Skip to content

fix: upgrade vitest package to ^4.1.8#2048

Merged
marrouchi merged 20 commits into
mainfrom
fix/security-upgrade-vitest-package-version
Jun 12, 2026
Merged

fix: upgrade vitest package to ^4.1.8#2048
marrouchi merged 20 commits into
mainfrom
fix/security-upgrade-vitest-package-version

Conversation

@yassinedorbozgithub

@yassinedorbozgithub yassinedorbozgithub commented Jun 12, 2026

Copy link
Copy Markdown
Collaborator

Summary

This PR upgrades the vitest dependency to version ^4.1.8.

Changes

  • Updated vitest from the previous version to ^4.1.8.
  • Incorporated upstream security fixes and dependency updates included in the latest release.

Security Benefits

This upgrade addresses a security issue related to CWE-862: Missing Authorization, where insufficient authorization checks could potentially allow unintended access to protected functionality under certain conditions.

By upgrading to vitest ^4.1.8, we benefit from:

  • Improved authorization and access-control handling in affected code paths.
  • Reduced risk of unauthorized operations during test execution or related tooling workflows.
  • Alignment with the latest security recommendations and dependency maintenance practices.
  • Reduced exposure to known vulnerabilities reported against older versions.

Testing

  • Existing test suite passes successfully with vitest ^4.1.8.
  • No application code changes were required beyond the dependency update.

@yassinedorbozgithub yassinedorbozgithub self-assigned this Jun 12, 2026
@yassinedorbozgithub yassinedorbozgithub added security Vulnerabilities, exploits, sensitive data WIP Work in progress labels Jun 12, 2026
@yassinedorbozgithub yassinedorbozgithub marked this pull request as draft June 12, 2026 09:33
@yassinedorbozgithub yassinedorbozgithub removed the WIP Work in progress label Jun 12, 2026
@yassinedorbozgithub yassinedorbozgithub marked this pull request as ready for review June 12, 2026 09:58
yassinedorbozgithub and others added 17 commits June 12, 2026 11:14
…ackage-version

fix: upgrade @grpc/grpc-js package to 1.14.4
…ufjs-package-version

fix: upgrade protobufjs package to 7.6.3
…kage-version

fix: upgrade qs package to 6.15.2
…router-dom-package-version

fix: upgrade react-router-dom package to ^6.30.4
…ackage-version

fix: upgrade hono package to 4.12.25
…package-version

fix: upgrade turbo package to ^2.9.18
…rently-package-version

fix: upgrade concurrently package to ^10.0.3
…ackage-version

fix: upgrade vite package to ^6.4.3
…package-version

fix: upgrade axios package to ^1.17.0
@marrouchi marrouchi merged commit dbd2d41 into main Jun 12, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

security Vulnerabilities, exploits, sensitive data

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants