Upgrade vitest to 3.2.6 · Pull request #5 · john-peterson-g17/todo-app

Advisory	Severity	Affected	Fixed in	Summary
GHSA-5xrq-8626-4rwp	critical	0.32.4	3.2.6	When Vitest UI server is listening, arbitrary file can be read and executed

Dependency review

Failed. Adds 1 vulnerable package.

src/package-lock.json

Change	Package	Version	Relationship	License	Vulnerabilities
Added	`@esbuild/aix-ppc64`	0.28.2	transitive, development	MIT	none known
Added	`@esbuild/android-arm`	0.28.2	transitive, development	MIT	none known
Added	`@esbuild/android-arm64`	0.28.2	transitive, development	MIT	none known
Added	`@esbuild/android-x64`	0.28.2	transitive, development	MIT	none known
Added	`@esbuild/darwin-arm64`	0.28.2	transitive, development	MIT	none known
Added	`@esbuild/darwin-x64`	0.28.2	transitive, development	MIT	none known
Added	`@esbuild/freebsd-arm64`	0.28.2	transitive, development	MIT	none known
Added	`@esbuild/freebsd-x64`	0.28.2	transitive, development	MIT	none known
Added	`@esbuild/linux-arm`	0.28.2	transitive, development	MIT	none known
Added	`@esbuild/linux-arm64`	0.28.2	transitive, development	MIT	none known
Added	`@esbuild/linux-ia32`	0.28.2	transitive, development	MIT	none known
Added	`@esbuild/linux-loong64`	0.28.2	transitive, development	MIT	none known
Added	`@esbuild/linux-mips64el`	0.28.2	transitive, development	MIT	none known
Added	`@esbuild/linux-ppc64`	0.28.2	transitive, development	MIT	none known
Added	`@esbuild/linux-riscv64`	0.28.2	transitive, development	MIT	none known
Added	`@esbuild/linux-s390x`	0.28.2	transitive, development	MIT	none known
Added	`@esbuild/linux-x64`	0.28.2	transitive, development	MIT	none known
Added	`@esbuild/netbsd-arm64`	0.28.2	transitive, development	MIT	none known
Added	`@esbuild/netbsd-x64`	0.28.2	transitive, development	MIT	none known
Added	`@esbuild/openbsd-arm64`	0.28.2	transitive, development	MIT	none known
Added	`@esbuild/openbsd-x64`	0.28.2	transitive, development	MIT	none known
Added	`@esbuild/openharmony-arm64`	0.28.2	transitive, development	MIT	none known
Added	`@esbuild/sunos-x64`	0.28.2	transitive, development	MIT	none known
Added	`@esbuild/win32-arm64`	0.28.2	transitive, development	MIT	none known
Added	`@esbuild/win32-ia32`	0.28.2	transitive, development	MIT	none known
Added	`@esbuild/win32-x64`	0.28.2	transitive, development	MIT	none known
Added	`@jridgewell/sourcemap-codec`	1.6.0	transitive	MIT	none known
Added	`@napi-rs/lzma-linux-x64-gnu`	1.5.1	transitive, development	MIT	none known
Added	`@rollup/rollup-android-arm-eabi`	4.64.6	transitive, development	MIT	none known
Added	`@rollup/rollup-android-arm64`	4.64.6	transitive, development	MIT	none known
Added	`@rollup/rollup-darwin-arm64`	4.64.6	transitive, development	MIT	none known
Added	`@rollup/rollup-darwin-x64`	4.64.6	transitive, development	MIT	none known
Added	`@rollup/rollup-freebsd-arm64`	4.64.6	transitive, development	MIT	none known
Added	`@rollup/rollup-freebsd-x64`	4.64.6	transitive, development	MIT	none known
Added	`@rollup/rollup-linux-arm-gnueabihf`	4.64.6	transitive, development	MIT	none known
Added	`@rollup/rollup-linux-arm-musleabihf`	4.64.6	transitive, development	MIT	none known
Added	`@rollup/rollup-linux-arm64-gnu`	4.64.6	transitive, development	MIT	none known
Added	`@rollup/rollup-linux-arm64-musl`	4.64.6	transitive, development	MIT	none known
Added	`@rollup/rollup-linux-loong64-gnu`	4.64.6	transitive, development	MIT	none known
Added	`@rollup/rollup-linux-loong64-musl`	4.64.6	transitive, development	MIT	none known
Added	`@rollup/rollup-linux-ppc64-gnu`	4.64.6	transitive, development	MIT	none known
Added	`@rollup/rollup-linux-ppc64-musl`	4.64.6	transitive, development	MIT	none known
Added	`@rollup/rollup-linux-riscv64-gnu`	4.64.6	transitive, development	MIT	none known
Added	`@rollup/rollup-linux-riscv64-musl`	4.64.6	transitive, development	MIT	none known
Added	`@rollup/rollup-linux-s390x-gnu`	4.64.6	transitive, development	MIT	none known
Added	`@rollup/rollup-linux-x64-gnu`	4.64.6	transitive, development	MIT	none known
Added	`@rollup/rollup-linux-x64-musl`	4.64.6	transitive, development	MIT	none known
Added	`@rollup/rollup-openbsd-x64`	4.64.6	transitive, development	MIT	none known
Added	`@rollup/rollup-openharmony-arm64`	4.64.6	transitive, development	MIT	none known
Added	`@rollup/rollup-win32-arm64-msvc`	4.64.6	transitive, development	MIT	none known
Added	`@rollup/rollup-win32-ia32-msvc`	4.64.6	transitive, development	MIT	none known
Added	`@rollup/rollup-win32-x64-gnu`	4.64.6	transitive, development	MIT	none known
Added	`@rollup/rollup-win32-x64-msvc`	4.64.6	transitive, development	MIT	none known
Added	`@types/chai`	5.2.3	transitive, development	MIT	none known
Added	`@types/deep-eql`	4.0.2	transitive, development	MIT	none known
Added	`@types/estree`	1.0.9	transitive, development	MIT	none known
Added	`@vitest/expect`	3.2.7	transitive, development	MIT	none known
Added	`@vitest/mocker`	3.2.7	transitive, development	MIT	GHSA-82fw-gwwq-j7x9 medium
Added	`@vitest/pretty-format`	3.2.7	transitive, development	MIT	none known
Added	`@vitest/runner`	3.2.7	transitive, development	MIT	none known
Added	`@vitest/snapshot`	3.2.7	transitive, development	MIT	none known
Added	`@vitest/spy`	3.2.7	transitive, development	MIT	none known
Added	`@vitest/utils`	3.2.7	transitive, development	MIT	none known
Added	`assertion-error`	2.0.1	transitive, development	MIT	none known
Added	`chai`	5.3.3	transitive, development	MIT	none known
Added	`check-error`	2.1.3	transitive, development	MIT	none known
Added	`debug`	4.4.3	transitive, development	MIT	none known
Added	`deep-eql`	5.0.2	transitive, development	MIT	none known
Added	`es-module-lexer`	1.7.0	transitive, development	MIT	none known
Added	`esbuild`	0.28.2	transitive, development	MIT	none known
Added	`estree-walker`	3.0.3	transitive, development	MIT	none known
Added	`expect-type`	1.4.0	transitive, development	Apache-2.0	none known
Added	`fdir`	6.5.0	transitive, development	MIT	none known
Added	`fsevents`	2.3.3	transitive, development	MIT	none known
Added	`js-tokens`	9.0.1	transitive, development	MIT	none known
Added	`loupe`	3.2.1	transitive, development	MIT	none known
Added	`magic-string`	0.30.21	transitive	MIT	none known
Added	`ms`	2.1.3	transitive, development	MIT	none known
Added	`nanoid`	3.3.20	transitive	MIT	none known
Added	`pathe`	2.0.3	transitive, development	MIT	none known
Added	`pathval`	2.0.1	transitive, development	MIT	none known
Added	`picocolors`	1.1.1	transitive	ISC	none known
Added	`picomatch`	4.0.7	transitive, development	MIT	none known
Added	`postcss`	8.5.30	transitive	MIT	none known
Added	`rollup`	4.64.6	transitive, development	MIT	none known
Added	`source-map-js`	1.2.2	transitive	BSD-3-Clause	none known
Added	`std-env`	3.10.0	transitive, development	MIT	none known
Added	`strip-literal`	3.1.0	transitive, development	MIT	none known
Added	`tinybench`	2.9.0	transitive, development	MIT	none known
Added	`tinyexec`	0.3.2	transitive, development	MIT	none known
Added	`tinyglobby`	0.2.17	transitive, development	MIT	none known
Added	`tinypool`	1.1.1	transitive, development	MIT	GHSA-5gmw-xhrv-c9v3 critical, GHSA-85c8-ppgw-ccpr critical
Added	`tinyrainbow`	2.0.0	transitive, development	MIT	none known
Added	`tinyspy`	4.0.6	transitive, development	MIT	none known
Added	`vite`	7.3.7	direct, development	MIT	none known
Added	`vite-node`	3.2.4	transitive, development	MIT	none known
Added	`vitest`	3.2.7	direct, development	MIT	GHSA-82fw-gwwq-j7x9 medium
Added	`why-is-node-running`	2.3.0	transitive, development	MIT	none known
Removed	`@jest/schemas`	29.6.0	transitive	unknown
Removed	`@jridgewell/sourcemap-codec`	1.4.15	transitive	unknown
Removed	`@sinclair/typebox`	0.27.8	transitive	unknown
Removed	`@types/chai`	4.3.5	transitive	unknown
Removed	`@types/chai-subset`	1.3.3	transitive	unknown
Removed	`@vitest/expect`	0.32.4	transitive	unknown
Removed	`@vitest/runner`	0.32.4	transitive	unknown
Removed	`@vitest/snapshot`	0.32.4	transitive	unknown
Removed	`@vitest/spy`	0.32.4	transitive	unknown
Removed	`@vitest/utils`	0.32.4	transitive	unknown
Removed	`acorn-walk`	8.2.0	transitive	unknown
Removed	`ansi-styles`	5.2.0	transitive	unknown
Removed	`assertion-error`	1.1.0	transitive	unknown
Removed	`chai`	4.3.7	transitive	unknown
Removed	`check-error`	1.0.2	transitive	unknown
Removed	`debug`	4.3.4	transitive	unknown
Removed	`deep-eql`	4.1.3	transitive	unknown
Removed	`diff-sequences`	29.4.3	transitive	unknown
Removed	`fsevents`	2.3.2	transitive	unknown
Removed	`get-func-name`	2.0.0	transitive	unknown
Removed	`jsonc-parser`	3.2.0	transitive	unknown
Removed	`local-pkg`	0.4.3	transitive	unknown
Removed	`loupe`	2.3.6	transitive	unknown
Removed	`magic-string`	0.30.1	transitive	unknown
Removed	`mlly`	1.4.0	transitive	unknown
Removed	`ms`	2.1.2	transitive	unknown
Removed	`nanoid`	3.3.6	transitive	unknown
Removed	`p-limit`	4.0.0	transitive	unknown
Removed	`pathe`	1.1.1	transitive	unknown
Removed	`pathval`	1.1.1	transitive	unknown
Removed	`picocolors`	1.0.0	transitive	unknown
Removed	`pkg-types`	1.0.3	transitive	unknown
Removed	`postcss`	8.4.26	transitive	unknown
Removed	`pretty-format`	29.6.1	transitive	unknown
Removed	`react-is`	18.2.0	transitive	unknown
Removed	`source-map-js`	1.0.2	transitive	unknown
Removed	`std-env`	3.3.3	transitive	unknown
Removed	`strip-literal`	1.0.1	transitive	unknown
Removed	`tinybench`	2.5.0	transitive	unknown
Removed	`tinypool`	0.5.0	transitive	unknown
Removed	`tinyspy`	2.1.1	transitive	unknown
Removed	`type-detect`	4.0.8	transitive	unknown
Removed	`ufo`	1.1.2	transitive	unknown
Removed	`vite-node`	0.32.4	transitive	unknown
Removed	`vitest`	0.32.4	direct	unknown
Removed	`why-is-node-running`	2.2.2	transitive	unknown
Removed	`yocto-queue`	1.0.0	transitive	unknown

This check fails on vulnerabilities of high severity or higher. Change it in the repository's Security settings.