fix: upgrade @vitest/browser to 4.1.6, 5.0.0-beta.3 (CVE-2026-47428)#2093
fix: upgrade @vitest/browser to 4.1.6, 5.0.0-beta.3 (CVE-2026-47428)#2093anupamme wants to merge 2 commits into
Conversation
Automated dependency upgrade by OrbisAI Security
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4fc3e26dea
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| "*": "moeru-lint --fix" | ||
| }, | ||
| "dependencies": { | ||
| "@vitest/browser": "catalog:" |
There was a problem hiding this comment.
Adding this as a separate root dependency does not remove the vulnerable install path that the security fix is targeting: the lockfile still contains @vitest/browser-playwright@4.1.4 depending on @vitest/browser@4.1.4 (pnpm-lock.yaml around the browser-playwright snapshot), while catalogs.vitest still pins the Vitest family to ^4.1.4. In contexts that scan pnpm-lock.yaml for CVE-2026-47428, @vitest/browser@4.1.4 will still be reported, so this should upgrade the coordinated Vitest/browser-playwright catalog entries instead of adding an unrelated root dependency.
Useful? React with 👍 / 👎.
⏳ Approval required for deploying to Cloudflare Workers (Preview) for stage-web.
Hey, maintainers, kindly take some time to review and approve this deployment when you are available. Thank you! 🙏 |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 342652b2dd
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| dependencies: | ||
| '@vitest/browser': | ||
| specifier: 'catalog:' | ||
| version: 4.1.6(bufferutil@4.1.0)(utf-8-validate@5.0.10)(vite@8.0.8(@types/node@24.12.2)(esbuild@0.27.2)(jiti@2.6.1)(less@4.6.4)(terser@5.46.1)(tsx@4.21.0)(yaml@2.8.3))(vitest@4.1.4) |
There was a problem hiding this comment.
This installs @vitest/browser@4.1.6 while resolving its vitest peer to 4.1.4; the lockfile package entry for @vitest/browser@4.1.6 declares an exact vitest: 4.1.6 peer, so browser-mode tests now run an unsupported mixed Vitest stack. Please upgrade the Vitest catalog entries together (including vitest, @vitest/browser-playwright, and coverage) rather than pinning only the browser package.
Useful? React with 👍 / 👎.
1 participant
Summary
Upgrade @vitest/browser from 4.1.4 to 4.1.6, 5.0.0-beta.3 to fix CVE-2026-47428.
Vulnerability
CVE-2026-47428pnpm-lock.yamlDescription: vitest: Vitest: Arbitrary code execution via crafted browser-runner URL
Evidence
Scanner confirmation: trivy rule
CVE-2026-47428flagged this pattern.Production code: This file is in the production codebase, not test-only code.
Threat Model Context
This is a Node.js library - vulnerabilities affect downstream consumers who use this package.
Changes
pnpm-workspace.yamlpackage.jsonpnpm-lock.yamlVerification
This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.
Automated security fix by OrbisAI Security