From c60ed459e8591a65e104b65de6240abaa9a98158 Mon Sep 17 00:00:00 2001 From: Imani Manyara Date: Mon, 5 Oct 2026 10:08:55 -0400 Subject: [PATCH] Raise Vitest and happy-dom past their security advisories Dependabot reports Vitest below 3.2.6 (UI server reads and runs arbitrary files, critical) and happy-dom below 20 (VM context escape, critical) and below 20.8.9 (credentialed fetch sends page-origin cookies, high). Both are dev dependencies. All 147 tests pass unchanged on Vitest 3.2.7 and happy-dom 20.14.5, and Vite now shares the patched esbuild 0.28.2. --- CHANGELOG.md | 5 ++++- package.json | 6 +++--- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1c9705b..212bfaa 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,7 +10,10 @@ All notable changes to this project are documented here. The format is based on - **esbuild `^0.23.0` → `^0.28.1`** (dev dependency, the bundler). Every release below 0.28.1 is covered by an esbuild advisory, and `^0.23` stops below 0.24, so Dependabot's security update could not reach the fix and failed on every run. The build, the 147 tests, lint and typecheck pass on 0.28.2. - Vite 5, inside Vitest 2, still bundles its own esbuild 0.21; that needs the Vitest upgrade. +- **Vitest `^2` → `^3.2.6` and happy-dom `^15` → `^20.8.9`** (dev dependencies). Vitest below 3.2.6 lets its UI + server read and run arbitrary files; happy-dom below 20 allows a VM-context escape to code execution, and below + 20.8.9 sends page-origin cookies on credentialed fetches. All 147 tests pass unchanged, and Vitest 3's Vite now + shares the patched esbuild instead of carrying 0.21. ### Added - **Publish to npm or GitHub Packages.** `release.yml` takes a `workflow_dispatch` with `tag` and diff --git a/package.json b/package.json index 18b17be..1109704 100644 --- a/package.json +++ b/package.json @@ -109,16 +109,16 @@ "@eslint/js": "^9.9.0", "@playwright/test": "~1.61.0", "@testing-library/react": "^16.3.2", - "@vitest/coverage-v8": "^2.1.9", + "@vitest/coverage-v8": "^3.2.6", "@webpixels/css": "^3.0.5", "esbuild": "^0.28.1", "eslint": "^9.9.0", - "happy-dom": "^15.0.0", + "happy-dom": "^20.8.9", "react": "^19.2.7", "react-dom": "^19.2.7", "sass": "^1.101.0", "typescript": "^5.5.0", - "vitest": "^2.0.5" + "vitest": "^3.2.6" }, "publishConfig": { "access": "public",