chore(deps): update dependency vitest to v4 [security] by renovate[bot] · Pull Request #165 · Aetherinox/ntfy-desktop

renovate · 2026-06-01T21:11:39Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
vitest (source)	`^1.6.0` → `^4.0.0`

When Vitest UI server is listening, arbitrary file can be read and executed

CVE-2026-47429 / GHSA-5xrq-8626-4rwp

More information

Details

Summary

Arbitrary file can be read on Windows when Vitest UI server is listening, especially when exposed to the network.

Impact

Only users that match either of the following conditions are affected:

explicitly exposes the Vitest UI server to the network (using --api.host or api.host config option)
running the Vitest UI or Browser Mode on Windows

Details

The API handler for /__vitest_attachment__ uses the deprecated isFileServingAllowed incorrectly.
https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/ui/node/index.ts#L77
The function expects the passed value to use cleanUrl after the check before file system related operation.
Because of this, it is possible to bypass the check by \\?\\..\\. This is not possible on Linux as Linux errors if a directory named ? does not exist.

A similar problem exists in other places as well.

That said, this isFileServingAllowed check does not actually prevent the API to be abused. Since the API has rerun feature and file write feature, it's possible to run arbitrary script by writing a script as a test file using saveTestFile and running it using rerun. This means exposing the API / Vitest UI is equivalent to giving script execution access.
On the browser mode side, there're readFile / writeFile / saveSnapshotFile. So exposing the browser mode is equivalent to giving file read / write access.

PoC

Run Vitest UI
Get the API token by curl http://localhost:51204/__vitest__/
Run curl "http://localhost:51204/__vitest_attachment__?path=C:\\path\\to\\project\\?\\..\\..\\secret.txt&contentType=text/plain&token=$TOKEN" (TOKEN is the API token)
curl shows the content of secret.txt that is outside the project directory

Mitigations

Vitest now ships two configuration flags, allowWrite and allowExec, that gate the privileged operations exploited by this vulnerability. Both are disabled by default whenever the API server is bound to a non-localhost host, ensuring that exposing the server to the network no longer implicitly grants write or execute capabilities to remote clients.

When these flags are disabled, the UI also enters a read-only mode: in-browser code editing and test file execution are turned off, removing the attack surface that allowed remote code execution. Many Browser Mode features are also disabled, like attachments, artifacts or snapshots. See browser.api.

Users who require the full interactive UI on a networked host must explicitly opt in by setting allowWrite and/or allowExec to true.

Severity

CVSS Score: 9.8 / 10 (Critical)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

vitest-dev/vitest (vitest)

`v4.1.10`

Compare Source

🐞 Bug Fixes

browser: Check fs access in builtin commands [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in #10680 (5c18d)
vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4] - by @SveLil and @hi-ogawa in #10661 (bae52)

View changes on GitHub

`v4.1.9`

Compare Source

🐞 Bug Fixes

Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in #10546 (a5180)
browser:
- Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in #10555 (7fb29)
- Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in #10497 and #10556 (fbc62)
mocker:
- Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in #10548 (2c955)
pool:
- Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in #10543 and #10564 (934b0)

View changes on GitHub

`v4.1.8`

Compare Source

🐞 Bug Fixes

browser:
- Disable client cdp API when allowWrite/allowExec: false [backport to v4] - by @hi-ogawa and Codex in #10450 (e4067)
- Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4] - by @toxik and @Zelys-DFKH in #10474 (675b4)

View changes on GitHub

`v4.1.7`

Compare Source

🐞 Bug Fixes

runner: Limit concurrency per task branch in addition to per leaf callbacks (backport) - by @hi-ogawa in #10384 (4f0f2)

View changes on GitHub

`v4.1.6`

Compare Source

🐞 Bug Fixes

browser: Provide project reference in ToMatchScreenshotResolvePath - by @macarie and @sheremet-va in #10138 (31882)
Global sequence.concurrent: true with top-level test(..., { concurrent: false }) + depreacte sequential test API and options - by @hi-ogawa, Codex and @sheremet-va in #10196 (2847d)
browser: Simplify orchestrator otel carrier - by @hi-ogawa in #10285 (18af9)

🏎 Performance

Stringify diff objects only once - by @sheremet-va in #10276 (9f7b1)

View changes on GitHub

`v4.1.5`

Compare Source

🚀 Experimental Features

coverage: Istanbul to support instrumenter option - by @BartWaardenburg and @AriPerkkio in #10119 (0e0ff)

🐞 Bug Fixes

--project negation excludes browser instances - by @felamaslen in #10131 (9423d)
Project color label on html reporter - by @hi-ogawa in #10142 (596f7)
Fix vi.defineHelper called as object method - by @hi-ogawa in #10163 (122c2)
Alias agent reporter to minimal - by @sheremet-va in #10157 (663b9)
Respect diff config options in soft assertions - by @Copilot, sheremet-va and @sheremet-va in #8696 (9787d)
Respect diff config options in soft assertions " - by @sheremet-va in #8696 (7dc6d)
ast-collect: Recognize _vi_import prefix in static test discovery - by @Yejneshwar in #10129 (32546)
coverage: Descriptive error message when reports directory is removed during test run - by @DaveT1991 and @AriPerkkio in #10117 (14133)
snapshot: Increase default snapshot max output length - by @hi-ogawa and Codex in #10150 (21e66)
ui: Fix jsx/tsx syntax highlight - by @hi-ogawa in #10152 (f1b1f)
web-worker: Support MessagePort objects referenced inside postMessage data - by @whitphx and Claude Opus 4.6 (1M context) in #9927 and #10124 (7ad7d)
api: Make test-specification options writable - by @sheremet-va in #10154 (6abd5)

View changes on GitHub

`v4.1.4`

Compare Source

🚀 Features

coverage:
- Default to text reporter skipFull if agent detected - by @hi-ogawa in #10018 (53757)
experimental:
- Expose assertion as a public field - by @sheremet-va in #10095 (a120e)
- Support aria snapshot - by @hi-ogawa, Claude Opus 4.6 (1M context), @AriPerkkio, Codex and @sheremet-va in #9668 (d4fbb)
reporter:
- Add filterMeta option to json reporter - by @nami8824 and @sheremet-va in #10078 (b77de)

🐞 Bug Fixes

Use "black" foreground for labeled terminal message to ensure contrast - by @hi-ogawa in #10076 (203f0)
Make expect(..., message) consistent as error message prefix - by @hi-ogawa and Codex in #10068 (a1b5f)
Do not hoist imports whose names match class properties . - by @SunsetFi in #10093 and #10094 (0fc4b)
browser: Spread user server options into browser Vite server in project - by @GoldStrikeArch in #10049 (65c9d)

View changes on GitHub

`v4.1.3`

Compare Source

🚀 Experimental Features

Add experimental.preParse flag - by @sheremet-va in #10070 (78273)
Support browser.locators.exact option - by @sheremet-va in #10013 (48799)
Add TestAttachment.bodyEncoding - by @hi-ogawa in #9969 (89ca0)
Support custom snapshot matcher - by @hi-ogawa, Claude Sonnet 4.6 and Codex in #9973 (59b0e)

🐞 Bug Fixes

Advance fake timers with expect.poll interval - by @hi-ogawa and Claude Sonnet 4.6 in #10022 (3f5bf)
Add @vitest/coverage-v8 and @vitest/coverage-istanbul as optional dependency - by @alan-agius4 in #10025 (146d4)
Fix defineHelper for webkit async stack trace + update playwright 1.59.0 - by @hi-ogawa in #10036 (5a5fa)
Fix suite hook throwing errors for unused auto test-scoped fixture - by @hi-ogawa and Claude Sonnet 4.6 in #10035 (39865)
expect:
- Remove JestExtendError.context from verbose error reporting - by @hi-ogawa in #9983 (66751)
- Don't leak "runner" types - by @sheremet-va in #10004 (ec204)
snapshot:
- Fix flagging obsolete snapshots for snapshot properties mismatch - by @hi-ogawa and Claude Sonnet 4.6 in #9986 (6b869)
- Export custom snapshot matcher helper from vitest - by @hi-ogawa and Codex in #10042 (691d3)
ui:
- Don't leak vite types - by @sheremet-va in #10005 (fdff1)
vm:
- Fix external module resolve error with deps optimizer query - by @hi-ogawa and Claude Sonnet 4.6 in #10024 (9dbf4)

View changes on GitHub

`v4.1.2`

Compare Source

This release bumps Vitest's flatted version and removes version pinning to resolve flatted's CVE related issues (#9975).

🐞 Bug Fixes

Don't resolve setupFiles from parent directory - by @hi-ogawa in #9960 (7aa93)
Ensure sequential mock/unmock resolution - by @hi-ogawa and Claude Opus 4.6 in #9830 (7c065)
browser: Take failure screenshot if toMatchScreenshot can't capture a stable screenshot - by @macarie in #9847 (faace)
coverage: Correct coverageConfigDefaults values and types - by @Arthie in #9940 (b3c99)
pretty-format: Fix output limit over counting - by @hi-ogawa in #9965 (d3b7a)
Disable colors if agent is detected - by @sheremet-va and @AriPerkkio in #9851 (6f97b)

View changes on GitHub

`v4.1.1`

Compare Source

🚀 Features

experimental:
- Expose matchesTagsFilter to test if the current filter matches tags - by @sheremet-va in #9913 (eec53)
- Introduce experimental.vcsProvider - by @sheremet-va in #9928 (56115)

🐞 Bug Fixes

Mark TestProject.testFilesList internal properly - by @sapphi-red in #9867 (54f26)
Detect fixture that returns without calling use - by @oilater in #9831 and #9861 (633ae)
Drop vite 8.beta support - by @AriPerkkio in #9862 (b78f5)
Type regression in vi.mocked() static class methods - by @purepear and @hi-ogawa in #9857 (90926)
Properly re-evaluate actual modules of mocked external - by @hi-ogawa in #9898 (ae5ec)
Preserve coverage report when html reporter overlaps - by @hi-ogawa in #9889 (2d81a)
Provide vi.advanceTimers to the preview provider - by @sheremet-va in #9891 (1bc3e)
Don't leak event listener in playwright provider - by @sheremet-va in #9910 (d9355)
Open browser in --standalone mode without running tests - by @sheremet-va in #9911 (e78ad)
Guard disposable and optional body - by @sheremet-va in #9912 (6fdb2)
Resolve retry.condition RegExp serialization issue - by @nstepien and @hi-ogawa in #9942 (7b605)
collect:
- Don't treat extra props on test return as tests - by @sheremet-va in #9871 (141e7)
coverage:
- Simplify provider types - by @AriPerkkio in #9931 (aaf9f)
- Load built-in provider without module runner - by @AriPerkkio in #9939 (bf892)
expect:
- Soft assertions continue after .resolves/.rejects promise errors - by @mixelburg, Maks Pikov, Claude Opus 4.6 (1M context) and @hi-ogawa in #9843 (6d74b)
- Fix sinon-chai style API - by @hi-ogawa in #9943 (0f08d)
pretty-format:
- Limit output for large object - by @hi-ogawa and Claude Opus 4.6 (1M context) in #9949 (0d5f9)

View changes on GitHub

`v4.1.0`

Compare Source

Vitest 4.1 is out!

This release page lists all changes made to the project during the 4.1 beta. To get a review of all the new features, read our blog post.

🚀 Features

Return a disposable from doMock() - by @kirkwaiblinger in #9332 (e3e65)
Added chai style assertions - by @ronnakamoto and @sheremet-va in #8842 (841df)
Update to sinon/fake-timers v15 and add setTickMode to timer controls - by @atscott and @sheremet-va in #8726 (4b480)
Expose matcher types - by @sheremet-va in #9448 (3e4b9)
Add toTestSpecification to reported tasks - by @sheremet-va in #9464 (1a470)
Show a warning if vi.mock or vi.hoisted are declared outside of top level of the module - by @sheremet-va in #9387 (5db54)
Track and display expectedly failed tests (.fails) in UI and CLI - by @Copilot, sheremet-va and @sheremet-va in #9476 (77d75)
Support tags - by @sheremet-va in #9478 (de7c8)
Implement aroundEach and aroundAll hooks - by @sheremet-va in #9450 (2a8cb)
Stabilize experimental features - by @sheremet-va in #9529 (b5fd2)
Accept new or all in --update flag - by @sheremet-va in #9543 (a5acf)
Support meta in test options - by @sheremet-va in #9535 (7d622)
Support type inference with a new test.extend syntax - by @sheremet-va in #9550 (e5385)
Support vite 8 beta, fix type issues in the config with different vite versions - by @sheremet-va in #9587 (99028)
Add assertion helper to hide internal stack traces - by @hi-ogawa and Claude Opus 4.6 in #9594 (eeb0a)
Store failure screenshots using artifacts API - by @macarie in #9588 (24603)
Allow vitest list to statically collect tests instead of running files to collect them - by @sheremet-va in #9630 (7a8e7)
Add --detect-async-leaks - by @AriPerkkio in #9528 (c594d)
Implement mockThrow and mockThrowOnce - by @thor-juhasz and @sheremet-va in #9512 (61917)
Support update: "none" and add docs about snapshots behavior on CI - by @hi-ogawa in #9700 (05f18)
Support playwright launchOptions with connectOptions - by @hi-ogawa in #9702 (f0ff1)
Add page/locator.mark API to enhance playwright trace - by @hi-ogawa in #9652 (d0ee5)
api:
- Support tests starting or ending with test in experimental_parseSpecification - by @jgillick and Jeremy Gillick in #9235 (2f367)
- Add filters to createSpecification - by @sheremet-va in #9336 (c8e6c)
- Expose runTestFiles as alternative to runTestSpecifications - by @sheremet-va in #9443 (43d76)
- Add allowWrite and allowExec options to api - by @sheremet-va in #9350 (20e00)
- Allow passing down test cases to toTestSpecification - by @sheremet-va in #9627 (6f17d)
browser:
- Add userEvent.wheel API - by @macarie in #9188 (66080)
- Add filterNode option to prettyDOM for filtering browser assertion error output - by @Copilot, sheremet-va and @sheremet-va in #9475 (d3220)
- Support playwright persistent context - by @hi-ogawa, Claude Opus 4.6 and @sheremet-va in #9229 (f865d)
- Added detailsPanelPosition option and button - by @shairez in #9525 (c8a31)
- Use BlazeDiff instead of pixelmatch - by @macarie in #9514 (30936)
- Add findElement and enable strict mode in webdriverio and preview - by @sheremet-va in #9677 (c3f37)
cli:
- Add @bomb.sh/tab completions - by @AmirSa12 and @sheremet-va in #8639 (200f3)
coverage:
- Support ignore start/stop ignore hints - by @AriPerkkio in #9204 (e59c9)
- Add coverage.changed option to report only changed files - by @kykim00 and @AriPerkkio in #9521 (1d939)
experimental:
- Add onModuleRunner hook to worker.init - by @sheremet-va in #9286 (e977f)
- Option to disable the module runner - by @sheremet-va and @AriPerkkio in #9210 (9be61)
- Add importDurations: { limit, print } options - by @hi-ogawa, Claude Opus 4.6 and @sheremet-va in #9401 (7e10f)
- Add print and fail thresholds for importDurations - by @hi-ogawa and Claude Opus 4.6 in #9533 (3f7a5)
fixtures:
- Pass down file context to beforeAll/afterAll - by @sheremet-va in #9572 (c8339)
reporters:
- Add agent reporter to reduce ai agent token usage - by @cpojer in #9779 (3e9e0)
runner:
- Enhance retry options - by @MazenSamehR, Matan Shavit, @AriPerkkio and @sheremet-va in #9370 (9e4cf)
ui:
- Allow run individual test/suites - by @userquin in #9465 (73b10)
- Add project filter/sort support - by @userquin in #8689 (0c7ea)
- Add duration sorting to explorer - by @julianhahn and @cursoragent in #9603 (209b1)
- Implement filter for slow tests - by @DerYeger and @userquin in #9705 (8880c)
vitest:
- Add run summary in GitHub Actions Reporter - by @macarie and jhnance in #9579 (96bfc)

🐞 Bug Fixes

Deprecate several vitest/* entry points - by @sheremet-va in #9347 (fd459)
Use meta.url in createRequire - by @sheremet-va in #9441 (e3422)
Preact browser mode init example of render function not async - by @WuMingDao in #9375 (2bea5)
Deprecate unused types in matcher context - by @sheremet-va in #9449 (20f87)
Handle external/noExternal during configEnvironment hook - by @hi-ogawa and Claude Opus 4.6 in #9508 (59ea2)
Replace default ssr environment runner with Vitest server module runner - by @hi-ogawa and Claude Opus 4.6 in #9506 (cd5db)
Propagate experimental CLI options to child projects - by @hi-ogawa and Claude Opus 4.6 in #9531 (b624f)
Show a warning when browser.isolate is used - by @sheremet-va in #9410 (3d48e)
Fix vi.mock({ spy: true }) node v8 coverage - by @hi-ogawa, hi-ogawa and Claude Opus 4.6 in #9541 (687b6)
Don't show internal ssr handler in errors - by @sheremet-va in #9547 (76c43)
Close vitest if it failed to start - by @sheremet-va in #9573 (728ba)
Fix ssr environment runner in project - by @hi-ogawa in #9584 (09006)
Trim trailing white spaces in code block - by @hi-ogawa in #9591 (f78be)
Support inline snapshot inside test.for/each - by @hi-ogawa in #9590 (615fd)
Apply source maps for external module stack trace - by @hi-ogawa in #9152 (79e20)
Remove the .name from statically collected test - by @sheremet-va in #9596 (b66ff)
Don't suppress warnings on pnp - by @sheremet-va in #9602 (89cbd)
Support snapshot with expect.soft - by @iumehara, @hi-ogawa and Claude Opus 4.6 in #9231 (3eb2c)
Log seed when only sequence.shuffle.tests is enabled - by @kaigritun, Kai Gritun and @sheremet-va in #9576 (8182b)
Externalize expect/src/utils from vitest - by @hi-ogawa in #9616 (48739)
Ignore test.override during static collection - by @sheremet-va in #9620 (09174)
Increase stacktrace limit for --detect-async-leaks - by @AriPerkkio in #9638 (9fd4c)
Hanging-reporter link in cli - by @flx-sta in #9649 (7c103)
Fix teardown timeout of aroundEach/All when inner aroundEach/All throws - by @hi-ogawa in #9657 (4ec6c)
Fix ui mode / html reporter and coverage integration - by @hi-ogawa and Claude Opus 4.6 in #9626 (86fad)
Don't continue when aroundEach/All setup timed out - by @hi-ogawa in [#9670](https://redirect.github.com/vitest-dev

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Etc/UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

BinaryServ · 2026-06-01T21:12:18Z

Automatic Self-Check - #165

The details of our automated scan for your pull request are listed below. If our scan detected errors, they must be corrected before this pull request will be advanced to the review stage:

About

This pull request includes the following information:

Category	Value
Title	chore(deps): update dependency vitest to v4 [security]
Created	06.01.2026 9:11 PM UTC
ID	#165
Author	renovate[bot]
Repo	ntfy-desktop
Branch	renovate/npm-vitest-vulnerability ⇁ main
Added Files	0
Modified Files	1
Renamed Files	0
Copied Files	0
Deleted Files	0

❌ Skipped Files

Tip

The following file(s) have been skipped:

src/package.json

^{This check was done automatically. Do NOT open a new PR for re-validation. Instead, to trigger this check again, make a change to your PR and wait a few minutes, or close and re-open it.}

BinaryServ · 2026-06-02T03:33:17Z

Automatic Self-Check - #165

The details of our automated scan for your pull request are listed below. If our scan detected errors, they must be corrected before this pull request will be advanced to the review stage:

About

This pull request includes the following information:

Category	Value
Title	chore(deps): update dependency vitest to v4 [security]
Created	06.01.2026 9:11 PM UTC
ID	#165
Author	renovate[bot]
Repo	ntfy-desktop
Branch	renovate/npm-vitest-vulnerability ⇁ main
Added Files	0
Modified Files	1
Renamed Files	0
Copied Files	0
Deleted Files	0

❌ Skipped Files

Tip

The following file(s) have been skipped:

src/package.json

^{This check was done automatically. Do NOT open a new PR for re-validation. Instead, to trigger this check again, make a change to your PR and wait a few minutes, or close and re-open it.}

BinaryServ · 2026-06-08T18:58:07Z

Automatic Self-Check - #165

The details of our automated scan for your pull request are listed below. If our scan detected errors, they must be corrected before this pull request will be advanced to the review stage:

About

This pull request includes the following information:

Category	Value
Title	chore(deps): update dependency vitest to v4 [security]
Created	06.01.2026 9:11 PM UTC
ID	#165
Author	renovate[bot]
Repo	ntfy-desktop
Branch	renovate/npm-vitest-vulnerability ⇁ main
Added Files	0
Modified Files	1
Renamed Files	0
Copied Files	0
Deleted Files	0

❌ Skipped Files

Tip

The following file(s) have been skipped:

src/package.json

^{This check was done automatically. Do NOT open a new PR for re-validation. Instead, to trigger this check again, make a change to your PR and wait a few minutes, or close and re-open it.}

BinaryServ · 2026-06-11T13:42:27Z

Automatic Self-Check - #165

The details of our automated scan for your pull request are listed below. If our scan detected errors, they must be corrected before this pull request will be advanced to the review stage:

About

This pull request includes the following information:

Category	Value
Title	chore(deps): update dependency vitest to v3 [security]
Created	06.01.2026 9:11 PM UTC
ID	#165
Author	renovate[bot]
Repo	ntfy-desktop
Branch	renovate/npm-vitest-vulnerability ⇁ main
Added Files	0
Modified Files	1
Renamed Files	0
Copied Files	0
Deleted Files	0

❌ Skipped Files

Tip

The following file(s) have been skipped:

src/package.json

^{This check was done automatically. Do NOT open a new PR for re-validation. Instead, to trigger this check again, make a change to your PR and wait a few minutes, or close and re-open it.}

BinaryServ · 2026-06-12T00:39:01Z

Automatic Self-Check - #165

The details of our automated scan for your pull request are listed below. If our scan detected errors, they must be corrected before this pull request will be advanced to the review stage:

About

This pull request includes the following information:

Category	Value
Title	chore(deps): update dependency vitest to v4 [security]
Created	06.01.2026 9:11 PM UTC
ID	#165
Author	renovate[bot]
Repo	ntfy-desktop
Branch	renovate/npm-vitest-vulnerability ⇁ main
Added Files	0
Modified Files	1
Renamed Files	0
Copied Files	0
Deleted Files	0

❌ Skipped Files

Tip

The following file(s) have been skipped:

src/package.json

^{This check was done automatically. Do NOT open a new PR for re-validation. Instead, to trigger this check again, make a change to your PR and wait a few minutes, or close and re-open it.}

BinaryServ · 2026-06-18T22:46:13Z

Automatic Self-Check - #165

The details of our automated scan for your pull request are listed below. If our scan detected errors, they must be corrected before this pull request will be advanced to the review stage:

About

This pull request includes the following information:

Category	Value
Title	chore(deps): update dependency vitest to v4 [security]
Created	06.01.2026 9:11 PM UTC
ID	#165
Author	renovate[bot]
Repo	ntfy-desktop
Branch	renovate/npm-vitest-vulnerability ⇁ main
Added Files	0
Modified Files	1
Renamed Files	0
Copied Files	0
Deleted Files	0

❌ Skipped Files

Tip

The following file(s) have been skipped:

src/package.json

^{This check was done automatically. Do NOT open a new PR for re-validation. Instead, to trigger this check again, make a change to your PR and wait a few minutes, or close and re-open it.}

BinaryServ · 2026-07-12T17:35:15Z

Automatic Self-Check - #165

The details of our automated scan for your pull request are listed below. If our scan detected errors, they must be corrected before this pull request will be advanced to the review stage:

About

This pull request includes the following information:

Category	Value
Title	chore(deps): update dependency vitest to v3 [security]
Created	06.01.2026 9:11 PM UTC
ID	#165
Author	renovate[bot]
Repo	ntfy-desktop
Branch	renovate/npm-vitest-vulnerability ⇁ main
Added Files	0
Modified Files	1
Renamed Files	0
Copied Files	0
Deleted Files	0

❌ Skipped Files

Tip

The following file(s) have been skipped:

src/package.json

^{This check was done automatically. Do NOT open a new PR for re-validation. Instead, to trigger this check again, make a change to your PR and wait a few minutes, or close and re-open it.}

BinaryServ · 2026-07-12T22:47:58Z

Automatic Self-Check - #165

The details of our automated scan for your pull request are listed below. If our scan detected errors, they must be corrected before this pull request will be advanced to the review stage:

About

This pull request includes the following information:

Category	Value
Title	chore(deps): update dependency vitest to v4 [security]
Created	06.01.2026 9:11 PM UTC
ID	#165
Author	renovate[bot]
Repo	ntfy-desktop
Branch	renovate/npm-vitest-vulnerability ⇁ main
Added Files	0
Modified Files	1
Renamed Files	0
Copied Files	0
Deleted Files	0

❌ Skipped Files

Tip

The following file(s) have been skipped:

src/package.json

^{This check was done automatically. Do NOT open a new PR for re-validation. Instead, to trigger this check again, make a change to your PR and wait a few minutes, or close and re-open it.}

BinaryServ · 2026-07-17T11:44:02Z

Automatic Self-Check - #165

The details of our automated scan for your pull request are listed below. If our scan detected errors, they must be corrected before this pull request will be advanced to the review stage:

About

This pull request includes the following information:

Category	Value
Title	chore(deps): update dependency vitest to v4 [security]
Created	06.01.2026 9:11 PM UTC
ID	#165
Author	renovate[bot]
Repo	ntfy-desktop
Branch	renovate/npm-vitest-vulnerability ⇁ main
Added Files	0
Modified Files	1
Renamed Files	0
Copied Files	0
Deleted Files	0

❌ Skipped Files

Tip

The following file(s) have been skipped:

src/package.json

^{This check was done automatically. Do NOT open a new PR for re-validation. Instead, to trigger this check again, make a change to your PR and wait a few minutes, or close and re-open it.}

BinaryServ · 2026-07-20T21:13:39Z

Automatic Self-Check - #165

The details of our automated scan for your pull request are listed below. If our scan detected errors, they must be corrected before this pull request will be advanced to the review stage:

About

This pull request includes the following information:

Category	Value
Title	chore(deps): update dependency vitest to v3 [security]
Created	06.01.2026 9:11 PM UTC
ID	#165
Author	renovate[bot]
Repo	ntfy-desktop
Branch	renovate/npm-vitest-vulnerability ⇁ main
Added Files	0
Modified Files	1
Renamed Files	0
Copied Files	0
Deleted Files	0

❌ Skipped Files

Tip

The following file(s) have been skipped:

src/package.json

^{This check was done automatically. Do NOT open a new PR for re-validation. Instead, to trigger this check again, make a change to your PR and wait a few minutes, or close and re-open it.}

BinaryServ · 2026-07-21T04:56:28Z

Automatic Self-Check - #165

The details of our automated scan for your pull request are listed below. If our scan detected errors, they must be corrected before this pull request will be advanced to the review stage:

About

This pull request includes the following information:

Category	Value
Title	chore(deps): update dependency vitest to v4 [security]
Created	06.01.2026 9:11 PM UTC
ID	#165
Author	renovate[bot]
Repo	ntfy-desktop
Branch	renovate/npm-vitest-vulnerability ⇁ main
Added Files	0
Modified Files	1
Renamed Files	0
Copied Files	0
Deleted Files	0

❌ Skipped Files

Tip

The following file(s) have been skipped:

src/package.json

^{This check was done automatically. Do NOT open a new PR for re-validation. Instead, to trigger this check again, make a change to your PR and wait a few minutes, or close and re-open it.}

BinaryServ · 2026-07-24T17:41:27Z

Automatic Self-Check - #165

The details of our automated scan for your pull request are listed below. If our scan detected errors, they must be corrected before this pull request will be advanced to the review stage:

About

This pull request includes the following information:

Category	Value
Title	chore(deps): update dependency vitest to v3 [security]
Created	06.01.2026 9:11 PM UTC
ID	#165
Author	renovate[bot]
Repo	ntfy-desktop
Branch	renovate/npm-vitest-vulnerability ⇁ main
Added Files	0
Modified Files	1
Renamed Files	0
Copied Files	0
Deleted Files	0

❌ Skipped Files

Tip

The following file(s) have been skipped:

src/package.json

^{This check was done automatically. Do NOT open a new PR for re-validation. Instead, to trigger this check again, make a change to your PR and wait a few minutes, or close and re-open it.}

BinaryServ · 2026-07-25T00:17:09Z

Automatic Self-Check - #165

The details of our automated scan for your pull request are listed below. If our scan detected errors, they must be corrected before this pull request will be advanced to the review stage:

About

This pull request includes the following information:

Category	Value
Title	chore(deps): update dependency vitest to v3 [security]
Created	06.01.2026 9:11 PM UTC
ID	#165
Author	renovate[bot]
Repo	ntfy-desktop
Branch	renovate/npm-vitest-vulnerability ⇁ main
Added Files	0
Modified Files	1
Renamed Files	0
Copied Files	0
Deleted Files	0

❌ Skipped Files

Tip

The following file(s) have been skipped:

src/package.json

^{This check was done automatically. Do NOT open a new PR for re-validation. Instead, to trigger this check again, make a change to your PR and wait a few minutes, or close and re-open it.}

BinaryServ · 2026-07-30T18:56:55Z

Automatic Self-Check - #165

The details of our automated scan for your pull request are listed below. If our scan detected errors, they must be corrected before this pull request will be advanced to the review stage:

About

This pull request includes the following information:

Category	Value
Title	chore(deps): update dependency vitest to v3 [security]
Created	06.01.2026 9:11 PM UTC
ID	#165
Author	renovate[bot]
Repo	ntfy-desktop
Branch	renovate/npm-vitest-vulnerability ⇁ main
Added Files	0
Modified Files	1
Renamed Files	0
Copied Files	0
Deleted Files	0

❌ Skipped Files

Tip

The following file(s) have been skipped:

src/package.json

^{This check was done automatically. Do NOT open a new PR for re-validation. Instead, to trigger this check again, make a change to your PR and wait a few minutes, or close and re-open it.}

BinaryServ · 2026-07-30T22:29:03Z

Automatic Self-Check - #165

The details of our automated scan for your pull request are listed below. If our scan detected errors, they must be corrected before this pull request will be advanced to the review stage:

About

This pull request includes the following information:

Category	Value
Title	chore(deps): update dependency vitest to v4 [security]
Created	06.01.2026 9:11 PM UTC
ID	#165
Author	renovate[bot]
Repo	ntfy-desktop
Branch	renovate/npm-vitest-vulnerability ⇁ main
Added Files	0
Modified Files	1
Renamed Files	0
Copied Files	0
Deleted Files	0

❌ Skipped Files

Tip

The following file(s) have been skipped:

src/package.json

^{This check was done automatically. Do NOT open a new PR for re-validation. Instead, to trigger this check again, make a change to your PR and wait a few minutes, or close and re-open it.}

BinaryServ · 2026-08-12T00:16:29Z

Automatic Self-Check - #165

The details of our automated scan for your pull request are listed below. If our scan detected errors, they must be corrected before this pull request will be advanced to the review stage:

About

This pull request includes the following information:

Category	Value
Title	chore(deps): update dependency vitest to v3 [security]
Created	06.01.2026 9:11 PM UTC
ID	#165
Author	renovate[bot]
Repo	ntfy-desktop
Branch	renovate/npm-vitest-vulnerability ⇁ main
Added Files	0
Modified Files	1
Renamed Files	0
Copied Files	0
Deleted Files	0

❌ Skipped Files

Tip

The following file(s) have been skipped:

src/package.json

^{This check was done automatically. Do NOT open a new PR for re-validation. Instead, to trigger this check again, make a change to your PR and wait a few minutes, or close and re-open it.}

BinaryServ · 2026-08-12T05:52:18Z

Automatic Self-Check - #165

The details of our automated scan for your pull request are listed below. If our scan detected errors, they must be corrected before this pull request will be advanced to the review stage:

About

This pull request includes the following information:

Category	Value
Title	chore(deps): update dependency vitest to v4 [security]
Created	06.01.2026 9:11 PM UTC
ID	#165
Author	renovate[bot]
Repo	ntfy-desktop
Branch	renovate/npm-vitest-vulnerability ⇁ main
Added Files	0
Modified Files	1
Renamed Files	0
Copied Files	0
Deleted Files	0

❌ Skipped Files

Tip

The following file(s) have been skipped:

src/package.json

^{This check was done automatically. Do NOT open a new PR for re-validation. Instead, to trigger this check again, make a change to your PR and wait a few minutes, or close and re-open it.}

BinaryServ · 2026-08-14T19:32:39Z

Automatic Self-Check - #165

The details of our automated scan for your pull request are listed below. If our scan detected errors, they must be corrected before this pull request will be advanced to the review stage:

About

This pull request includes the following information:

Category	Value
Title	chore(deps): update dependency vitest to v3 [security]
Created	06.01.2026 9:11 PM UTC
ID	#165
Author	renovate[bot]
Repo	ntfy-desktop
Branch	renovate/npm-vitest-vulnerability ⇁ main
Added Files	0
Modified Files	1
Renamed Files	0
Copied Files	0
Deleted Files	0

❌ Skipped Files

Tip

The following file(s) have been skipped:

src/package.json

^{This check was done automatically. Do NOT open a new PR for re-validation. Instead, to trigger this check again, make a change to your PR and wait a few minutes, or close and re-open it.}

renovate Bot added Type › Dependency Item is associated to dependency Type › Vulnerability labels Jun 1, 2026

BinaryServ added AC › Passed Ready to be reviewed Type › Pull Request Normal pull request labels Jun 1, 2026

renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 24d3210 to 28aacee Compare June 2, 2026 03:32

renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 28aacee to 76170af Compare June 8, 2026 18:57

renovate Bot changed the title ~~chore(deps): update dependency vitest to v4 [security]~~ chore(deps): update dependency vitest to v3 [security] Jun 8, 2026

renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 76170af to 6b036c6 Compare June 11, 2026 13:41

renovate Bot changed the title ~~chore(deps): update dependency vitest to v3 [security]~~ chore(deps): update dependency vitest to v4 [security] Jun 11, 2026

renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 6b036c6 to 2089f20 Compare June 12, 2026 00:38

renovate Bot changed the title ~~chore(deps): update dependency vitest to v4 [security]~~ chore(deps): update dependency vitest to v3 [security] Jun 12, 2026

renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 2089f20 to 132a1e5 Compare June 18, 2026 19:54

renovate Bot changed the title ~~chore(deps): update dependency vitest to v3 [security]~~ chore(deps): update dependency vitest to v4 [security] Jun 18, 2026

renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 132a1e5 to 1ccb0b1 Compare June 18, 2026 22:45

renovate Bot changed the title ~~chore(deps): update dependency vitest to v4 [security]~~ chore(deps): update dependency vitest to v3 [security] Jun 18, 2026

renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 1ccb0b1 to 868217b Compare July 12, 2026 17:34

renovate Bot changed the title ~~chore(deps): update dependency vitest to v3 [security]~~ chore(deps): update dependency vitest to v4 [security] Jul 12, 2026

renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 868217b to c67ad33 Compare July 12, 2026 22:47

renovate Bot changed the title ~~chore(deps): update dependency vitest to v4 [security]~~ chore(deps): update dependency vitest to v3 [security] Jul 12, 2026

renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from c67ad33 to e9b90a9 Compare July 17, 2026 01:33

renovate Bot changed the title ~~chore(deps): update dependency vitest to v4 [security]~~ chore(deps): update dependency vitest to v3 [security] Jul 17, 2026

renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 2f33d32 to edd7e71 Compare July 20, 2026 21:12

renovate Bot changed the title ~~chore(deps): update dependency vitest to v3 [security]~~ chore(deps): update dependency vitest to v4 [security] Jul 20, 2026

renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from edd7e71 to bfaa3ba Compare July 21, 2026 04:55

renovate Bot changed the title ~~chore(deps): update dependency vitest to v4 [security]~~ chore(deps): update dependency vitest to v3 [security] Jul 21, 2026

renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from bfaa3ba to f333e19 Compare July 24, 2026 17:40

renovate Bot changed the title ~~chore(deps): update dependency vitest to v3 [security]~~ chore(deps): update dependency vitest to v4 [security] Jul 24, 2026

renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from f333e19 to ab820eb Compare July 25, 2026 00:16

renovate Bot changed the title ~~chore(deps): update dependency vitest to v4 [security]~~ chore(deps): update dependency vitest to v3 [security] Jul 25, 2026

renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from ab820eb to 14569f2 Compare July 30, 2026 18:56

renovate Bot changed the title ~~chore(deps): update dependency vitest to v3 [security]~~ chore(deps): update dependency vitest to v4 [security] Jul 30, 2026

renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 14569f2 to ebf1afa Compare July 30, 2026 22:28

renovate Bot changed the title ~~chore(deps): update dependency vitest to v4 [security]~~ chore(deps): update dependency vitest to v3 [security] Jul 30, 2026

renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from ebf1afa to 225c367 Compare August 12, 2026 00:15

renovate Bot changed the title ~~chore(deps): update dependency vitest to v3 [security]~~ chore(deps): update dependency vitest to v4 [security] Aug 12, 2026

renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 225c367 to 441ca14 Compare August 12, 2026 05:51

renovate Bot changed the title ~~chore(deps): update dependency vitest to v4 [security]~~ chore(deps): update dependency vitest to v3 [security] Aug 12, 2026

chore(deps): update dependency vitest to v4 [security]

d71907e

renovate Bot force-pushed the renovate/npm-vitest-vulnerability branch from 441ca14 to d71907e Compare August 14, 2026 19:32

renovate Bot changed the title ~~chore(deps): update dependency vitest to v3 [security]~~ chore(deps): update dependency vitest to v4 [security] Aug 14, 2026

Uh oh!

Conversation

renovate Bot commented Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

When Vitest UI server is listening, arbitrary file can be read and executed

Details

Summary

Impact

Details

PoC

Mitigations

Severity

References

Release Notes

🐞 Bug Fixes

🐞 Bug Fixes

🐞 Bug Fixes

🐞 Bug Fixes

🐞 Bug Fixes

🏎 Performance

🚀 Experimental Features

🐞 Bug Fixes

🚀 Features

🐞 Bug Fixes

🚀 Experimental Features

🐞 Bug Fixes

🐞 Bug Fixes

🚀 Features

🐞 Bug Fixes

🚀 Features

🐞 Bug Fixes

Configuration

Uh oh!

BinaryServ commented Jun 1, 2026

Automatic Self-Check - #165

About

❌ Skipped Files

Uh oh!

BinaryServ commented Jun 2, 2026

Automatic Self-Check - #165

About

❌ Skipped Files

Uh oh!

BinaryServ commented Jun 8, 2026

Automatic Self-Check - #165

About

❌ Skipped Files

Uh oh!

BinaryServ commented Jun 11, 2026

Automatic Self-Check - #165

About

❌ Skipped Files

Uh oh!

BinaryServ commented Jun 12, 2026

Automatic Self-Check - #165

About

❌ Skipped Files

Uh oh!

BinaryServ commented Jun 18, 2026

Automatic Self-Check - #165

About

❌ Skipped Files

Uh oh!

BinaryServ commented Jul 12, 2026

Automatic Self-Check - #165

About

❌ Skipped Files

Uh oh!

BinaryServ commented Jul 12, 2026

Automatic Self-Check - #165

About

❌ Skipped Files

Uh oh!

BinaryServ commented Jul 17, 2026

Automatic Self-Check - #165

About

❌ Skipped Files

Uh oh!

BinaryServ commented Jul 20, 2026

Automatic Self-Check - #165

renovate Bot commented Jun 1, 2026 •

edited

Loading