Repository navigation
chore(deps): bump vitest to 4.1.11 in clients/web/package-lock.json (1 advisory) #2312
Description
Filed automatically from 1 open Dependabot alert (#2233). The fix is written by hand against v2/main.
| Package | vitest |
| Manifest | clients/web/package-lock.json |
Vulnerable on v2/main |
4.1.10 |
| Fixed in | 4.1.11 |
| Scope | development |
| Highest severity | medium |
Advisories
| GHSA | CVE | Severity | Vulnerable range | Summary |
|---|---|---|---|---|
| GHSA-82fw-gwwq-j7x9 | CVE-2026-84373 | medium | >= 2.1.0, < 4.1.11 | Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock |
Fix
Add an overrides entry pinning vitest to 4.1.11, for the copies below, which no declared range reaches. Not npm audit fix, which "resolves" an advisory with no upward escape by silently downgrading.
| Vulnerable copy | Version |
|---|---|
node_modules/vitest |
4.1.10 |
Note
Priority is a standing rubric override. A routine bump scores Medium; a security bump is filed High so it does not sit.
Where each number comes from. The GHSA, CVE, severity, vulnerable range and summary are the advisory's own, reported by Dependabot. What was verified independently against v2/main is the installed versions, their paths, and whether each advisory's range still matches — GitHub computes alerts from the default branch, so an alert is filed here only after that re-check.
Activity
cliffhall commentedon Sep 11, 2026
Triage: Priority High — standing override, not a rubric score.
Per AGENTS.md, an issue filed by the daily Dependabot alert sweep takes Todo / High by standing override; the rubric would otherwise score a routine bump Medium. Arriving through that pipeline is itself the approval, and the milestone was already set.
Board: #28, Status
Todo(card was missing — the sweep has no org-project token, so it filed the issue without boarding it).cliffhall commentedon Sep 11, 2026
Closed as a duplicate — this was already fixed by #2301 / PR #2315, which landed on
v2/mainas b0b5060 before this alert sweep ran.All four of #2310–#2313 are the same advisory (GHSA-82fw-gwwq-j7x9 / CVE-2026-84373, vulnerable
>= 2.1.0, < 4.1.11) fanned out per package × per lockfile. #2315 moved the whole pinned vitest constellation to4.1.11in one change, which covers this issue's target —vitestinclients/web/package-lock.json.Verified on the current
v2/main:vitest4.1.11,@vitest/mocker4.1.11clients/weblockfile:vitest4.1.11,@vitest/mocker4.1.11clients/{cli,tui,launcher}: novitestcopies at all, so nothing else in rangepackage.jsondeclaresvitest: "4.1.11"exactlyclients/web/package.jsoncarriesoverrides: { "vitest": "4.1.11" }, which moves the peer-shadow copyOne difference from the suggested fix worth recording: this issue asked for an
overridesentry pinning@vitest/mockerdirectly; #2315 pinnedvitestinstead, which pulls@vitest/mocker@4.1.11in with it. Same outcome with fewer pins.Per AGENTS.md,
Donemeans the work shipped under that card — nothing shipped under this number, so the board card is deleted rather than moved to Done. The issue stays searchable and linkable.