Repository navigation
chore(deps-dev): bump vitest to 4.1.12 and drop stale audit allowlist entries - #597
Open
Matt Sutkus (msuitcase) wants to merge 2 commits into
Open
Matt Sutkus (msuitcase) wants to merge 2 commits into
Matt Sutkus (msuitcase) wants to merge 2 commits into
Conversation
… entries Fixes GHSA-qxg6-89mg-rqv8 and GHSA-xp26-3454-mjgp in @vitest/mocker. Lockfile only; package.json ranges are unchanged. Removes GHSA-4mjr-xmp4-gh2g and GHSA-x5fp-wj9c-mxmx from audit-ci.jsonc, which audit-ci reports as no longer matching anything.
Matt Sutkus (msuitcase)
marked this pull request as ready for review
October 23, 2026 09:23
Justin Hammond (Justintime50)
approved these changes
Oct 23, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Why
just scan(audit-ci) now fails on every PR. GHSA-qxg6-89mg-rqv8 and GHSA-xp26-3454-mjgp (moderate) affect@vitest/mocker<4.1.12, pulled in byvitestand@vitest/coverage-istanbul. They are dev-only. Dependabot #595 fixes theviteandmarkdown-itadvisories but leaves these two.Change
package-lock.json:vitest,@vitest/coverage-istanbuland@vitest/mocker(plus the other@vitest/*packages that move in lockstep) 4.1.11 → 4.1.12.package.jsonis unchanged.audit-ci.jsonc: remove GHSA-4mjr-xmp4-gh2g and GHSA-x5fp-wj9c-mxmx from the allowlist; audit-ci reports they no longer match anything.Not touched: #595.
Testing
npm ci,npm run buildandnpm testpass locally (36 files, 190 tests).npm run scanno longer reports any vitest advisory. It still fails on theviteandmarkdown-itadvisories until #595 merges, solintstays red on this PR until then.Pull Request Type