Repository navigation
fix(deps): bump vitest to 4.1.12 for @vitest/mocker advisories - #88
Merged
Merged
Conversation
@vitest/mocker 4.1.11 allowed code injection through unauthenticated manual mock registration and had a Windows backslash traversal. Both are fixed in 4.1.12. vite is already pinned at 8.2.4 via overrides. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Deploying furedea-com with
|
| Latest commit: |
ec48d7c
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://568928d3.furedea-com.pages.dev |
| Branch Preview URL: | https://fix-vitest-advisories.furedea-com.pages.dev |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
概要
vitest を 4.1.11 から 4.1.12 に更新し，
pnpm-lock.yaml経由で検出されている @vitest/mocker の Dependabot アラートを解消する．背景
@vitest/mocker 4.1.11 には次の脆弱性がある．4.1.12 で修正済み．
vite は overrides で 8.2.4 に固定済みで，vite 側の advisory（launch-editor，
server.fs.allow）の修正版（8.1.6 以上）を満たしているため変更しない．変更内容
package.json:vitestを 4.1.12 に更新pnpm-lock.yaml:vitestと@vitest/*を 4.1.12 に更新．未使用になった@jridgewell/sourcemap-codecとtinyexecが削除されたminimumReleaseAge（7日）の設定は変更していない確認
pnpm check（format，lint，typecheck，test，knip，build，verify:build）が成功lefthook run pre-commit --all-filesが成功🤖 Generated with Claude Code