Skip to content

chore(deps): update dependency vitest to v4 [security] - #8289

Closed
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-vitest-vulnerability
Closed

chore(deps): update dependency vitest to v4 [security]#8289
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-vitest-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Jun 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
vitest (source) ^3.2.4 → ^4.0.0 age confidence

Vitest: Path Traversal / Arbitrary File Read via @​vitest/mocker Redirect Mock

CVE-2026-84373 / GHSA-82fw-gwwq-j7x9

More information

Details

Summary

@vitest/mocker registers a redirect mock's target path without validating it
against the dev server's file-serving allowlist. An attacker who can reach the
dev server's WebSocket can register a redirect mock pointing outside the project
root; when the mocked module is requested, the plugin's load hook returns
readFile(<attacker path>) as the module source, disclosing local files.

This is exploitable without authentication only through the public
mockerPlugin / standalone interceptorPlugin exports (used by third-party dev
servers), which register the handler on Vite's unauthenticated HMR socket.
Vitest's own browser mode registers mocks over a token-authenticated RPC and
is not remotely reachable by default (see Scope).

Affected code

packages/mocker/src/node/interceptorPlugin.ts.

The load hook is the file-read sink:

if (mock.type === 'redirect') {
  return readFile(mock.redirect, 'utf-8')
}

mock.redirect is derived from client input at registration time with no
boundary check:

if (event.type === 'redirect') {
  const redirectUrl = new URL(event.redirect)
  event.redirect = join(server.config.root, redirectUrl.pathname)
}
registry.register(event)

There is no server.fs.allow / server.fs.deny check and no assertion that the
resolved path stays within the project root.

Registration paths and trust boundaries
  • Public mockerPlugin / interceptorPlugin (unauthenticated). In
    configureServer, the plugin registers server.ws.on('vitest:interceptor:register', …)
    on Vite's HMR WebSocket. That socket performs no token, Origin, or same-origin
    check, so any client that can reach it can register a redirect mock. This is
    the path the "unauthenticated" impact applies to.
  • Vitest browser mode (authenticated). Mocks register over the browser RPC
    (registerMock), which sits behind a per-run token (isValidApiRequest, a
    random api.token). The interceptor's configureServer socket is not used for
    registration here (in v5 it does not run at all, as the plugin is injected per
    environment). The same missing boundary check exists on the authenticated RPC
    path, but reaching it requires the token, so it is not a remote-unauthenticated
    read.
Path handling

new URL(redirect).pathname combined with join(root, pathname) does not
confine reads to the root:

  • Special/hierarchical schemes (file:, http:) are normalized by WHATWG URL,
    so .. segments are collapsed and the result stays under the root. Payloads of
    the form file:///../../etc/passwd do not escape.
  • A non-special (opaque) scheme preserves .. in pathname, so
    join(root, "../../…/etc/passwd") resolves outside the root and reads an
    arbitrary file.

Even without escaping the root, the missing server.fs check allows reading any
in-root file the dev server would otherwise refuse to serve (for example an
in-root .env or source that is denied by server.fs.deny).

Scope / preconditions
  • This is a development-server issue. The dev server binds to localhost by
    default and is not reachable from the network unless the developer exposes it
    (server.host / 0.0.0.0, a LAN bind, or a proxy).
  • A raw (non-browser) client against a reachable server bypasses browser origin
    and CORS protections entirely and can both register the mock and read the
    response.
  • A browser-based drive-by against a localhost server is substantially mitigated
    by Vite defaults: the default CORS origin allowlist is limited to localhost
    origins, and server.allowedHosts blocks DNS-rebinding, so a cross-origin page
    cannot read the file contents back.
Impact

Disclosure of local files readable by the dev-server process (source, in-root
.env/secrets, and, via the opaque-scheme payload, files outside the project
root). No integrity or availability impact.

Affected versions

Present since @vitest/mocker was introduced.

  • Affected: @vitest/mocker >= 2.1.0 (shipped in vitest and
    @vitest/browser >= 2.1.0), through 4.1.x and the 5.0.0 pre-releases.
  • Fixed: Vitest 4.1.11 and 5.0.0. Older majors (2.1.x, 3.x) are not
    maintained and are not planned to receive the fix.
Fix

Validate the resolved redirect target against Vite's file-serving allowlist
(isFileLoadingAllowed) before registering it, at every registration site, and
stop registering the interceptor WebSocket events in Vitest's browser mode
(mocks there flow through the authenticated RPC).

Severity

  • CVSS Score: 5.9 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

vitest-dev/vitest (vitest)

v4.1.11

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v4.1.10

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v4.1.9

Compare Source

🐞 Bug Fixes
  • Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in #​10546 (a5180)
  • browser:
    • Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in #​10555 (7fb29)
    • Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in #​10497 and #​10556 (fbc62)
  • mocker:
    • Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in #​10548 (2c955)
  • pool:
    • Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in #​10543 and #​10564 (934b0)
View changes on GitHub

v4.1.8

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v4.1.7

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v4.1.6

Compare Source

   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub

v4.1.5

Compare Source

   🚀 Experimental Features
   🐞 Bug Fixes
    View changes on GitHub

v4.1.4

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v4.1.3

Compare Source

   🚀 Experimental Features
   🐞 Bug Fixes
    View changes on GitHub

v4.1.2

Compare Source

This release bumps Vitest's flatted version and removes version pinning to resolve flatted's CVE related issues (#​9975).

   🐞 Bug Fixes
    View changes on GitHub

v4.1.1

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v4.1.0

Compare Source

Vitest 4.1 is out!

This release page lists all changes made to the project during the 4.1 beta. To get a review of all the new features, read our blog post.

   🚀 Features
   🐞 Bug Fixes

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner June 1, 2026 21:51
@renovate renovate Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jun 1, 2026
@renovate

renovate Bot commented Jun 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json
npm warn Unknown env config "store". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE unable to resolve dependency tree
npm error
npm error While resolving: netlify-cli@27.11.0
npm error Found: vitest@4.1.11
npm error node_modules/vitest
npm error   dev vitest@"^4.0.0" from the root project
npm error   peer vitest@"4.1.11" from @vitest/browser-playwright@4.1.11
npm error   node_modules/@vitest/browser-playwright
npm error     peerOptional @vitest/browser-playwright@"4.1.11" from vitest@4.1.11
npm error   4 more (@vitest/browser-preview, ...)
npm error
npm error Could not resolve dependency:
npm error peer vitest@"3.2.7" from @vitest/coverage-v8@3.2.7
npm error node_modules/@vitest/coverage-v8
npm error   dev @vitest/coverage-v8@"^3.2.4" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-10-05T16_02_24_279Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-10-05T16_02_24_279Z-debug-0.log

kodiakhq[bot]
kodiakhq Bot previously approved these changes Jun 1, 2026
View reviewed changes
@renovate renovate Bot changed the title chore(deps): update dependency vitest to v4 [security] chore(deps): update dependency vitest to v3.2.6 [security] Jun 8, 2026
@github-actions

github-actions Bot commented Jun 10, 2026 •
edited
Loading

Copy link
Copy Markdown

📊 Benchmark results

Comparing with 20fb23d

  • Dependency count: 1,127 (no change)
  • Package size: 379 MB (no change)
  • Number of ts-expect-error directives: 354 (no change)

kodiakhq[bot]
kodiakhq Bot previously approved these changes Jun 10, 2026
View reviewed changes
kodiakhq[bot]
kodiakhq Bot previously approved these changes Jun 10, 2026
View reviewed changes
kodiakhq[bot]
kodiakhq Bot previously approved these changes Jun 10, 2026
View reviewed changes
@renovate renovate Bot changed the title chore(deps): update dependency vitest to v3.2.6 [security] chore(deps): update dependency vitest to v3.2.6 [security] - abandoned Jul 27, 2026
@renovate

renovate Bot commented Jul 27, 2026

Copy link
Copy Markdown
Contributor Author

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.

@renovate
renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 31db0ad to cb7b2c6 Compare September 8, 2026 21:48
@renovate renovate Bot changed the title chore(deps): update dependency vitest to v3.2.6 [security] - abandoned chore(deps): update dependency vitest to v4 [security] Sep 8, 2026
@renovate
renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch 2 times, most recently from e6bc32d to ff845b8 Compare September 10, 2026 15:18
@coderabbitai

coderabbitai Bot commented Sep 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 7269c586-e43e-44e5-9bb2-d93bac6149ab

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

@renovate
renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from ff845b8 to 99b6324 Compare September 15, 2026 09:16
@renovate
renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch 2 times, most recently from ef2811a to 2875436 Compare October 1, 2026 07:40
@renovate
renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 2875436 to 277428d Compare October 5, 2026 16:02
@netlify-coding netlify-coding Bot mentioned this pull request Oct 6, 2026
Merged
sarahetter added a commit that referenced this pull request Oct 6, 2026
@netlify-coding Netliloop @sarahetter
chore(deps): update vitest to v4 and oxfmt to 0.72.0 [security] (#8573)
e5d6c36 
Opened by Netliloop run [#392](https://netliloop.netlify.app/#/runs/392)
(security-scan), asked in
[Slack](https://slack.com/archives/C095D1JL480/p1791299459766719?thread_ts=1791298825.895999&cid=C095D1JL480)

### Why

- `vitest@3.2.7` carries
[GHSA-82fw-gwwq-j7x9](GHSA-82fw-gwwq-j7x9)
(`@vitest/mocker` path traversal, patched in 4.1.11). Renovate's
[#8289](#8289) and
[#8320](#8320) target it but their
lockfiles no longer resolve against `main` (`npm ci` fails on every
rebase), and Dependabot's
[#8570](#8570) jumps to vitest 5 and
fails typecheck, lint and 12 unit tests.
- `oxfmt@0.61.0` pins `tinypool@2.1.0`, which carries the critical
[GHSA-85c8-ppgw-ccpr](GHSA-85c8-ppgw-ccpr);
the only way past it is an oxfmt version that pins `tinypool >= 2.1.2`.
- `npm audit` on `main` lists `vitest`, `@vitest/mocker`,
`@vitest/coverage-v8` and `tinypool`; on this branch none of them
appear.

### What changed

- `vitest` and `@vitest/coverage-v8` go to `^4.1.11`, the first patched
release (vitest 5 is a week old).
- `oxfmt` goes to `0.72.0`, which pins `tinypool@2.2.0`; running it
reformats two files under `src/commands/logs/sources/`.
- vitest 4 removed `poolOptions`, so `threads.singleThread: true`
becomes `maxWorkers: 1` in both configs: still one worker thread, one
file at a time. This is not a byte-for-byte port. The migration guide's
equivalent adds `isolate: false`, but in vitest 4 that shares module
mocks across files and fails 38 unit tests here, so file isolation stays
on and the comment in each config says why. Each file now gets a fresh
worker; the Windows-hang TODO beside the pin still applies and CI's
Windows jobs on this PR are the check.
- Transitively, vitest now carries its own nested Vite 8.3.3 (rolldown)
instead of the top-level Vite 7.3.5, so test-file transforms change
engine.
- Coverage reports change shape (vitest 4 drops `coverage.all` and uses
AST remapping), so the Codecov numbers on this PR will move; that is the
tooling, not a regression.
- vitest 4 constructs mocks called with `new`, so the `NetlifyAPI` and
`LocalState` mock implementations in three test files become `function`
expressions instead of arrow functions.
- `toThrowError` is marked `@deprecated` ("Alias for `expect.toThrow`")
in `@vitest/expect` 4 and so flagged by
`@typescript-eslint/no-deprecated`; 38 call sites in `tests/` switch to
`toThrow` with the same arguments.
- Supersedes #8289, #8320 and #8570, which can be closed when this
merges.

### How we verified

- `npm ci --dry-run`: the committed lockfile is in sync with
`package.json` (Renovate's #8289 and #8320 fail exactly here).
- `npm run build`, `npm run typecheck`, `npm run lint`, `npm run
format:check`: all exit 0.
- `CI=true npm run test:unit -- --coverage`: 80 files, 667 tests passed,
the same counts as `CI=true npm run test:unit` on `main`. With the
migration guide's `isolate: false` the same command fails 38 tests in 9
files (leaked module mocks), which is why isolation stays on.
- `CI=true npx vitest run --retry=3 --coverage
tests/integration/commands/env/env.test.ts
tests/integration/commands/dev/dev-forms-and-redirects.test.ts`: 2
files, 32 tests passed, so `--retry`, `--coverage` and the integration
harness work on vitest 4
- `CI=true npm run test:integration -- --shard=1/4` here: 24 failures in
6 files, and the same 6 files fail with the same 24 tests on `main`
under vitest 3 (this machine has a linked Netlify site and no git
identity, which `build`, `clone` and `link` tests depend on); the full
set is CI's 8 green shards.
- `npx vitest list --config vitest.e2e.config.ts`: the e2e config loads
and lists 5 tests.
- `CI=true npx vitest run --config vitest.e2e.config.ts -t "npm →"` runs
through verdaccio publish, `npm install`, `netlify --help` and `netlify
link` on vitest 4 and fails at the `netlify unlink` assertion (`expected
... to contain 'Run netlify link to link it'`). The identical run on
`main` with vitest 3 fails at the same line: this machine has a globally
linked Netlify site (`main` received `Unlinked from netliloop`) and,
once unlinked, the CLI running under `npx` phrases the hint as `Run npx
netlify link` (the branch received that). The failure is the
environment, not the upgrade; the e2e suite is unverified here.
- `npm audit --json`: on `main` it lists `vitest` (critical, range
0.0.95 - 4.1.10), `@vitest/mocker`, `@vitest/coverage-v8` and `tinypool
<=2.1.1`; on this branch none of the four appear and `npm ls tinypool`
shows only `oxfmt@0.72.0 → tinypool@2.2.0`. 39 advisories remain,
unchanged from `main`; the two critical ones are `proxy-addr`
(Dependabot's #8567 fixes it) and `shell-quote`.

### What is left to test

- The full integration suite, the e2e suite, and unit/integration on
macOS and Windows (where the single-thread pin matters most) could not
run here; on this PR CI ran them and all 34 checks are green (unit on
ubuntu/macOS/Windows, 8 integration shards, e2e, lint, format,
typecheck, verify-docs, package-size).

### Risk

`low`: development tooling only; nothing in `dist/` or the published
package changes except the two reformatted files, whose formatting-only
diff is in the branch. No Linear issue: a self-contained dependency fix
the CLI team can merge from this description.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Netliloop <netliloop@netlify.com>
Co-authored-by: Sarah Etter <sarah.etter@netlify.com>
@sarahetter

sarahetter commented Oct 6, 2026

Copy link
Copy Markdown
Contributor

Superseded by #8573 (vitest ^4.1.11, oxfmt 0.72.0 → tinypool 2.2.0), which has merged.

@sarahetter sarahetter closed this Oct 6, 2026
@renovate
renovate Bot deleted the renovate/npm-vitest-vulnerability branch October 6, 2026 16:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kodiakhq kodiakhq[bot] kodiakhq[bot] left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@sarahetter