Skip to content

fix: bump vitest to ^3.2.6 (critical Dependabot advisory) #13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chiliec merged 1 commit into from
Jun 22, 2026
Merged

fix: bump vitest to ^3.2.6 (critical Dependabot advisory) #13

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions .changeset/bump-vitest-security.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
---
"@viz-cx/core": patch
---

Bump `vitest` and `@vitest/coverage-v8` from `^1.6.0` to `^3.2.6`, resolving the critical Dependabot advisory (Vitest UI server arbitrary file read/exec, GHSA fixed in 3.2.6). Dev-dependency only — no change to the published surface.

All gates pass under vitest 3: lint, typecheck, 106/106 unit tests, tsd, attw exports, tarball size. Coverage config: excluded ambient `.d.ts` files and recalibrated the `functions` threshold (vitest 3's v8 provider counts inner closures/arrows as uncovered even when their lines run, so lines/statements/branches remain the meaningful gates at 98%/98%/92%).

The low-severity esbuild advisory (dev-server file read on Windows, transitively via `tsup`) is intentionally not addressed here: the patched esbuild `0.28.1` is outside tsup 8.5.1's declared `^0.27.0` range, and the vector (dev server on Windows) does not apply to this repo's Linux CI / `vitest run` usage. Revisit once tsup widens its esbuild range.
4 changes: 2 additions & 2 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,12 +67,12 @@
"@types/node": "^20.14.0",
"@typescript-eslint/eslint-plugin": "^7.13.0",
"@typescript-eslint/parser": "^7.13.0",
"@vitest/coverage-v8": "^1.6.0",
"@vitest/coverage-v8": "^3.2.6",
"eslint": "^8.57.0",
"tsd": "^0.31.1",
"tsup": "^8.1.0",
"typescript": "^5.4.5",
"vitest": "^1.6.0",
"vitest": "^3.2.6",
"viz-js-lib": "^0.12.7"
},
"publishConfig": {
Expand Down
Loading