Skip to content

chore: upgrade vitest to 4.1.11 to address CVE-2026-84373 #1637

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
brendan-kellam merged 3 commits into from
Sep 9, 2026
+54 −53
Merged

chore: upgrade vitest to 4.1.11 to address CVE-2026-84373 #1637

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ea08126
chore: upgrade vitest to 4.1.11 to address CVE-2026-84373
github-actions[bot] Sep 9, 2026
9137544
chore: add CHANGELOG entry for vitest upgrade
github-actions[bot] Sep 9, 2026
10fb199
Merge branch 'main' into cursor/cve/vitest
brendan-kellam Sep 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
- Upgraded `postcss-selector-parser` to `^6.1.4`. [#1625](https://github.com/sourcebot-dev/sourcebot/pull/1625)
- Upgraded `fast-uri` to `3.1.7`. [#1626](https://github.com/sourcebot-dev/sourcebot/pull/1626)
- Upgraded `qs` to `6.16.0`. [#1627](https://github.com/sourcebot-dev/sourcebot/pull/1627)
- Upgraded `vitest` to `4.1.11`. [#1637](https://github.com/sourcebot-dev/sourcebot/pull/1637)
- Upgraded `js-yaml` to `4.3.2`. [#1636](https://github.com/sourcebot-dev/sourcebot/pull/1636)
- Upgraded `@humanfs/node` to `0.16.8`. [#1630](https://github.com/sourcebot-dev/sourcebot/pull/1630)
- Upgraded `fflate` to `0.4.9`. [#1629](https://github.com/sourcebot-dev/sourcebot/pull/1629)
Expand Down
106 changes: 53 additions & 53 deletions yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10672,25 +10672,25 @@ __metadata:
languageName: node
linkType: hard

"@vitest/expect@npm:4.1.4":
version: 4.1.4
resolution: "@vitest/expect@npm:4.1.4"
"@vitest/expect@npm:4.1.11":
version: 4.1.11
resolution: "@vitest/expect@npm:4.1.11"
dependencies:
"@standard-schema/spec": "npm:^1.1.0"
"@types/chai": "npm:^5.2.2"
"@vitest/spy": "npm:4.1.4"
"@vitest/utils": "npm:4.1.4"
"@vitest/spy": "npm:4.1.11"
"@vitest/utils": "npm:4.1.11"
chai: "npm:^6.2.2"
tinyrainbow: "npm:^3.1.0"
checksum: 10c0/99b53a931366ddc985f26528495ec991fa2ce64018b00a56f989c322553045c5adf17e091eb7a12d786246712f84d36fc88e9d26c852538ff4dd5a6f9cf98715
checksum: 10c0/0aa5e0973aca93a58cbdc3041c6bfed5897e976124965203b96a23b811f4ca403590c7eb15802c8d8366ec27a1db0682451e8a91c4d06617636de262baf86e4b
languageName: node
linkType: hard

"@vitest/mocker@npm:4.1.4":
version: 4.1.4
resolution: "@vitest/mocker@npm:4.1.4"
"@vitest/mocker@npm:4.1.11":
version: 4.1.11
resolution: "@vitest/mocker@npm:4.1.11"
dependencies:
"@vitest/spy": "npm:4.1.4"
"@vitest/spy": "npm:4.1.11"
estree-walker: "npm:^3.0.3"
magic-string: "npm:^0.30.21"
peerDependencies:
Expand All @@ -10701,56 +10701,56 @@ __metadata:
optional: true
vite:
optional: true
checksum: 10c0/da61ee63743da4bc45df0488c994e284e7059a4005149195744705945d19aeb267c801b1f7d85e71b40f547ff2d5a195175c5d51e8455179c794ce67a019de87
checksum: 10c0/3111ea34bd5046f6c70bbd67cf8b89608ee8c41cb27ab2bd61d42f4b68810e9ea16a9a757a71bc254c105f73b407d00ebb6bab1ab0f7f5cdcc9d7d16602a3933
languageName: node
linkType: hard

"@vitest/pretty-format@npm:4.1.4":
version: 4.1.4
resolution: "@vitest/pretty-format@npm:4.1.4"
"@vitest/pretty-format@npm:4.1.11":
version: 4.1.11
resolution: "@vitest/pretty-format@npm:4.1.11"
dependencies:
tinyrainbow: "npm:^3.1.0"
checksum: 10c0/14a25c5acd02b1d18f9fab01d884658edb9137008d01025273617fb000e36391e4fda1513e94a257f5e611fb09041a0c042d145a90d359c9e810c0044b12763e
checksum: 10c0/ad32525c73807c0b72f38dc29bc51fd5a17879dc650f37995a9c5adbb8526e15f787691f76aa8768448ec7ed5bf5ba2b12329eac8fda1428b4d6b8c036390f71
languageName: node
linkType: hard

"@vitest/runner@npm:4.1.4":
version: 4.1.4
resolution: "@vitest/runner@npm:4.1.4"
"@vitest/runner@npm:4.1.11":
version: 4.1.11
resolution: "@vitest/runner@npm:4.1.11"
dependencies:
"@vitest/utils": "npm:4.1.4"
"@vitest/utils": "npm:4.1.11"
pathe: "npm:^2.0.3"
checksum: 10c0/a942ecf2e50e4c380f0d269f87272353dc40fe354357e1ecd0c6568fd37202bb86e33db676f4ad6cc5f1ab30937bba0b278d987729b21a0f22e9827f7f577da2
checksum: 10c0/3c782b055e9e688e1785f7c8937bd1669bad1b0e5758cb8b844f918f30a324b1d21e174d46c941ce80ebf37f2b89b55b6d619a675025914a1ece6377b95909e2
languageName: node
linkType: hard

"@vitest/snapshot@npm:4.1.4":
version: 4.1.4
resolution: "@vitest/snapshot@npm:4.1.4"
"@vitest/snapshot@npm:4.1.11":
version: 4.1.11
resolution: "@vitest/snapshot@npm:4.1.11"
dependencies:
"@vitest/pretty-format": "npm:4.1.4"
"@vitest/utils": "npm:4.1.4"
"@vitest/pretty-format": "npm:4.1.11"
"@vitest/utils": "npm:4.1.11"
magic-string: "npm:^0.30.21"
pathe: "npm:^2.0.3"
checksum: 10c0/9221df7c097665a204c811184ac2f3b89638ecd115344e703e9c4361dabd2ba80be4710ed20d127817d34227a74f21b90725deaecd4632954b492ad258d4913f
checksum: 10c0/35d82a7c2a3e4b57529c30387d568d9106b6bf960189214e5d8cb1f5288cb042305c2e5c7b0b2f8cb56a2c814973de0310bc56d72deb79427bea272b6224190c
languageName: node
linkType: hard

"@vitest/spy@npm:4.1.4":
version: 4.1.4
resolution: "@vitest/spy@npm:4.1.4"
checksum: 10c0/1036591947668845e45515d5b66b2095071609c243d2c987d650c71d0a27418e5de75a8b1ad44b7f45c5d97e71176640f0f49da94b32fb3d11e87cdd009bed26
"@vitest/spy@npm:4.1.11":
version: 4.1.11
resolution: "@vitest/spy@npm:4.1.11"
checksum: 10c0/06c68247a8efd21006abe7532fee17f30ba83c8cda3e0b952ef89e278d58058f4b1de69b6bbaa2ed614c568bf4f5769fcc76be42802dedf2bcdd9c0aae601740
languageName: node
linkType: hard

"@vitest/utils@npm:4.1.4":
version: 4.1.4
resolution: "@vitest/utils@npm:4.1.4"
"@vitest/utils@npm:4.1.11":
version: 4.1.11
resolution: "@vitest/utils@npm:4.1.11"
dependencies:
"@vitest/pretty-format": "npm:4.1.4"
"@vitest/pretty-format": "npm:4.1.11"
convert-source-map: "npm:^2.0.0"
tinyrainbow: "npm:^3.1.0"
checksum: 10c0/7f81db08e5a8db1e83a37a8d64db011ae3a08b5bcc9aa220a6da428385acb75b11c77b169ab7a9f753529cc25ec11406cff6099b92711fda6291f844fb840a4e
checksum: 10c0/a2c1ddc64333458c3e031465c1ee0440a7660fd1b298c54ccbf865ef1e5cf3ebdd6c5c75a5ea235d8a672498b394e7121f992b096f021f45014ab25e9abd1b52
languageName: node
linkType: hard

Expand Down Expand Up @@ -23352,16 +23352,16 @@ __metadata:
linkType: hard

"vitest@npm:^4.1.4":
version: 4.1.4
resolution: "vitest@npm:4.1.4"
dependencies:
"@vitest/expect": "npm:4.1.4"
"@vitest/mocker": "npm:4.1.4"
"@vitest/pretty-format": "npm:4.1.4"
"@vitest/runner": "npm:4.1.4"
"@vitest/snapshot": "npm:4.1.4"
"@vitest/spy": "npm:4.1.4"
"@vitest/utils": "npm:4.1.4"
version: 4.1.11
resolution: "vitest@npm:4.1.11"
dependencies:
"@vitest/expect": "npm:4.1.11"
"@vitest/mocker": "npm:4.1.11"
"@vitest/pretty-format": "npm:4.1.11"
"@vitest/runner": "npm:4.1.11"
"@vitest/snapshot": "npm:4.1.11"
"@vitest/spy": "npm:4.1.11"
"@vitest/utils": "npm:4.1.11"
es-module-lexer: "npm:^2.0.0"
expect-type: "npm:^1.3.0"
magic-string: "npm:^0.30.21"
Expand All @@ -23379,12 +23379,12 @@ __metadata:
"@edge-runtime/vm": "*"
"@opentelemetry/api": ^1.9.0
"@types/node": ^20.0.0 || ^22.0.0 || >=24.0.0
"@vitest/browser-playwright": 4.1.4
"@vitest/browser-preview": 4.1.4
"@vitest/browser-webdriverio": 4.1.4
"@vitest/coverage-istanbul": 4.1.4
"@vitest/coverage-v8": 4.1.4
"@vitest/ui": 4.1.4
"@vitest/browser-playwright": 4.1.11
"@vitest/browser-preview": 4.1.11
"@vitest/browser-webdriverio": 4.1.11
"@vitest/coverage-istanbul": 4.1.11
"@vitest/coverage-v8": 4.1.11
"@vitest/ui": 4.1.11
happy-dom: "*"
jsdom: "*"
vite: ^6.0.0 || ^7.0.0 || ^8.0.0
Expand Down Expand Up @@ -23414,8 +23414,8 @@ __metadata:
vite:
optional: false
bin:
vitest: vitest.mjs
checksum: 10c0/a85288778cf6a6f0222aaac547fc84f917565ba78d1e32df4693226ec93aa8675f549b246b70913e9f1d80a87830b39843f9bd96b39d270e599ff4f71def6260
vitest: ./vitest.mjs
checksum: 10c0/3fa0948cf74adcccc8cbcdb4e6d30ada6933bdfb1816ff99200f3d3b689325b37dc483b22535b57b6d911f7a7b64eaa6a5f8da1606cfe7f2466f48000c21e296
languageName: node
linkType: hard

Expand Down
Loading