Bump vitest to 4.1.11 past the mocker path traversal advisory #19

Merged

weichen merged 1 commits from fix/dep-vuln-bumps into main

2026-09-30 16:48:48 +00:00

Author	SHA1	Message	Date
weichen	a61bd70399	Bump vitest to 4.1.11 past the mocker path traversal advisory Why: GHSA-82fw-gwwq-j7x9 (path traversal / arbitrary file read via @vitest/mocker redirect mock) affects vitest 2.1.0-4.1.10; the locked 3.x toolchain was inside the range. Dev-only dependency, but the fix is a routine bump — follow-up to the 2026-09-30 dependency CVE inventory. Evidence: vitest and @vitest/mocker now at 4.1.11 (first fixed release); npm audit reports 0 vulnerabilities; npx vitest run 33/33 green on vitest 4. Impact: package.json/package-lock.json devDependency bump only; no production dependency or source change. Refs: Dev-side task fix/dep-vuln-bumps (gitlink pin follows after combined verification)	2026-09-30 16:47:34 +00:00

Author

SHA1

Message

Date

weichen

a61bd70399

Bump vitest to 4.1.11 past the mocker path traversal advisory

Why: GHSA-82fw-gwwq-j7x9 (path traversal / arbitrary file read via @vitest/mocker redirect mock) affects vitest 2.1.0-4.1.10; the locked 3.x toolchain was inside the range. Dev-only dependency, but the fix is a routine bump — follow-up to the 2026-09-30 dependency CVE inventory.
Evidence: vitest and @vitest/mocker now at 4.1.11 (first fixed release); npm audit reports 0 vulnerabilities; npx vitest run 33/33 green on vitest 4.
Impact: package.json/package-lock.json devDependency bump only; no production dependency or source change.
Refs: Dev-side task fix/dep-vuln-bumps (gitlink pin follows after combined verification)

2026-09-30 16:47:34 +00:00