chore(deps): update dependency vitest to v4 [security] #10
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/npm-vitest-vulnerability"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
3.0.6→4.1.11When Vitest UI server is listening, arbitrary file can be read and executed
CVE-2026-47429 / GHSA-5xrq-8626-4rwp
More information
Details
Summary
Arbitrary file can be read on Windows when Vitest UI server is listening, especially when exposed to the network.
Impact
Only users that match either of the following conditions are affected:
--api.hostorapi.hostconfig option)Details
The API handler for
/__vitest_attachment__uses the deprecatedisFileServingAllowedincorrectly.github.com/vitest-dev/vitest@eb1abf0857/packages/ui/node/index.ts (L77)The function expects the passed value to use
cleanUrlafter the check before file system related operation.Because of this, it is possible to bypass the check by
\\?\\..\\. This is not possible on Linux as Linux errors if a directory named?does not exist.A similar problem exists in other places as well.
github.com/vitest-dev/vitest@eb1abf0857/packages/vitest/src/api/setup.ts (L103-L105)github.com/vitest-dev/vitest@eb1abf0857/packages/vitest/src/api/setup.ts (L119-L121)github.com/vitest-dev/vitest@eb1abf0857/packages/browser/src/node/commands/fs.ts (L10-L11)github.com/vitest-dev/vitest@eb1abf0857/packages/browser/src/node/plugin.ts (L194-L196)github.com/vitest-dev/vitest@eb1abf0857/packages/browser/src/node/rpc.ts (L115-L121)That said, this
isFileServingAllowedcheck does not actually prevent the API to be abused. Since the API has rerun feature and file write feature, it's possible to run arbitrary script by writing a script as a test file usingsaveTestFileand running it usingrerun. This means exposing the API / Vitest UI is equivalent to giving script execution access.On the browser mode side, there're
readFile/writeFile/saveSnapshotFile. So exposing the browser mode is equivalent to giving file read / write access.PoC
curl http://localhost:51204/__vitest__/curl "http://localhost:51204/__vitest_attachment__?path=C:\\path\\to\\project\\?\\..\\..\\secret.txt&contentType=text/plain&token=$TOKEN"(TOKEN is the API token)secret.txtthat is outside the project directoryMitigations
Vitest now ships two configuration flags,
allowWriteandallowExec, that gate the privileged operations exploited by this vulnerability. Both are disabled by default whenever the API server is bound to a non-localhosthost, ensuring that exposing the server to the network no longer implicitly grants write or execute capabilities to remote clients.When these flags are disabled, the UI also enters a read-only mode: in-browser code editing and test file execution are turned off, removing the attack surface that allowed remote code execution. Many Browser Mode features are also disabled, like attachments, artifacts or snapshots. See
browser.api.Users who require the full interactive UI on a networked host must explicitly opt in by setting
allowWriteand/orallowExectotrue.Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock
CVE-2026-84373 / GHSA-82fw-gwwq-j7x9
More information
Details
Summary
@vitest/mockerregisters a redirect mock's target path without validating itagainst the dev server's file-serving allowlist. An attacker who can reach the
dev server's WebSocket can register a redirect mock pointing outside the project
root; when the mocked module is requested, the plugin's
loadhook returnsreadFile(<attacker path>)as the module source, disclosing local files.This is exploitable without authentication only through the public
mockerPlugin/ standaloneinterceptorPluginexports (used by third-party devservers), which register the handler on Vite's unauthenticated HMR socket.
Vitest's own browser mode registers mocks over a token-authenticated RPC and
is not remotely reachable by default (see Scope).
Affected code
packages/mocker/src/node/interceptorPlugin.ts.The
loadhook is the file-read sink:mock.redirectis derived from client input at registration time with noboundary check:
There is no
server.fs.allow/server.fs.denycheck and no assertion that theresolved path stays within the project root.
Registration paths and trust boundaries
mockerPlugin/interceptorPlugin(unauthenticated). InconfigureServer, the plugin registersserver.ws.on('vitest:interceptor:register', …)on Vite's HMR WebSocket. That socket performs no token, Origin, or same-origin
check, so any client that can reach it can register a redirect mock. This is
the path the "unauthenticated" impact applies to.
(
registerMock), which sits behind a per-run token (isValidApiRequest, arandom
api.token). The interceptor'sconfigureServersocket is not used forregistration here (in v5 it does not run at all, as the plugin is injected per
environment). The same missing boundary check exists on the authenticated RPC
path, but reaching it requires the token, so it is not a remote-unauthenticated
read.
Path handling
new URL(redirect).pathnamecombined withjoin(root, pathname)does notconfine reads to the root:
file:,http:) are normalized by WHATWG URL,so
..segments are collapsed and the result stays under the root. Payloads ofthe form
file:///../../etc/passwddo not escape...inpathname, sojoin(root, "../../…/etc/passwd")resolves outside the root and reads anarbitrary file.
Even without escaping the root, the missing
server.fscheck allows reading anyin-root file the dev server would otherwise refuse to serve (for example an
in-root
.envor source that is denied byserver.fs.deny).Scope / preconditions
localhostbydefault and is not reachable from the network unless the developer exposes it
(
server.host/0.0.0.0, a LAN bind, or a proxy).and CORS protections entirely and can both register the mock and read the
response.
by Vite defaults: the default CORS origin allowlist is limited to
localhostorigins, and
server.allowedHostsblocks DNS-rebinding, so a cross-origin pagecannot read the file contents back.
Impact
Disclosure of local files readable by the dev-server process (source, in-root
.env/secrets, and, via the opaque-scheme payload, files outside the projectroot). No integrity or availability impact.
Affected versions
Present since
@vitest/mockerwas introduced.@vitest/mocker>= 2.1.0 (shipped invitestand@vitest/browser>= 2.1.0), through 4.1.x and the 5.0.0 pre-releases.maintained and are not planned to receive the fix.
Fix
Validate the resolved redirect target against Vite's file-serving allowlist
(
isFileLoadingAllowed) before registering it, at every registration site, andstop registering the interceptor WebSocket events in Vitest's browser mode
(mocks there flow through the authenticated RPC).
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
vitest-dev/vitest (vitest)
v4.1.11Compare Source
🐞 Bug Fixes
View changes on GitHub
v4.1.10Compare Source
🐞 Bug Fixes
View changes on GitHub
v4.1.9Compare Source
🐞 Bug Fixes
importOriginalwith optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in #10546 (a5180)View changes on GitHub
v4.1.8Compare Source
🐞 Bug Fixes
cdpAPI whenallowWrite/allowExec: false[backport to v4] - by @hi-ogawa and Codex in #10450 (e4067)View changes on GitHub
v4.1.7Compare Source
🐞 Bug Fixes
View changes on GitHub
v4.1.6Compare Source
🐞 Bug Fixes
ToMatchScreenshotResolvePath- by @macarie and @sheremet-va in #10138 (31882)sequence.concurrent: truewith top-leveltest(..., { concurrent: false })+ depreactesequentialtest API and options - by @hi-ogawa, Codex and @sheremet-va in #10196 (2847d)🏎 Performance
View changes on GitHub
v4.1.5Compare Source
🚀 Experimental Features
instrumenteroption - by @BartWaardenburg and @AriPerkkio in #10119 (0e0ff)🐞 Bug Fixes
vi.defineHelpercalled as object method - by @hi-ogawa in #10163 (122c2)agentreporter tominimal- by @sheremet-va in #10157 (663b9)View changes on GitHub
v4.1.4Compare Source
🚀 Experimental Features
skipFullif agent detected - by @hi-ogawa in #10018 (53757)assertionas a public field - by @sheremet-va in #10095 (a120e)🐞 Bug Fixes
expect(..., message)consistent as error message prefix - by @hi-ogawa and Codex in #10068 (a1b5f)View changes on GitHub
v4.1.3Compare Source
🚀 Experimental Features
experimental.preParseflag - by @sheremet-va in #10070 (78273)browser.locators.exactoption - by @sheremet-va in #10013 (48799)TestAttachment.bodyEncoding- by @hi-ogawa in #9969 (89ca0)🐞 Bug Fixes
expect.pollinterval - by @hi-ogawa and Claude Sonnet 4.6 in #10022 (3f5bf)@vitest/coverage-v8and@vitest/coverage-istanbulas optional dependency - by @alan-agius4 in #10025 (146d4)defineHelperfor webkit async stack trace + update playwright 1.59.0 - by @hi-ogawa in #10036 (5a5fa)JestExtendError.contextfrom verbose error reporting - by @hi-ogawa in #9983 (66751)vitest- by @hi-ogawa and Codex in #10042 (691d3)View changes on GitHub
v4.1.2Compare Source
This release bumps Vitest's
flattedversion and removes version pinning to resolveflatted's CVE related issues (#9975).🐞 Bug Fixes
setupFilesfrom parent directory - by @hi-ogawa in #9960 (7aa93)toMatchScreenshotcan't capture a stable screenshot - by @macarie in #9847 (faace)coverageConfigDefaultsvalues and types - by @Arthie in #9940 (b3c99)View changes on GitHub
v4.1.1Compare Source
🚀 Features
matchesTagsto test if the current filter matches tags - by @sheremet-va in #9913 (eec53)experimental.vcsProvider- by @sheremet-va in #9928 (56115)🐞 Bug Fixes
TestProject.testFilesListinternal properly - by @sapphi-red in #9867 (54f26)use- by @oilater in #9831 and #9861 (633ae)vi.advanceTimersto the preview provider - by @sheremet-va in #9891 (1bc3e)--standalonemode without running tests - by @sheremet-va in #9911 (e78ad)body- by @sheremet-va in #9912 (6fdb2)retry.conditionRegExp serialization issue - by @nstepien and @hi-ogawa in #9942 (7b605)testreturn as tests - by @sheremet-va in #9871 (141e7)View changes on GitHub
v4.1.0Compare Source
Vitest 4.1 is out!
This release page lists all changes made to the project during the 4.1 beta. To get a review of all the new features, read our blog post.
🚀 Features
setTickModeto timer controls - by @atscott and @sheremet-va in #8726 (4b480)toTestSpecificationto reported tasks - by @sheremet-va in #9464 (1a470)vi.mockorvi.hoistedare declared outside of top level of the module - by @sheremet-va in #9387 (5db54)aroundEachandaroundAllhooks - by @sheremet-va in #9450 (2a8cb)neworallin--updateflag - by @sheremet-va in #9543 (a5acf)metain test options - by @sheremet-va in #9535 (7d622)test.extendsyntax - by @sheremet-va in #9550 (e5385)vitest listto statically collect tests instead of running files to collect them - by @sheremet-va in #9630 (7a8e7)--detect-async-leaks- by @AriPerkkio in #9528 (c594d)mockThrowandmockThrowOnce- by @thor-juhasz and @sheremet-va in #9512 (61917)update: "none"and add docs about snapshots behavior on CI - by @hi-ogawa in #9700 (05f18)launchOptionswithconnectOptions- by @hi-ogawa in #9702 (f0ff1)page/locator.markAPI to enhance playwright trace - by @hi-ogawa in #9652 (d0ee5)testinexperimental_parseSpecification- by @jgillick and Jeremy Gillick in #9235 (2f367)createSpecification- by @sheremet-va in #9336 (c8e6c)runTestFilesas alternative torunTestSpecifications- by @sheremet-va in #9443 (43d76)allowWriteandallowExecoptions toapi- by @sheremet-va in #9350 (20e00)toTestSpecification- by @sheremet-va in #9627 (6f17d)userEvent.wheelAPI - by @macarie in #9188 (66080)filterNodeoption to prettyDOM for filtering browser assertion error output - by @Copilot, sheremet-va and @sheremet-va in #9475 (d3220)detailsPanelPositionoption and button - by @shairez in #9525 (c8a31)findElementand enable strict mode in webdriverio and preview - by @sheremet-va in #9677 (c3f37)ignore start/stopignore hints - by @AriPerkkio in #9204 (e59c9)coverage.changedoption to report only changed files - by @kykim00 and @AriPerkkio in #9521 (1d939)onModuleRunnerhook toworker.init- by @sheremet-va in #9286 (e977f)importDurations: { limit, print }options - by @hi-ogawa, Claude Opus 4.6 and @sheremet-va in #9401 (7e10f)importDurations- by @hi-ogawa and Claude Opus 4.6 in #9533 (3f7a5)beforeAll/afterAll- by @sheremet-va in #9572 (c8339)agentreporter to reduce ai agent token usage - by @cpojer in #9779 (3e9e0)retryoptions - by @MazenSamehR, Matan Shavit, @AriPerkkio and @sheremet-va in #9370 (9e4cf)🐞 Bug Fixes
meta.urlincreateRequire- by @sheremet-va in #9441 (e3422)external/noExternalduringconfigEnvironmenthook - by @hi-ogawa and Claude Opus 4.6 in #9508 (59ea2)browser.isolateis used - by @sheremet-va in #9410 (3d48e)vi.mock({ spy: true })node v8 coverage - by @hi-ogawa, hi-ogawa and Claude Opus 4.6 in #9541 (687b6).namefrom statically collected test - by @sheremet-va in #9596 (b66ff)expect.soft- by @iumehara, @hi-ogawa and Claude Opus 4.6 in #9231 (3eb2c)sequence.shuffle.testsis enabled - by @kaigritun, Kai Gritun and @sheremet-va in #9576 (8182b)expect/src/utilsfromvitest- by @hi-ogawa in #9616 (48739)--detect-async-leaks- by @AriPerkkio in #9638 (9fd4c)aroundEach/Allwhen inneraroundEach/Allthrows - by @hi-ogawa in #9657 (4ec6c)aroundEach/Allsetup timed out - by @hi-ogawa in #9670 (bb013)VitestRunnerConfigoptional fields withSerializedConfig- by @hi-ogawa in #9661 (79520)toBe*spy assertions in favor oftoHaveBeen*(andtoThrowError) - by @sheremet-va in #9665 (4d390)aroundEach/Allerrors but aggregate them on runner - by @hi-ogawa in #9673 (b6365)resolves/rejectschained assertion error - by @hi-ogawa in #9679 (c6151)maxConcurrency- by @hi-ogawa in #9653 (16d13)resolve.conditionsfor externals - by @hi-ogawa in #9717 (1d498)mockObjectchange backwards compatible - by @sheremet-va in #9744 (84c69)URL.nameon jsdom - by @hi-ogawa in #9767 (031f3)vi.importActual()for virtual modules - by @hi-ogawa and Claude Opus 4.6 in #9772 (1e89e)FixtureAccessErrorif suite hook accesses undefined fixture - by @sheremet-va in #9786 (fc2ce)loadortransformoriginal module - by @hi-ogawa and Claude Opus 4.6 in #9774 (a8216)hideSkippedTestsshould not hidetest.todo- by @oilater in #9562 and #9781 (8181e)beforeEachhooks - by @hi-ogawa and Claude Opus 4.6 in #9826 (99e52)performance.nowto measure test timeout duration - by @hi-ogawa and Claude Opus 4.6 in #9795 (f48a6)toMatchScreenshotpasses - by @macarie in #9289 (46aab)toMatchScreenshot- by @macarie in #9552 (83ca0)--remote-debugging-addressfrom chrome args - by @hi-ogawa and @AriPerkkio in #9712 (f09bb)ensureAwaited- by @sheremet-va in #9732 (97685)getCDPSessionandcdp()- by @AriPerkkio in #9716 (689a2)deepEqualin the config because it's not serializable - by @sheremet-va in #9666 (9ee99)thresholds.autoUpdateto preserve ending whitespace - by @AriPerkkio in #9436 (7e534)/config/#optionhash links causing hydration errors - by @hi-ogawa, Claude Opus 4.6 and @sheremet-va in #9610 (a603c)toMatchObject(Map/Set)should expectMap/Seton left hand side - by @hi-ogawa and Claude Opus 4.6 in #9532 (381da)toThrowand make Error detection robust - by @hi-ogawa and Claude Opus 4.6 in #9570 (de215)dotreporter leaves pending tests - by @AriPerkkio in #9684 (4d793)undefined- by @sheremet-va in #9511 (6f181)bench.reportersno longer gives type errors when passing file name string paths - by @Bertie690 in #9695 (093c8)🏎 Performance
View changes on GitHub
v4.0.18Compare Source
🚀 Experimental Features
onModuleRunnerhook toworker.init- by @sheremet-va in #9286 (ea837)🐞 Bug Fixes
meta.urlincreateRequire- by @sheremet-va in #9441 (e0572)View changes on GitHub
v4.0.17Compare Source
🚀 Experimental Features
🐞 Bug Fixes
addEventHandler#9371 - by @ThibautMarechal in #9372 and #9371 (40841)process.envandimport.meta.envdefines in inline project - by @hi-ogawa in #9239 (b70c9)ErrorEvent.messagewhen unhandledErrorEvent.erroris null - by @hi-ogawa in #9322 (5d84e)fileParallelismon an instance - by @sheremet-va in #9328 (15006)istanbul-lib-source-mapsusage - by @AriPerkkio in #9344 (b0940)View changes on GitHub
v4.0.16Compare Source
🐞 Bug Fixes
process.versionsstub - by @AriPerkkio in #9174 (78cfb)test.poolOptionsif it's set - by @sheremet-va in #9226 (f7f6a)recordArtifactfrom the vitest package - by @macarie in #9186 (01c56)import.meta.envdefine - by @hi-ogawa in #9205 (01a9a)setupEnvironmentfor custom pools - by @AriPerkkio in #9187 (5d26b)View changes on GitHub
v4.0.15Compare Source
🚀 Experimental Features
🐞 Bug Fixes
optimizeDeps.rolldownOptionsto fix depreated warning + fixssr.external: true- by @hi-ogawa in #9121 (fd8bd)deps.optimizer- by @hi-ogawa in #9125 (4c754)toMatchScreenshotonly once when used withexpect.element- by @macarie in #9132 (0d2e7)--browser.providerfrom docs - by @sheremet-va in #9115 (120b3)currentTestNamein extended matchers - by @macarie in #9106 (e4345)CTRL+cforceful exits - by @AriPerkkio in #9140 (d57d8)View changes on GitHub
v4.0.14Compare Source
🚀 Experimental Features
utils.configurePrettyDOM- by @sheremet-va in #9103 (2cc34)toMatchScreenshotwith comparison slider - by @macarie in #8813 (c37c2)🐞 Bug Fixes
collecttoimport, removeprepare- by @sheremet-va in #9091 (1256b)onCancelon rpc destroy - by @AriPerkkio in #9088 (f5b72)VITEST_POOL_ID+VITEST_WORKER_IDbefore environment setup - by @AriPerkkio in #9085 (37918)postMessageto send ports to workers - by @whitphx and @AriPerkkio in #9078 (9d176)🏎 Performance
debugwithobug- by @sxzz and @AriPerkkio in #9057 (acc51)View changes on GitHub
v4.0.13Compare Source
🐞 Bug Fixes
🏎 Performance
fsCacheModuleis enabled, read from the memory when possible - by @sheremet-va in #9076 (6b9a1)View changes on GitHub
v4.0.12Compare Source
🐞 Bug Fixes
fsModuleCachePathby default - by @sheremet-va in #9063 (9a8bc)@opentelemetry/apiin public types - by @sheremet-va in #9066 (e944a)View changes on GitHub
v4.0.11Compare Source
🚀 Experimental Features
taskinMatchState- by @macarie in #9022 (afd1f)🏎 Performance
View changes on GitHub
v4.0.10Compare Source
🐞 Bug Fixes
onCancelwhen worker is terminated - by @sheremet-va in #9033 (6d7f0)onFinished) - by @userquin in #8975 (f56dc)View changes on GitHub
v4.0.9Compare Source
🚀 Experimental Features
🐞 Bug Fixes
Request- by @sheremet-va in #8985 (506a9)View changes on GitHub
v4.0.8Compare Source
🐞 Bug Fixes
noExternalmerging bug on Vite 6 - by @hi-ogawa in #8950 (bcb13)expect.element()- by @StyleShit in #8954 (9638d)vi.fn(), fix types forvi.spyOn(obj, class)- by @sheremet-va in #8956 (75e7f)View changes on GitHub
v4.0.7Compare Source
🐞 Bug Fixes
processin case global is overwritten - by @AriPerkkio in #8916 (6240d)isolate: false- by @sheremet-va in #8915 (c9078)toContainElement()matcher - by @vitalybaev in #8910 and #8927 (35a27)isolateoption, deprecatebrowser.isolate/browser.fileParallelism- by @sheremet-va in #8890 (9d2b4)--execArgvas array - by @AriPerkkio in #8924 (751c3)URL.createObjectURL,FormData.set(prop, blob)- by @sheremet-va in #8935 (a1b73)--requireargument when running in deno - by @pi0 in #8897 (d41fa)tsc- by @AriPerkkio in #8920 (fdb2e)🏎 Performance
Array.fromcall - by @Connormiha in #8907 (b6014)View changes on GitHub
v4.0.6Compare Source
🐞 Bug Fixes
isolateandfileParallelismare false - by @sheremet-va in #8889 (31706)FormDatatoRequest- by @sheremet-va in #8880 (197ca)View changes on GitHub
v4.0.5Compare Source
🐞 Bug Fixes
ssr.noExternalwhen externalizing dependencies, fix Svelte and Astro - by @sheremet-va in #8862 (a4f86)Locatortype in selectOptions element parameter - by @rzzf and @sheremet-va in #8848 (7ee28)getBuiltinsunconditionally - by @sapphi-red in #8863 (0e858)groupIdtogroupOrderin error message - by @Yohannfra in #8856 (b9aab)🏎 Performance
--no-isolate --maxWorkers=1- by @AriPerkkio in #8835 (584aa)View changes on GitHub
v4.0.4Compare Source
🐞 Bug Fixes
node:prefix - by @sheremet-va in #8829 (06208)MaxListenersExceededWarning- by @AriPerkkio in #8820 (d1bff)stdioto logger - by @AriPerkkio in #8809 (fb95f)vi.mockedutility - by @sheremet-va in #8839 (f8756)isolate: false- by @AriPerkkio in #8821 (573dc)🏎 Performance
View changes on GitHub
v4.0.3Compare Source
🐞 Bug Fixes
View changes on GitHub
v4.0.2Compare Source
🐞 Bug Fixes
length- by @sheremet-va in #8778 (d4c2b)restoreMocksandmockResetare set in the config - by @sheremet-va in #8781 (2eedb)View changes on GitHub
v4.0.1Compare Source
🐞 Bug Fixes
getBuiltinscheck - by @sheremet-va in #8765 (81000)View changes on GitHub
v4.0.0Compare Source
Vitest 4.0 is out!
To stay updated, read our blog post and check the migration guide.
🚨 Breaking Changes
'basic'reporter - by @AriPerkkio in #7884 (82fcf)vitest/nodeexports - by @sheremet-va in #8197 (dc848)vitest/nodeinstead - by @sheremet-va in #8200 (1e60c)workspaceoption in favor ofprojects- by @sheremet-va in #8218 (76fb7)--standalonewhen CLI filename filter is used - by @AriPerkkio in #8262 (013bf)minWorkersand set it automatically to 0 in non watch mode - by @sheremet-va in #8454 (2c2d1)treereporter - by @sheremet-va and @AriPerkkio in #8500 (25fd3)tinypool- by @AriPerkkio and @sheremet-va in #8705 (4822d)todoif no function is passed down totestordescribe- by @sheremet-va in #8346 (1a81c)🚀 Features
onUnhandledErrorcallback - by @sheremet-va in #8162 (924cb)expect.assertfor type narrowing - by @sheremet-va in #8695 (fe589)displayAnnotationsoption togithub-options- by @sheremet-va in #8706 (4a66d)experimental_parseSpecifications- by @sheremet-va in #8408 (fdeb2)enableCoverageanddisableCoveragemethods - by @sheremet-va and @AriPerkkio in #8412 (61eb7)getGlobalTestNamePatternmethod - by @sheremet-va in #8438 (bdb70)relativeModuleIdtoTestModule- by @sheremet-va in #8505 (3be09)getSeedmethod - by @sheremet-va in #8592 (438c4)toBeInViewportutility method to assert element is in viewport or not - by @Shinyaigeek in #8234 (ceed5)vitest initcli command - by @thejackshelton in #8330 (1638b)toMatchScreenshotfor Visual Regression Testing - by @macarie in #8041 (d45f9)trackUnhandledErrorsoption - by @sheremet-va in #8386 (c0ec0)lengthproperty to locators,toHaveLengthnow accepts locators - by @sheremet-va in #8512 (2308c)optionsonBrowserProviderOption- by @sheremet-va in #8609 (0d0e5)--inspectoption in webdriverio - by @sheremet-va in #8613 (38adc)autoUpdateto support percentage formatting - by @Battjmo and @AriPerkkio in #8456 (99e01)toBeNullableexpect function to check provided value is nullish - by @Shinyaigeek and @sheremet-va in #8294 (eeec5)automockerentry - by @sheremet-va in #8301 (e9c92)🐞 Bug Fixes
test.extend- by @AriPerkkio in #8278 (43977)--changedflag support tovitest listcommand - by @haakonjackfloat in #8270 and #8272 (e71a5)browser- by @sheremet-va in #8334 (0417a)oxcinstead ofesbuildonrolldown-vite- by @hi-ogawa in #8378 (e922e)stacksproperty in Node.js context - by @sheremet-va in #8392 (b825e)import.meta.resolveon Vite 7 - by @hi-ogawa in #8493 (549d3)expect.pollassertion fails - by @sheremet-va in #8483 (fb450)useFakeTimersis called multiple times - by @sheremet-va in #8504 (ed7e3)expect.extendmatchers - by @lzl0304 in #8520 (96945)globalSetupfiles - by @sheremet-va in #8534 (8978a)$and%formatting totest.for/eachtitle - by @hi-ogawa in #8557 (ea6d7)"./*"with specific files in vitest package - by @hi-ogawa in #8560 (ce746)optimizeDeps.includefor browser mode - by @jake-danton in #8570 (cdcf7)enginesfield to drop Node 18 support - by @sheremet-va in #8608 (9a0bf)baseoption doesn't crash vitest - by @sheremet-va in #8760 (9f0ec)locator.element()returnsHTMLElementorSVGElement- by @sheremet-va in #8440 (c1ac1)vitedirectly - by @sheremet-va in #8541 (d7fca)not.toBeInTheDocument()- by @sheremet-va in #8751 (f5d06)objectContainingexpect utility to have more compatibility to jest's one - by @Shinyaigeek in #8241 (480be)--projectfilter - by @gtbuchanan in #7885 (761be)vitest:coverage-transformplugin - by @AriPerkkio in #8477 (ff517)coverage.exclude- by @sheremet-va in #8731 (c9c30)regexpHoistableto allow whitespace before parentheses - by @cszhjh in #8231 (a0f9a)resolvedSourcescorrectly - by @sheremet-va in #8736 (8fc52)vitest --standalone- by @AriPerkkio in #8248 (37cc2)config.includeoption withconfig.browser.instances[].includeoption if it is specified - by @Shinyaigeek in #8260 (010fc)🏎 Performance
process.title- by @sheremet-va in #8453 (0a766)@vitest/expect- by @sheremet-va in #8461 (cc98c)workerIdfrom a global object - by @sheremet-va in #8507 (46b13)meta.resolveflag instead of a custom loader - by @sheremet-va in #8567 (2e063)View changes on GitHub
v3.2.7Compare Source
🐞 Bug Fixes
View changes on GitHub
v3.2.6Compare Source
🐞 Bug Fixes
View changes on GitHub
v3.2.5Compare Source
🚀 Features
allowWriteandallowExecoptions toapi[backport to v3] - by @hi-ogawa and Codex in #10445 (af88b)🐞 Bug Fixes
cdpAPI whenallowWrite/allowExec: false[backport to v3] - by @hi-ogawa and Codex in #10456 (385a1)View changes on GitHub
v3.2.4Compare Source
🐞 Bug Fixes
vitest run --watchshould be watch-mode - by @AriPerkkio in #8128 (657e8)--shard x/<count>exceeds count of test files - by @AriPerkkio in #8112 (8a18c)minWorkerswhen onlymaxWorkersspecified - by @AriPerkkio in #8110 (14dc0)task.metashould be available in custom reporter's errors - by @AriPerkkio in #8115 (27df6)View changes on GitHub
v3.2.3Compare Source
🚀 Features
🐞 Bug Fixes
expect.anyreturn type - by @sheremet-va in #8129 (47514)process.send()- by @AriPerkkio in #8125 (dfe81)View changes on GitHub
v3.2.2Compare Source
🚀 Features
🐞 Bug Fixes
createTesterscall on the main thread - by @sheremet-va in #8101 (142c7)vitest-browser-*packages - by @sheremet-va in #8103 (247ef)toEqual- by @dubzzz in #8094 (02ec8)dotreporter to work in non interactive terminals - by @bstephen1 and @AriPerkkio in #7994 (6db9f)View changes on GitHub
v3.2.1Compare Source
🐞 Bug Fixes
DeeplyAllowMatchers- by @sheremet-va in #8078 (30ab4)View changes on GitHub
v3.2.0Compare Source
🚀 Features
ctx.signal- by @sheremet-va in #7878 (e761f)test.name- by @AriPerkkio in #7809 (4af5d)vi.mockObjectto automock any object - by @hi-ogawa and @sheremet-va in #7761 (465bd)watchTriggerPatternsoption - by @sheremet-va in #7778 (a0675)workspacein favor ofprojects- by @sheremet-va and @AriPerkkio in #7923 (41beb)sequence.groupOrderoption - by @sheremet-va in #7852 (d1a1d)connectoption forplaywrightbrowser provider - by @egfx-notifications and @sheremet-va in #7915 (029c0)screenshot.saveoption - by @sheremet-va in #7777 (d9f51)onWritePathoption togithub-actions- by @nwalters512 and @AriPerkkio in #8015 (abd3b)🐞 Bug Fixes
micromatchwithpicomatch- by @sapphi-red in #7951 (df076)anytypes toAsymmetricMatcher<unknown>, withDeeplyAllowMatchers<T>- by @JoshuaKGoldberg in #7016 (8ec44)stackproperties - by @sheremet-va in #7995 (330f9)toJSONserialisation - by @sheremet-va in #8053 (3bdf0)uploadfiles relative to the project root - by @sheremet-va in #8042 (b9a31)thistype tolocators.extend- by @sheremet-va in #8069 (70fb0)--silentvalues properly - by @AriPerkkio in #8055 (8fad7)@types/chai- by @hi-ogawa in #7937 (525f5)vitest listcommand - by @sheremet-va in #7933 (ba6da)__vite_ssr_exportName__- by @hi-ogawa in #7925 (76091)getWorkerMemoryLimitpriority for vmForks - by @pengooseDev in #7960 (5a91e)View changes on GitHub
v3.1.4Compare Source
🐞 Bug Fixes
View changes on GitHub
v3.1.3Compare Source
🐞 Bug Fixes
inline: trueis set - by @sheremet-va in #7856 (a83f3)--merge-reportsto show each total run times - by @AriPerkkio in #7877 (d613b)View changes on GitHub
v3.1.2Compare Source
🐞 Bug Fixes
chaivariable invitest/globals(fix: #7474) - by @Jay-Karia in #7771 and #7474 (d9297)test.excludewhen same object passed incoverage.exclude- by @AriPerkkio in #7774 (c3751)envionmentOptions- by @hi-ogawa in #7795 (67430)awaitprofiler calls - by @AriPerkkio in #7763 (795a6)🏎 Performance
View changes on GitHub
v3.1.1Compare Source
🐞 Bug Fixes
View changes on GitHub
v3.1.0Compare Source
🚀 Features
%$option to add number of the test to its title - by @kemuridama in #7412 (df347)diff.maxDepthoption and set non-Infinityvalue as a default to reduce crash - by @hi-ogawa in #7481 (eacab)test.each/fortitle formatting - by @hi-ogawa in #7522 (ea3d6)--configLoaderCLI option - by @Carnageous and @hi-ogawa in #7574 (2a852)vitest-browser-littovitest init browserand docs - by @EskiMojo14 and @hi-ogawa in #7705 (5659a)and,orandfilterlocators - by @sheremet-va and @AriPerkkio in #7463 (63949)--silent=passed-onlyto log failed tasks only - by @AriPerkkio in #7530 (f9e1c)test.scopedto overridetest.extendfixtures per-suite - by @sheremet-va in #7233 (e5851)context.skip(boolean)- by @sheremet-va and @AriPerkkio in #7659 (6adec)🐞 Bug Fixes
diff.expand: falseas default - by @hi-ogawa in #7697 (f3420)--hideSkippedTestsshould hide suites too - by @AriPerkkio in #7695 (ba9b5)🏎 Performance
View changes on GitHub
v3.0.9Compare Source
🐞 Bug Fixes
ctx.skip()asnever- by @sirlancelot in #7608 (09f35)resolveConfigAPI - by @hi-ogawa in #7623 (db14a)toHaveBeenCalledWith(asymmetricMatcher)withundefinedarguments - by @hi-ogawa in #7624 (0fb21)getState().testPathduring collection with no isolation - by @hi-ogawa in #7640 (3fb3f)coverage.all- by @AriPerkkio in #7597 (422ba)buildStart- by @hi-ogawa in #7652 (29f5a)removeEventListeneris bound to worker - by @joelgallant in #7631 (ff42b)View changes on GitHub
v3.0.8Compare Source
🐞 Bug Fixes
@vitest/spy- by @mrginglymus in #7575 (7f7ff)beforeEach/Allcleanup callback timeout - by @hi-ogawa in #7500 (0c292)Task.suiteinitialization - by @hi-ogawa in #7414 (ca9ff)buildStarton Vite 6 - by @hi-ogawa in #7480 (c0f47)View changes on GitHub
v3.0.7Compare Source
🐞 Bug Fixes
🏎 Performance
View changes on GitHub
Configuration
📅 Schedule: (in timezone Europe/Berlin)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.