From d81e5d53b38f7bb9b56f74e85ab1f68b6fd383e1 Mon Sep 17 00:00:00 2001 From: Markus Neusinger <2921697+MarkusNeusinger@users.noreply.github.com> Date: Fri, 23 Oct 2026 01:12:55 +0200 Subject: [PATCH 1/2] chore(app): vitest 4.1.12 closes the two @vitest/mocker advisories Raise vitest and @vitest/coverage-v8 from ^4.1.11 to ^4.1.12 so app/yarn.lock resolves @vitest/mocker 4.1.12, the first patched version for the two open Dependabot alerts on 4.1.11 (code injection through unauthenticated manual mock registration; Windows backslash traversal bypassing the redirect allowlist). Test-time dependency only. The other two alerts on main stay open for reasons outside this change: certifi already is at the fixed 2026.10.19 in uv.lock (the alert is stale), and opentelemetry-api 1.45.1 is unreachable while google-adk, 2.11.0 and 2.12.0 alike, caps it at 1.42.1. Co-Authored-By: Claude Fable 5.1 --- app/package.json | 4 +- app/yarn.lock | 104 +++++++++++++------------- changelog.d/vitest-mocker-advisory.md | 8 ++ 3 files changed, 62 insertions(+), 54 deletions(-) create mode 100644 changelog.d/vitest-mocker-advisory.md diff --git a/app/package.json b/app/package.json index d04381efc11..8fb7e9249ed 100644 --- a/app/package.json +++ b/app/package.json @@ -48,7 +48,7 @@ "@typescript-eslint/eslint-plugin": "^8.72.0", "@typescript-eslint/parser": "^8.72.0", "@vitejs/plugin-react-swc": "^4.3.3", - "@vitest/coverage-v8": "^4.1.11", + "@vitest/coverage-v8": "^4.1.12", "eslint": "^10.13.0", "eslint-config-prettier": "^10.1.8", "eslint-plugin-perfectionist": "^5.12.1", @@ -62,6 +62,6 @@ "vite": "8.3.5", "vite-plugin-checker": "^0.14.5", "vite-plugin-compression2": "^2.5.3", - "vitest": "^4.1.11" + "vitest": "^4.1.12" } } diff --git a/app/yarn.lock b/app/yarn.lock index 0ee3c24b141..24d2cd02a9c 100644 --- a/app/yarn.lock +++ b/app/yarn.lock @@ -1078,13 +1078,13 @@ "@rolldown/pluginutils" "^1.0.1" "@swc/core" "^1.15.46" -"@vitest/coverage-v8@^4.1.11": - version "4.1.11" - resolved "https://registry.yarnpkg.com/@vitest/coverage-v8/-/coverage-v8-4.1.11.tgz#6f0636abe7e23e86dd35127244554be2c60bc2a5" - integrity sha512-8MVGEFnJIcdGjcbfKmeq8z0pZHH0JlVtoVZH9Q/qwUp6wyFnEJUBMrw9DCaj+ra3vShGmhavjalMIhPNxZAUcw== +"@vitest/coverage-v8@^4.1.12": + version "4.1.12" + resolved "https://registry.yarnpkg.com/@vitest/coverage-v8/-/coverage-v8-4.1.12.tgz#d4633b3cb3fddad0f671689883cd5f8dcdc83e91" + integrity sha512-6S7/iVknKglLAxMFxQGNppBI0iqJS2NgM6FBxavitj7KaDq/vywOWGf6dGu7F2L1Qy0G6S3uTp7aGshHrzK8JA== dependencies: "@bcoe/v8-coverage" "^1.0.2" - "@vitest/utils" "4.1.11" + "@vitest/utils" "4.1.12" ast-v8-to-istanbul "^1.0.0" istanbul-lib-coverage "^3.2.2" istanbul-lib-report "^3.0.1" @@ -1094,63 +1094,63 @@ std-env "^4.0.0-rc.1" tinyrainbow "^3.1.0" -"@vitest/expect@4.1.11": - version "4.1.11" - resolved "https://registry.yarnpkg.com/@vitest/expect/-/expect-4.1.11.tgz#5f580d1f9cdbba314dbf23b2d911f8eb23878f5f" - integrity sha512-VX2x5vNJXET47KAFzwERI+KRMtTTCSWTfSMKsW7JsUsXV4psq++e3DvZpuTDOpHcxytiDs6p2nhVb2tVDiiUYw== +"@vitest/expect@4.1.12": + version "4.1.12" + resolved "https://registry.yarnpkg.com/@vitest/expect/-/expect-4.1.12.tgz#e12b5f114e548252a6eee50f6619f1b8f0f89eed" + integrity sha512-vFlTt+YEu9WBpNjdGayNmlMVzrWPi1+sv853/7t2FU7hpO5gAFBKHzQmkCq5Xjpr+evegF2994LQT3hF3mRlqQ== dependencies: "@standard-schema/spec" "^1.1.0" "@types/chai" "^5.2.2" - "@vitest/spy" "4.1.11" - "@vitest/utils" "4.1.11" + "@vitest/spy" "4.1.12" + "@vitest/utils" "4.1.12" chai "^6.2.2" tinyrainbow "^3.1.0" -"@vitest/mocker@4.1.11": - version "4.1.11" - resolved "https://registry.yarnpkg.com/@vitest/mocker/-/mocker-4.1.11.tgz#8e2906361bc5dfa271757a858ae80643118fcbb4" - integrity sha512-2XJVD55d1o5AZous5CCGKS74g/riOj9odEt2bQpCVZeblHyHdnMeFl4jl0XjU21stf4mbjUkew2eXQZt65g5CQ== +"@vitest/mocker@4.1.12": + version "4.1.12" + resolved "https://registry.yarnpkg.com/@vitest/mocker/-/mocker-4.1.12.tgz#13b241597b79695e401fd05b363bb8e79695dfac" + integrity sha512-fKShNpKZzupWZuY0z7egydvL0sqW4INEZBEExMBMAa6izlENEVHwoXgdaTCaBZ5fwlr4xf2o1wXC83n9RpO+NA== dependencies: - "@vitest/spy" "4.1.11" + "@vitest/spy" "4.1.12" estree-walker "^3.0.3" magic-string "^0.30.21" -"@vitest/pretty-format@4.1.11": - version "4.1.11" - resolved "https://registry.yarnpkg.com/@vitest/pretty-format/-/pretty-format-4.1.11.tgz#8b28eb8240771d6ea970e33beaeb41384b51868e" - integrity sha512-yiZzPbGTS9Sr/JpFl8zHrcIkAofNbFV6k21vIgQN/cY/oxZeXhJv5sc/MBJ5jFKWmWs+oJHw0UXLZjmf931+Vw== +"@vitest/pretty-format@4.1.12": + version "4.1.12" + resolved "https://registry.yarnpkg.com/@vitest/pretty-format/-/pretty-format-4.1.12.tgz#396d123c8905e0a7c3dde02d5ba84ed8f983fdbf" + integrity sha512-XW9O8+Mxx4VpCtkYdMJLZQQwsVryP9wk7cPKDxtXFfwSak6yRh5+2fep/Y0XF/ElBvJHq8bcYdi6aeuai0opZA== dependencies: tinyrainbow "^3.1.0" -"@vitest/runner@4.1.11": - version "4.1.11" - resolved "https://registry.yarnpkg.com/@vitest/runner/-/runner-4.1.11.tgz#bfbad98c8d6c3f1fb4df12056ad569821ff77f21" - integrity sha512-LztvUgdwMNJMIkj3hQnnxiC2Xy1zNxq928W/xhjCLaNCzqTZOudjwbQf6v9IntZGPw132i2Lq2rgTRZHD3JHNw== +"@vitest/runner@4.1.12": + version "4.1.12" + resolved "https://registry.yarnpkg.com/@vitest/runner/-/runner-4.1.12.tgz#4c4e267b2011e7dcc5a84a9271caaaf880d80c02" + integrity sha512-NKlVKCr5QnCe8jijdMnmkpHHU+WTqiLFR6G0pHji9uRjXK9xJl1k1nTw6F3pOOj2PDcsDt2GKQMI7wIsaT491w== dependencies: - "@vitest/utils" "4.1.11" + "@vitest/utils" "4.1.12" pathe "^2.0.3" -"@vitest/snapshot@4.1.11": - version "4.1.11" - resolved "https://registry.yarnpkg.com/@vitest/snapshot/-/snapshot-4.1.11.tgz#df461eb165924a3155986dde68e13360f53f3d4c" - integrity sha512-pN7ikn1ON7h8ee4gIAp4AzyK+zBtJPzVbqOgu5LCEh4VaJVbPQcgYQYJIMGQPXVeJJq1fnfazis7a5pFNPahog== +"@vitest/snapshot@4.1.12": + version "4.1.12" + resolved "https://registry.yarnpkg.com/@vitest/snapshot/-/snapshot-4.1.12.tgz#53670a17d3d804e651195d5babab1bf2fd83688a" + integrity sha512-ko1y1Qgb/slzQ9mr+b89Cuqud8WG1TKtsPD8r7ZUBdvVOGt85Af2HwCqHujrhwJq95hs/9RM7fcAPg57o1vlzw== dependencies: - "@vitest/pretty-format" "4.1.11" - "@vitest/utils" "4.1.11" + "@vitest/pretty-format" "4.1.12" + "@vitest/utils" "4.1.12" magic-string "^0.30.21" pathe "^2.0.3" -"@vitest/spy@4.1.11": - version "4.1.11" - resolved "https://registry.yarnpkg.com/@vitest/spy/-/spy-4.1.11.tgz#0add45cae953afed9c88f98e2f6fc9164558c32a" - integrity sha512-apNa/prQy2qCeywhnixOHPRCgGNhvg7T4Dapfl1GahLp/R+uhBm5cPyFoNVyqsNd2h1nJxL6BqqdIjiABL60YA== +"@vitest/spy@4.1.12": + version "4.1.12" + resolved "https://registry.yarnpkg.com/@vitest/spy/-/spy-4.1.12.tgz#59b02f0735cdff0644e1664d433b084b4b80ec04" + integrity sha512-RGq9x4JNGNTZHEJxvN0oSiJjeSCExm0n2gZKKJZHY9cX5AVA6M7VJILBT3ZJ/tJ/0J9uWT7fETV9/btoi//vSg== -"@vitest/utils@4.1.11": - version "4.1.11" - resolved "https://registry.yarnpkg.com/@vitest/utils/-/utils-4.1.11.tgz#9b27a4293b827942b223539bfab1bd9f7eada31b" - integrity sha512-zTCVGpyFsGWBhllOyKlTw/vnr6D9qxsfSDyfbyZmTyjHw5N/VuvzHpHoQjm2ZJzn4RJgx5w4r7V0er69CmLgPQ== +"@vitest/utils@4.1.12": + version "4.1.12" + resolved "https://registry.yarnpkg.com/@vitest/utils/-/utils-4.1.12.tgz#e5416ed6c2313ded30dd9eae5fc08cba11fcacb3" + integrity sha512-Q3awXrwOfEV+qc3WmO5ONyE0yO7Q1gQ9/oyHxGLZ/pl7N3NO/ZztqQwKLuwMkV+CA1JYSIeO3gkHnRDIo4AVaA== dependencies: - "@vitest/pretty-format" "4.1.11" + "@vitest/pretty-format" "4.1.12" convert-source-map "^2.0.0" tinyrainbow "^3.1.0" @@ -2976,18 +2976,18 @@ vite@8.3.5, "vite@^6.0.0 || ^7.0.0 || ^8.0.0": optionalDependencies: fsevents "~2.3.3" -vitest@^4.1.11: - version "4.1.11" - resolved "https://registry.yarnpkg.com/vitest/-/vitest-4.1.11.tgz#1653c1521ae917f960d9b21877797c47dfd8bf21" - integrity sha512-fhACrNXUidIbGSBr5FlbuBkO7VWC1ZyLl0DO4CU2DrQoAPxX84Ysxs+HeGQpii5lZWV1Q4gBZTTu49mF+A6Edw== - dependencies: - "@vitest/expect" "4.1.11" - "@vitest/mocker" "4.1.11" - "@vitest/pretty-format" "4.1.11" - "@vitest/runner" "4.1.11" - "@vitest/snapshot" "4.1.11" - "@vitest/spy" "4.1.11" - "@vitest/utils" "4.1.11" +vitest@^4.1.12: + version "4.1.12" + resolved "https://registry.yarnpkg.com/vitest/-/vitest-4.1.12.tgz#b372587e9c000f165f1757793178ea6b5631f82e" + integrity sha512-5eWdz2yb3ajxWF3C8C4TjkXl7FGm3n2E/VlazALrQHzK7nYMSGFnCZto0bbPNl77AwkOZVLk0YnBAejUu0NiWA== + dependencies: + "@vitest/expect" "4.1.12" + "@vitest/mocker" "4.1.12" + "@vitest/pretty-format" "4.1.12" + "@vitest/runner" "4.1.12" + "@vitest/snapshot" "4.1.12" + "@vitest/spy" "4.1.12" + "@vitest/utils" "4.1.12" es-module-lexer "^2.0.0" expect-type "^1.3.0" magic-string "^0.30.21" diff --git a/changelog.d/vitest-mocker-advisory.md b/changelog.d/vitest-mocker-advisory.md new file mode 100644 index 00000000000..b2928f6a88f --- /dev/null +++ b/changelog.d/vitest-mocker-advisory.md @@ -0,0 +1,8 @@ +### Security + +- **vitest 4.1.12 in the frontend test setup.** Raises `vitest` and + `@vitest/coverage-v8` from 4.1.11 so `app/yarn.lock` resolves + `@vitest/mocker` 4.1.12, which closes the two Dependabot advisories on + 4.1.11 (code injection through unauthenticated manual mock registration, + and the Windows backslash traversal of the redirect allowlist). Test-time + only; nothing ships to the site. From 06d982b6a663ddc9cec63913a2fb6636adf6ba34 Mon Sep 17 00:00:00 2001 From: Markus Neusinger <2921697+MarkusNeusinger@users.noreply.github.com> Date: Fri, 23 Oct 2026 01:13:09 +0200 Subject: [PATCH 2/2] docs(changelog): add the PR reference to the vitest fragment --- changelog.d/vitest-mocker-advisory.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/changelog.d/vitest-mocker-advisory.md b/changelog.d/vitest-mocker-advisory.md index b2928f6a88f..a937c7ceca3 100644 --- a/changelog.d/vitest-mocker-advisory.md +++ b/changelog.d/vitest-mocker-advisory.md @@ -5,4 +5,4 @@ `@vitest/mocker` 4.1.12, which closes the two Dependabot advisories on 4.1.11 (code injection through unauthenticated manual mock registration, and the Windows backslash traversal of the redirect allowlist). Test-time - only; nothing ships to the site. + only; nothing ships to the site. (#12241)