GHSA-82fw-gwwq-j7x9 affects vitest 2.1.0-4.1.10; bumped vitest and @vitest/mocker to 4.1.11, npm audit clean, full vitest suite green. Dev gitlink pin follows.
GHSA-82fw-gwwq-j7x9 affects vitest 2.1.0-4.1.10; bumped vitest and @vitest/mocker to 4.1.11, npm audit clean, full vitest suite green. Dev gitlink pin follows.
Why: GHSA-82fw-gwwq-j7x9 (path traversal / arbitrary file read via @vitest/mocker redirect mock) affects vitest 2.1.0-4.1.10; the locked 3.x toolchain was inside the range. Dev-only dependency, but the fix is a routine bump — follow-up to the 2026-09-30 dependency CVE inventory.
Evidence: vitest and @vitest/mocker now at 4.1.11 (first fixed release); npm audit reports 0 vulnerabilities; npx vitest run 33/33 green on vitest 4.
Impact: package.json/package-lock.json devDependency bump only; no production dependency or source change.
Refs: Dev-side task fix/dep-vuln-bumps (gitlink pin follows after combined verification)
weichen
merged commit af0385451a into main2026-09-30 16:48:48 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
GHSA-82fw-gwwq-j7x9 affects vitest 2.1.0-4.1.10; bumped vitest and @vitest/mocker to 4.1.11, npm audit clean, full vitest suite green. Dev gitlink pin follows.