Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update dependency @vitest/browser to v2.1.9 [SECURITY] #18

Open
wants to merge 1 commit into
base: next
Choose a base branch
from

Conversation

renovate[bot]
Copy link

@renovate renovate bot commented Feb 16, 2025

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@vitest/browser (source) 2.0.5 -> 2.1.9 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2025-24963

Summary

__screenshot-error handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by browser.api.host: true, an attacker can send a request to that handler from remote to get the content of arbitrary files.

Details

This __screenshot-error handler on the browser mode HTTP server responds any file on the file system.
https://github.com/vitest-dev/vitest/blob/f17918a79969d27a415f70431e08a9445b051e45/packages/browser/src/node/plugin.ts#L88-L130

This code was added by vitest-dev/vitest@2d62051.

PoC

  1. Create a directory and change the current directory to that directory
  2. Run npx vitest init browser
  3. Run npm run test:browser
  4. Run curl http://localhost:63315/__screenshot-error?file=/path/to/any/file

Impact

Users explicitly exposing the browser mode server to the network by browser.api.host: true may get any files exposed.


Release Notes

vitest-dev/vitest (@​vitest/browser)

v2.1.9

Compare Source

This release includes security patches for:

   🐞 Bug Fixes
    View changes on GitHub

v2.1.8

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.1.7

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.1.6

Compare Source

🚀 Features

  • Support Vite 6
    View changes on GitHub

v2.1.5

Compare Source

   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub

v2.1.4

Compare Source

   🚀 Features

This patch release includes a non-breaking feature for the experimental Browser Mode that doesn't follow SemVer. If you want to avoid picking up releases like this, make sure to pin the Vitest version in your package.json. See npm's documentation about semver for more information.

   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub

v2.1.3

Compare Source

   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub

v2.1.2

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.1.1

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v2.1.0

Compare Source

This release makes another big change to the Browser Mode by introducing locators API:

test('renders blog posts', async () => {
  const screen = page.render(<Blog />)

  await expect.element(screen.getByRole('heading', { name: 'Blog' })).toBeInTheDocument()

  const [firstPost] = screen.getByRole('listitem').all()

  await firstPost.getByRole('button', { name: 'Delete' }).click()

  expect(screen.getByRole('listitem').all()).toHaveLength(3)
})

You can use either vitest-browser-vue, vitest-browser-svelte or vitest-browser-react to render components and make assertions using locators. Locators are also available on the page object from @vitest/browser/context.

Potential Breaking Change
  • workspace:
    • Correctly resolve workspace globs and file paths  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6316 (afdcb)
    • This changes how the custom glob pattern in the workspace config is treated. Any file matching the glob is considered a Vitest config file. Any folder matching the glob pattern is treated as a workspace project and is subject to the regular config resolution (single vitest.config.ts or vite.config.ts inside the folder)
    • For example, projects/* will match anything inside the projects folder. If it's a folder, we try to find the config inside that folder (if there is none, it is still treated as a project with the default config). If it's a file, it will be treated as a Vitest config. projects/**/* previously would assume that you only wanted to have folders as projects, but now it will match every single file insideprojects.
    • This change doesn't affect non-glob usage.
   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Copy link

github-actions bot commented Feb 16, 2025

Fails
🚫

PR is not labeled with one of: ["cleanup","BREAKING CHANGE","feature request","bug","documentation","maintenance","build","dependencies"]

🚫

PR is not labeled with one of: ["ci:normal","ci:merged","ci:daily","ci:docs"]

🚫 PR title must be in the format of "Area: Summary", With both Area and Summary starting with a capital letter Good examples: - "Docs: Describe Canvas Doc Block" - "Svelte: Support Svelte v4" Bad examples: - "add new api docs" - "fix: Svelte 4 support" - "Vue: improve docs"

Generated by 🚫 dangerJS against 6739027

@renovate renovate bot force-pushed the renovate/npm-vitest-browser-vulnerability branch from 58afa34 to 6739027 Compare February 19, 2025 03:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants