Update vitest 4.0.10 → 4.0.14 (patch) #478

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@depfu rebase
Rebases against your default branch and redoes this update

@depfu recreate
Recreates this PR, overwriting any edits that you've made to it

@depfu merge
Merges this PR once your tests are passing and conflicts are resolved

@depfu cancel merge
Cancels automatic merging of this PR

@depfu close
Closes this PR and deletes the branch

@depfu reopen
Restores the branch and reopens this PR (if it's closed)

@depfu pause
Ignores all future updates for this dependency and closes this PR

@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR

@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

code-genius-code-coverage · 2025-11-26T15:10:32Z

The files' contents are under analysis for test generation.

coderabbitai · 2025-11-26T15:10:37Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Tip

📝 Customizable high-level summaries are now available in beta!

You can now customize how CodeRabbit generates the high-level summary in your pull requests — including its content, structure, tone, and formatting.

Provide your own instructions using the high_level_summary_instructions setting.
Format the summary however you like (bullet lists, tables, multi-section layouts, contributor stats, etc.).
Use high_level_summary_in_walkthrough to move the summary from the description to the walkthrough section.

Example instruction:

"Divide the high-level summary into five sections:

📝 Description — Summarize the main change in 50–60 words, explaining what was done.

📓 References — List relevant issues, discussions, documentation, or related PRs.

📦 Dependencies & Requirements — Mention any new/updated dependencies, environment variable changes, or configuration updates.

📊 Contributor Summary — Include a Markdown table showing contributions:
| Contributor | Lines Added | Lines Removed | Files Changed |

✔️ Additional Notes — Add any extra reviewer context.
Keep each section concise (under 200 words) and use bullet or numbered lists for clarity."

Note: This feature is currently in beta for Pro-tier users, and pricing will be announced later.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

deepsource-io · 2025-11-26T15:10:55Z

Here's the code health analysis summary for commits a8bd70c..e0890a8. View details on DeepSource ↗.

Analysis Summary

Analyzer	Status	Link
Test coverage	✅ Success	View Check ↗
Secrets	✅ Success	View Check ↗
JavaScript	✅ Success	View Check ↗

Code Coverage Report

Metric	Aggregate	Javascript
Branch Coverage	100%	0%
Composite Coverage	93.8%	93.8%
Line Coverage	93.8%	93.8%

💡 If you’re a repository administrator, you can configure the quality gates from the settings.

socket-security · 2025-11-26T15:10:56Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
@vitest/coverage-v8@4.0.10 ⏵ 4.0.14
typescript-eslint@8.47.0 ⏵ 8.48.0
vitest@4.0.10 ⏵ 4.0.14	⁺¹	⁺¹	⁺¹

View full report

socket-security · 2025-11-26T15:10:58Z

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Block		Dynamic code execution: npm `@acemir/cssom` Eval Type: eval Location: Package overview From: package-lock.json → `npm/jsdom@27.2.0` → `npm/@acemir/cssom@0.9.24` ℹ Read more on: This package \| This alert \| What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@acemir/cssom@0.9.24`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm `@typescript-eslint/typescript-estree` in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package-lock.json → `npm/typescript-eslint@8.48.0` → `npm/@typescript-eslint/typescript-estree@8.48.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript-eslint/typescript-estree@8.48.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm `@typescript-eslint/utils` in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package-lock.json → `npm/typescript-eslint@8.48.0` → `npm/@typescript-eslint/utils@8.48.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript-eslint/utils@8.48.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Low adoption: npm `obug` Location: Package overview From: package-lock.json → `npm/@vitest/coverage-v8@4.0.14` → `npm/vitest@4.0.14` → `npm/obug@2.1.1` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/obug@2.1.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: npm `@acemir/cssom` URLs: http://dev.w3.org/csswg/cssom/#the-cssrule-interface, http://www.w3.org/TR/DOM-Level-2-Style/css.html#CSS-CSSRule, https://drafts.csswg.org/cssom/#the-cssrulelist-interface, https://drafts.csswg.org/css-nesting-1/, https://drafts.csswg.org/cssom/#the-cssgroupingrule-interface, https://www.w3.org/TR/cssom-1/#dom-cssgroupingrule-insertrule, https://www.w3.org/TR/cssom-1/#dom-cssgroupingrule-deleterule, https://drafts.csswg.org/css-counter-styles/#the-csscounterstylerule-interface, https://www.w3.org/TR/css-conditional-3/#the-cssconditionrule-interface, http://dev.w3.org/csswg/cssom/#cssstylerule, http://www.w3.org/TR/DOM-Level-2-Style/css.html#CSS-CSSStyleRule, http://dev.w3.org/csswg/cssom/#the-medialist-interface, http://dev.w3.org/csswg/cssom/#cssmediarule, http://www.w3.org/TR/DOM-Level-2-Style/css.html#CSS-CSSMediaRule, https://opensource.apple.com/source/WebCore/WebCore-7611.1.21.161.3/css/CSSMediaRule.cpp, https://drafts.csswg.org/css-contain-3/, https://www.w3.org/TR/css-contain-3/, https://drafts.csswg.org/css-conditional-3/#the-csssupportsrule-interface, http://dev.w3.org/csswg/cssom/#cssimportrule, http://www.w3.org/TR/DOM-Level-2-Style/css.html#CSS-CSSImportRule, https://drafts.csswg.org/css-cascade-6/#cssscoperule, https://drafts.csswg.org/css-cascade-5/#csslayerblockrule, https://drafts.csswg.org/css-cascade-5/#csslayerstatementrule, https://drafts.csswg.org/cssom/#the-csspagerule-interface Location: Package overview From: package-lock.json → `npm/jsdom@27.2.0` → `npm/@acemir/cssom@0.9.24` ℹ Read more on: This package \| This alert \| What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@acemir/cssom@0.9.24`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: npm `@typescript-eslint/eslint-plugin` URLs: Fruit.Apple, https://typescript-eslint.io/rules/consistent-type-definitions, https://github.com/typescript-eslint/typescript-eslint/pull/6229, https://typescript-eslint.io/rules/no-require-imports, https://github.com/typescript-eslint/typescript-eslint/pull/8334, https://typescript-eslint.io/rules/no-empty-object-type, https://github.com/typescript-eslint/typescript-eslint/pull/8977, https://typescript-eslint.io/rules/ban-ts-comment, https://github.com/typescript-eslint/typescript-eslint/pull/9081, https://eslint.org/docs/latest/rules/no-loss-of-precision, https://github.com/typescript-eslint/typescript-eslint/pull/8832, https://perfectionist.dev, https://perfectionist.dev/rules/sort-intersection-types, https://perfectionist.dev/rules/sort-union-types, https://github.com/typescript-eslint/typescript-eslint/pull/9253 Location: Package overview From: package-lock.json → `npm/typescript-eslint@8.48.0` → `npm/@typescript-eslint/eslint-plugin@8.48.0` ℹ Read more on: This package \| This alert \| What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript-eslint/eslint-plugin@8.48.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: npm `@typescript-eslint/scope-manager` with es2020.date, es2017.date URLs: es2020.date, es2017.date Location: Package overview From: package-lock.json → `npm/typescript-eslint@8.48.0` → `npm/@typescript-eslint/scope-manager@8.48.0` ℹ Read more on: This package \| This alert \| What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript-eslint/scope-manager@8.48.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: npm `@typescript-eslint/typescript-estree` URLs: https://github.com/typescript-eslint/typescript-eslint/pull/6615#discussion_r1136489935, https://github.com/typescript-eslint/typescript-eslint/issues/6469, https://typescript-eslint.io/troubleshooting/faqs/general#the-key-property-is-deprecated-on-type-nodes-use-key-instead-warnings., this.foo Location: Package overview From: package-lock.json → `npm/typescript-eslint@8.48.0` → `npm/@typescript-eslint/typescript-estree@8.48.0` ℹ Read more on: This package \| This alert \| What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript-eslint/typescript-estree@8.48.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: npm `@typescript-eslint/utils` URLs: https://typescript-eslint.io/getting-started/typed-linting, http://json-schema.org/schema#, http://json-schema.org/hyper-schema#, http://json-schema.org/draft-04/schema#, http://json-schema.org/draft-04/hyper-schema#, http://json-schema.org/draft-03/schema#, http://json-schema.org/draft-03/hyper-schema#, https://tools.ietf.org/html/draft-zyp-json-schema-03#section-5.3, https://tools.ietf.org/html/draft-zyp-json-schema-03#section-5.2, https://json-schema.org/understanding-json-schema/reference/array.html, https://tools.ietf.org/html/draft-zyp-json-schema-03#section-5.6, https://tools.ietf.org/html/draft-zyp-json-schema-03#section-5.5, https://json-schema.org/understanding-json-schema/reference/string.html, https://json-schema.org/understanding-json-schema/reference/numeric.html, https://tools.ietf.org/html/draft-zyp-json-schema-03#section-5.19, https://json-schema.org/understanding-json-schema/reference/boolean.html, https://json-schema.org/understanding-json-schema/reference/null.html, https://github.com/eslint/espree Location: Package overview From: package-lock.json → `npm/typescript-eslint@8.48.0` → `npm/@typescript-eslint/utils@8.48.0` ℹ Read more on: This package \| This alert \| What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript-eslint/utils@8.48.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: npm `@vitest/expect` URLs: Object.is, http://underscorejs.org, https://nodejs.org/docs/latest-v22.x/api/assert.html#comparison-details, https://github.com/facebook/immutable-js, https://github.com/chaijs/loupe/blob/9b8a6deabcd50adc056a64fb705896194710c5c6/src/index.ts#L29, https://github.com/microsoft/TypeScript/issues/61068 Location: Package overview From: package-lock.json → `npm/vitest@4.0.14` → `npm/@vitest/expect@4.0.14` ℹ Read more on: This package \| This alert \| What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@vitest/expect@4.0.14`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: npm `@vitest/runner` URLs: https://github.com/unocss/unocss/blob/2e74b31625bbe3b9c8351570749aa2d3f799d919/packages/autocomplete/src/parse.ts#L11, https://github.com/vitest-dev/vitest/pull/7069, vitest.test.id, vitest.test.name, vitest.suite.id, vitest.suite.name, https://developer.mozilla.org/en-US/docs/Web/API/AbortSignal, https://vitest.dev/guide/test-context#signal, https://vitest.dev/guide/test-context#ontestfailed, https://vitest.dev/guide/test-context#ontestfinished, https://vitest.dev/guide/test-context#skip, https://vitest.dev/guide/test-context#annotate, https://vitest.dev/advanced/runner#your-task-function Location: Package overview From: package-lock.json → `npm/vitest@4.0.14` → `npm/@vitest/runner@4.0.14` ℹ Read more on: This package \| This alert \| What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@vitest/runner@4.0.14`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Environment variable access: npm `obug` Location: Package overview From: package-lock.json → `npm/@vitest/coverage-v8@4.0.14` → `npm/vitest@4.0.14` → `npm/obug@2.1.1` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/obug@2.1.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Environment variable access: npm `obug` reads DEBUG Env Vars: DEBUG Location: Package overview From: package-lock.json → `npm/@vitest/coverage-v8@4.0.14` → `npm/vitest@4.0.14` → `npm/obug@2.1.1` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/obug@2.1.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: npm `tldts` with example.org URLs: example.org Location: Package overview From: package-lock.json → `npm/jsdom@27.2.0` → `npm/tldts@7.0.19` ℹ Read more on: This package \| This alert \| What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/tldts@7.0.19`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: npm `typescript-eslint` URLs: https://typescript-eslint.io/users/configs#base, https://typescript-eslint.io/users/configs#disable-type-checked Location: Package overview From: package-lock.json → `npm/typescript-eslint@8.48.0` ℹ Read more on: This package \| This alert \| What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/typescript-eslint@8.48.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: npm `vitest` URLs: https://vitest.dev/api/vi#vi-advancetimersbytime, https://vitest.dev/api/vi#vi-fn, https://vitest.dev/api/mock, performance.now, Date.now, https://vitest.dev/api/vi#vi-waitfor, https://vitest.dev/api/vi#vi-mock, 0.0.0.0, process.env.CI, https://vitest.dev/config/#coverage-reporter, https://github.com/istanbuljs/nyc#coverage-thresholds, https://github.com/istanbuljs/nyc#ignoring-methods, https://vitest.dev/guide/coverage#custom-coverage-provider, https://vitest.dev/config/browser/provider, https://en.wikipedia.org/wiki/Random_seed, https://vitest.dev/config/#sequence-hooks, 127.0.0.1:9229, https://github.com/nodejs/node/blob/7c3dce0/lib/internal/modules/package_json_reader.js, browser.name, https://github.com/sinonjs/sinon/issues/1852#issuecomment-419622780, https://nodejs.org/api/modules.html#built-in-modules-with-mandatory-node-prefix, vitest.module.id, vitest.mock.id, https://github.com/vitest-dev/vitest/issues, https://github.com/vitejs/vite/pull/20449, task.name, https://vitest.dev/guide/coverage.html#including-and-excluding-files-from-coverage-report, https://istanbul.js.org/docs/advanced/alternative-reporters/, https://trace.playwright.dev/, https://vitest.dev/api/browser/commands, https://vitest.dev/config/#onunhandlederror, https://vitest.dev/config/#root, https://vitest.dev/api/#test, https://nodejs.org/docs/latest/api/cli.html, https://github.com/nodejs/node/issues/41103, https://github.com/chaijs/chai/blob/4.x.x/lib/chai/config.js, https://vitest.dev/guide/open-telemetry, 127.0.0.0, https://nodejs.org/docs/latest-v20.x/api/esm.html#resolution-algorithm, https://github.com/nodejs/node/pull/49038, https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#setting-an-error-message, https://github.com/actions/toolkit/blob/f1d9b4b985e6f0f728b4b766db73498403fd5ca3/packages/core/src/command.ts#L80-L85, https://gist.github.com/john-doherty/b9195065884cdbfd2017a4756e6409cc, vitest.runtime.run, vitest.worker.id, builder.io/qwik, https://playwright.dev, https://webdriver.io, builder.io/qwik/optimizer, qwik.dev/core, https://vitest.dev/config/browser/playwright, https://vitest.dev/config/browser/webdriverio, https://www.cl.cam.ac.uk/%7Emgk25/ucs/utf8_check.c, https://tools.ietf.org/html/rfc6455#section-9.1, https://html.spec.whatwg.org/multipage/comms.html#the-websocket-interface, https://github.com/websockets/ws/issues/1869., https://github.com/websockets/ws/issues/1940., https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions#escaping, https://github.com/vitest-dev/vitest/pull/7531, vitest.fetched_module.id, https://github.com/vitejs/vite/issues/15438,, https://nodejs.org/api/process.html#signal-events, https://github.com/vitest-dev/vitest/issues/7871, vitest.worker.name, https://github.com/jestjs/jest/blob/25a8785584c9d54a05887001ee7f498d489a5441/packages/jest-worker/src/workers/ChildProcessWorker.ts#L463-L477, https://github.com/tinylibs/tinypool/blob/40b4b3eb926dabfbfd3d0a7e3d1222d4dd1c0d2d/src/runtime/process-worker.ts#L56, https://github.com/vitejs/vite/blob/af2aa09575229462635b7cbb6d248ca853057ba2/packages/vite/src/node/plugins/resolve.ts#L1056-L1080, https://github.com/vitejs/vite/blob/main/packages/vite/src/node/logger.ts?rgh-link-date=2024-10-16T23%3A29%3A19Z, https://github.com/vitejs/vite/pull/15184, https://github.com/vitejs/vite/pull/20502, https://github.com/unjs/mlly/blob/c5bcca0cda175921344fd6de1bc0c499e73e5dac/src/syntax.ts#L51-L98, https://github.com/vitejs/vite/issues/14328, https://vitest.dev/guide/projects, https://vitest.dev/config/#reporters Location: Package overview From: package-lock.json → `npm/vitest@4.0.14` ℹ Read more on: This package \| This alert \| What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/vitest@4.0.14`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: npm `zod` URLs: gmail.com, z.date, z.coerce.date, z.iso.date, z.map, lkajsdf.com, http://example.org/, https://json-schema.org/draft/2020-12/schema, http://json-schema.org/draft-07/schema#, http://json-schema.org/draft-04/schema#, example.com, z.lt, z.gt, z.int, 127.0.0.1, user.name, e.co, EXAMPLE.COM, http://google.com, https://google.com/asdf?asdf=ljk3lk4&asdf=234#asdf, lkjsdf.com, 122.122.122.122, 254.164.77.1, 114.71.82.94, 0.0.0.0, 37.85.236.115, 192.168.0.1/24, 192.168.0.0/24, 10.0.0.0/8, 203.0.113.0/24, 192.0.2.0/24, 127.0.0.0/8, 172.16.0.0/12, 192.168.1.0/24, 192.168.1.1/33, 10.0.0.1/-1, 192.168.1.1/24/24, 192.168.1.0/abc, https://example.com/path?query=value, https://test.com/api/v1?foo=bar&baz=qux, https://example.com/path, http://example.com/path, http://api.example.com/v1/users, ftp://example.com, z.email, test.com, http://example.com, https://example.com, http://sub.example.com, https://example.com/path?query=123#fragment, http://example.com/, http://example.com//, https://sub.example.com, http://examples.com, http://example.org, https://example.org, 192.168.1.1, 255.255.255.255, developer.mozilla.org/en-US/docs/Web/API/URL/password, https://my.local, https://example.com?key=NUXOmHqWNVTapJkJJHw8BfD155AuqhH_qju_5fNmQ4ZHV7u8, https://example.com?foo=bar, http://example.com?test=123, https://sub.example.com?param=value&other=data, https://example.com/, https://example.com/path/, https://example.com/path?query=param, https://example.com?key=value, https://example.com/?key=value, http://example.com/?test=123, https://example.com/../?key=value, https://example.com/./path?key=value, https://example.com/path?key=value, http://example.com?key=value, https://other.com?key=value, https://example.com:8080, http://example.com:8080, https://example.com/path/to/resource, http://example.com/path/to/resource, http://example.com/path?query=param, https://example.com/path#fragment, http://example.com/path#fragment, shttp://example.com, httpz://example.com, http://-asdf.com, http://asdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdfasdf.com, lckj.com, 192.168.0.1, 1.2.3.4, 94.105.123.75, 0.0.0.0/0, 255.255.255.255/32, 192.168.0.0, 192.168.0.0/33, 192.168.0.0/-1, sub.example.com, a-b-c.example.com, 123.example.com, example-123.com, developer.mozilla.org, hello.world.example.com, www.google.com, xn--d1acj3b.com, xn--d1acj3b.org, example-.com, -example.com, example.com:8080, tp://invalid.com, mple.com, 213.174.246.205, https://speedtest.net, https://example.net.il Location: Package overview From: package-lock.json → `npm/eslint-plugin-react-hooks@7.0.1` → `npm/zod@4.1.13` ℹ Read more on: This package \| This alert \| What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/zod@4.1.13`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

guibranco

Automatically approved by gstraccini[bot]

guibranco

Automatically approved by gstraccini[bot]

guibranco · 2025-11-26T15:12:23Z

@depfu merge

guibranco · 2025-11-26T15:12:23Z

@depfu merge

guibranco · 2025-11-27T15:56:10Z

@gstraccini npm check updates vitest

gstraccini · 2025-11-27T15:56:20Z

Running the command npm-check-updates to update dependencies via NPM! 🏗️

gstraccini · 2025-11-27T15:57:01Z

✅ NPM check updates result:

Upgrading /home/runner/work/gstraccini-bot-workflows/gstraccini-bot-workflows/package.json


All dependencies match the latest package versions :)

added 335 packages, and audited 336 packages in 20s

71 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities

added 3 packages, and audited 339 packages in 829ms

72 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities

github-actions · 2025-11-27T15:57:33Z

Infisical secrets check: ✅ No secrets leaked!

💻 Scan logs

2025-11-27T15:57:29Z INF scanning for exposed secrets...
3:57PM INF 405 commits scanned.
2025-11-27T15:57:30Z INF scan completed in 429ms
2025-11-27T15:57:30Z INF no leaks found

sonarqubecloud · 2025-11-27T15:57:59Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

depfu · 2025-12-01T14:45:10Z

Closing because this update has already been applied

Update vitest to version 4.0.14

8243a52

depfu bot added the depfu label Nov 26, 2025

github-actions bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Nov 26, 2025

guibranco enabled auto-merge (squash) November 26, 2025 15:12

gstraccini bot added the ☑️ auto-merge Automatic merging of pull requests (gstraccini-bot) label Nov 26, 2025

gstraccini bot assigned guibranco Nov 26, 2025

gstraccini bot approved these changes Nov 26, 2025

View reviewed changes

guibranco approved these changes Nov 26, 2025

View reviewed changes

gstraccini bot added the 🤖 bot Automated processes or integrations label Nov 26, 2025

[NPM] Update dependencies

e0890a8

github-actions bot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Nov 27, 2025

depfu bot closed this Dec 1, 2025

auto-merge was automatically disabled December 1, 2025 14:45
Pull request was closed

depfu bot deleted the depfu/update/npm/vitest-4.0.14 branch December 1, 2025 14:45

Update vitest 4.0.10 → 4.0.14 (patch) #478

Update vitest 4.0.10 → 4.0.14 (patch) #478

Uh oh!

Conversation

depfu bot commented Nov 26, 2025

What changed?

✳️ vitest (4.0.10 → 4.0.14) · Repo

↗️ @​vitest/expect (indirect, 4.0.10 → 4.0.14) · Repo

↗️ @​vitest/mocker (indirect, 4.0.10 → 4.0.14) · Repo

↗️ @​vitest/runner (indirect, 4.0.10 → 4.0.14) · Repo

↗️ @​vitest/snapshot (indirect, 4.0.10 → 4.0.14) · Repo

↗️ @​vitest/spy (indirect, 4.0.10 → 4.0.14) · Repo

🆕 obug (added, 2.1.1)

🆕 @​vitest/pretty-format (added, 4.0.14)

🆕 @​vitest/utils (added, 4.0.14)

Uh oh!

code-genius-code-coverage bot commented Nov 26, 2025

Uh oh!

coderabbitai bot commented Nov 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

deepsource-io bot commented Nov 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Analysis Summary

Code Coverage Report

Uh oh!

socket-security bot commented Nov 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Nov 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

guibranco left a comment

Choose a reason for hiding this comment

Uh oh!

guibranco left a comment

Choose a reason for hiding this comment

Uh oh!

guibranco commented Nov 26, 2025

Uh oh!

guibranco commented Nov 26, 2025

Uh oh!

guibranco commented Nov 27, 2025

Uh oh!

gstraccini bot commented Nov 27, 2025

Uh oh!

gstraccini bot commented Nov 27, 2025

Uh oh!

github-actions bot commented Nov 27, 2025

Uh oh!

sonarqubecloud bot commented Nov 27, 2025

Quality Gate passed

Uh oh!

depfu bot commented Dec 1, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

↗️ @vitest/expect (indirect, 4.0.10 → 4.0.14) · Repo

↗️ @vitest/mocker (indirect, 4.0.10 → 4.0.14) · Repo

↗️ @vitest/runner (indirect, 4.0.10 → 4.0.14) · Repo

↗️ @vitest/snapshot (indirect, 4.0.10 → 4.0.14) · Repo

↗️ @vitest/spy (indirect, 4.0.10 → 4.0.14) · Repo

🆕 @vitest/pretty-format (added, 4.0.14)

🆕 @vitest/utils (added, 4.0.14)

coderabbitai bot commented Nov 26, 2025 •

edited

Loading

deepsource-io bot commented Nov 26, 2025 •

edited

Loading

socket-security bot commented Nov 26, 2025 •

edited

Loading

socket-security bot commented Nov 26, 2025 •

edited

Loading