverage.include` / `coverage.exclude` lost their looser "contains" matching: the coverage file set is identical to Vitest 4 (117 files, diffed). - `vite` became a required peer dependency: `app/package.json` already lists `vite` 8.3.5, inside the `^6.4.0 || ^7.0.0 || ^8.0.0` peer range. - Node `^22.12.0 || ^24.0.0`: CI and the local toolchain run Node 24. ## Plan N/A. A single dependency bump, no plan file. ## Test plan Local, Node 24.21.0, in a fresh worktree from `origin/main`: - [x] `yarn lint`: pass - [x] `yarn fm:check`: pass - [x] `yarn type-check`: pass - [x] `yarn test`: 106 files, 1,168 tests pass (same counts as Vitest 4.1.11 on `main`) - [x] `yarn test --coverage` (the CI form): pass; 117 covered files, identical list to Vitest 4; statements 80.55 % vs 80.61 % on `main` - [x] `yarn build`: pass; `dist/` identical to `main` in file names and sizes - [x] `uv run python -m tools.changelog check --base origin/main`: pass - [ ] CI green No local browser run against the backend: Vitest is a test-time dependency only and never reaches the site, and the built bundle is identical to `main`. The gates plus the full test run cover this change. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_0175hA62juZoajMcqKxWFGza --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Owner
Author
|
Closed as superseded: the owner chose Vitest 5 (#12249), which resolves the same two @vitest/mocker advisories (GHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp) with @vitest/mocker 5.0.5. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
vitestand@vitest/coverage-v8inapp/from ^4.1.11 to ^4.1.12, soapp/yarn.lockresolves@vitest/mocker4.1.12, the first patched version for the two open Dependabot alerts on 4.1.11 (code injection through unauthenticated manual mock registration; Windows backslash traversal of the redirect allowlist). Test-time dependency, nothing ships to the site.mainare not fixable here:certifiis already at the fixed 2026.10.19 inuv.locksince deps(python): Bump certifi from 2026.4.22 to 2026.10.19 #12234 (the alert is stale), andopentelemetry-api1.45.1 is unreachable whilegoogle-adk(2.11.0 and 2.12.0 alike) caps it at<=1.42.1.Plan
No plan file; a dependency bump that Dependabot had not opened yet.
Test plan
cd app && yarn testpasses on the upgraded vitest (Node 24)yarn lint,yarn type-check,yarn buildpass