chore(deps): update dependency vitest to v4 [security] #571
Loading…
Reference in a new issue
No description provided.
Delete branch "renovate/npm-vitest-vulnerability"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
3.2.7→4.1.11Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock
CVE-2026-84373 / GHSA-82fw-gwwq-j7x9
More information
Details
Summary
@vitest/mockerregisters a redirect mock's target path without validating itagainst the dev server's file-serving allowlist. An attacker who can reach the
dev server's WebSocket can register a redirect mock pointing outside the project
root; when the mocked module is requested, the plugin's
loadhook returnsreadFile(<attacker path>)as the module source, disclosing local files.This is exploitable without authentication only through the public
mockerPlugin/ standaloneinterceptorPluginexports (used by third-party devservers), which register the handler on Vite's unauthenticated HMR socket.
Vitest's own browser mode registers mocks over a token-authenticated RPC and
is not remotely reachable by default (see Scope).
Affected code
packages/mocker/src/node/interceptorPlugin.ts.The
loadhook is the file-read sink:mock.redirectis derived from client input at registration time with noboundary check:
There is no
server.fs.allow/server.fs.denycheck and no assertion that theresolved path stays within the project root.
Registration paths and trust boundaries
mockerPlugin/interceptorPlugin(unauthenticated). InconfigureServer, the plugin registersserver.ws.on('vitest:interceptor:register', …)on Vite's HMR WebSocket. That socket performs no token, Origin, or same-origin
check, so any client that can reach it can register a redirect mock. This is
the path the "unauthenticated" impact applies to.
(
registerMock), which sits behind a per-run token (isValidApiRequest, arandom
api.token). The interceptor'sconfigureServersocket is not used forregistration here (in v5 it does not run at all, as the plugin is injected per
environment). The same missing boundary check exists on the authenticated RPC
path, but reaching it requires the token, so it is not a remote-unauthenticated
read.
Path handling
new URL(redirect).pathnamecombined withjoin(root, pathname)does notconfine reads to the root:
file:,http:) are normalized by WHATWG URL,so
..segments are collapsed and the result stays under the root. Payloads ofthe form
file:///../../etc/passwddo not escape...inpathname, sojoin(root, "../../…/etc/passwd")resolves outside the root and reads anarbitrary file.
Even without escaping the root, the missing
server.fscheck allows reading anyin-root file the dev server would otherwise refuse to serve (for example an
in-root
.envor source that is denied byserver.fs.deny).Scope / preconditions
localhostbydefault and is not reachable from the network unless the developer exposes it
(
server.host/0.0.0.0, a LAN bind, or a proxy).and CORS protections entirely and can both register the mock and read the
response.
by Vite defaults: the default CORS origin allowlist is limited to
localhostorigins, and
server.allowedHostsblocks DNS-rebinding, so a cross-origin pagecannot read the file contents back.
Impact
Disclosure of local files readable by the dev-server process (source, in-root
.env/secrets, and, via the opaque-scheme payload, files outside the projectroot). No integrity or availability impact.
Affected versions
Present since
@vitest/mockerwas introduced.@vitest/mocker>= 2.1.0 (shipped invitestand@vitest/browser>= 2.1.0), through 4.1.x and the 5.0.0 pre-releases.maintained and are not planned to receive the fix.
Fix
Validate the resolved redirect target against Vite's file-serving allowlist
(
isFileLoadingAllowed) before registering it, at every registration site, andstop registering the interceptor WebSocket events in Vitest's browser mode
(mocks there flow through the authenticated RPC).
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
vitest-dev/vitest (vitest)
v4.1.11Compare Source
🐞 Bug Fixes
View changes on GitHub
v4.1.10Compare Source
🐞 Bug Fixes
View changes on GitHub
v4.1.9Compare Source
🐞 Bug Fixes
importOriginalwith optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in #10546 (a5180)View changes on GitHub
v4.1.8Compare Source
🐞 Bug Fixes
cdpAPI whenallowWrite/allowExec: false[backport to v4] - by @hi-ogawa and Codex in #10450 (e4067)View changes on GitHub
v4.1.7Compare Source
🐞 Bug Fixes
View changes on GitHub
v4.1.6Compare Source
🐞 Bug Fixes
ToMatchScreenshotResolvePath- by @macarie and @sheremet-va in #10138 (31882)sequence.concurrent: truewith top-leveltest(..., { concurrent: false })+ depreactesequentialtest API and options - by @hi-ogawa, Codex and @sheremet-va in #10196 (2847d)🏎 Performance
View changes on GitHub
v4.1.5Compare Source
🚀 Experimental Features
instrumenteroption - by @BartWaardenburg and @AriPerkkio in #10119 (0e0ff)🐞 Bug Fixes
vi.defineHelpercalled as object method - by @hi-ogawa in #10163 (122c2)agentreporter tominimal- by @sheremet-va in #10157 (663b9)View changes on GitHub
v4.1.4Compare Source
🚀 Experimental Features
skipFullif agent detected - by @hi-ogawa in #10018 (53757)assertionas a public field - by @sheremet-va in #10095 (a120e)🐞 Bug Fixes
expect(..., message)consistent as error message prefix - by @hi-ogawa and Codex in #10068 (a1b5f)View changes on GitHub
v4.1.3Compare Source
🚀 Experimental Features
experimental.preParseflag - by @sheremet-va in #10070 (78273)browser.locators.exactoption - by @sheremet-va in #10013 (48799)TestAttachment.bodyEncoding- by @hi-ogawa in #9969 (89ca0)🐞 Bug Fixes
expect.pollinterval - by @hi-ogawa and Claude Sonnet 4.6 in #10022 (3f5bf)@vitest/coverage-v8and@vitest/coverage-istanbulas optional dependency - by @alan-agius4 in #10025 (146d4)defineHelperfor webkit async stack trace + update playwright 1.59.0 - by @hi-ogawa in #10036 (5a5fa)JestExtendError.contextfrom verbose error reporting - by @hi-ogawa in #9983 (66751)vitest- by @hi-ogawa and Codex in #10042 (691d3)View changes on GitHub
v4.1.2Compare Source
This release bumps Vitest's
flattedversion and removes version pinning to resolveflatted's CVE related issues (#9975).🐞 Bug Fixes
setupFilesfrom parent directory - by @hi-ogawa in #9960 (7aa93)toMatchScreenshotcan't capture a stable screenshot - by @macarie in #9847 (faace)coverageConfigDefaultsvalues and types - by @Arthie in #9940 (b3c99)View changes on GitHub
v4.1.1Compare Source
🚀 Features
matchesTagsto test if the current filter matches tags - by @sheremet-va in #9913 (eec53)experimental.vcsProvider- by @sheremet-va in #9928 (56115)🐞 Bug Fixes
TestProject.testFilesListinternal properly - by @sapphi-red in #9867 (54f26)use- by @oilater in #9831 and #9861 (633ae)vi.advanceTimersto the preview provider - by @sheremet-va in #9891 (1bc3e)--standalonemode without running tests - by @sheremet-va in #9911 (e78ad)body- by @sheremet-va in #9912 (6fdb2)retry.conditionRegExp serialization issue - by @nstepien and @hi-ogawa in #9942 (7b605)testreturn as tests - by @sheremet-va in #9871 (141e7)View changes on GitHub
v4.1.0Compare Source
Vitest 4.1 is out!
This release page lists all changes made to the project during the 4.1 beta. To get a review of all the new features, read our blog post.
🚀 Features
setTickModeto timer controls - by @atscott and @sheremet-va in #8726 (4b480)toTestSpecificationto reported tasks - by @sheremet-va in #9464 (1a470)vi.mockorvi.hoistedare declared outside of top level of the module - by @sheremet-va in #9387 (5db54)aroundEachandaroundAllhooks - by @sheremet-va in #9450 (2a8cb)neworallin--updateflag - by @sheremet-va in #9543 (a5acf)metain test options - by @sheremet-va in #9535 (7d622)test.extendsyntax - by @sheremet-va in #9550 (e5385)vitest listto statically collect tests instead of running files to collect them - by @sheremet-va in #9630 (7a8e7)--detect-async-leaks- by @AriPerkkio in #9528 (c594d)mockThrowandmockThrowOnce- by @thor-juhasz and @sheremet-va in #9512 (61917)update: "none"and add docs about snapshots behavior on CI - by @hi-ogawa in #9700 (05f18)launchOptionswithconnectOptions- by @hi-ogawa in #9702 (f0ff1)page/locator.markAPI to enhance playwright trace - by @hi-ogawa in #9652 (d0ee5)testinexperimental_parseSpecification- by @jgillick and Jeremy Gillick in #9235 (2f367)createSpecification- by @sheremet-va in #9336 (c8e6c)runTestFilesas alternative torunTestSpecifications- by @sheremet-va in #9443 (43d76)allowWriteandallowExecoptions toapi- by @sheremet-va in #9350 (20e00)toTestSpecification- by @sheremet-va in #9627 (6f17d)userEvent.wheelAPI - by @macarie in #9188 (66080)filterNodeoption to prettyDOM for filtering browser assertion error output - by @Copilot, sheremet-va and @sheremet-va in #9475 (d3220)detailsPanelPositionoption and button - by @shairez in #9525 (c8a31)findElementand enable strict mode in webdriverio and preview - by @sheremet-va in #9677 (c3f37)ignore start/stopignore hints - by @AriPerkkio in #9204 (e59c9)coverage.changedoption to report only changed files - by @kykim00 and @AriPerkkio in #9521 (1d939)onModuleRunnerhook toworker.init- by @sheremet-va in #9286 (e977f)importDurations: { limit, print }options - by @hi-ogawa, Claude Opus 4.6 and @sheremet-va in #9401 (7e10f)importDurations- by @hi-ogawa and Claude Opus 4.6 in #9533 (3f7a5)beforeAll/afterAll- by @sheremet-va in #9572 (c8339)agentreporter to reduce ai agent token usage - by @cpojer in #9779 (3e9e0)retryoptions - by @MazenSamehR, Matan Shavit, @AriPerkkio and @sheremet-va in #9370 (9e4cf)🐞 Bug Fixes
meta.urlincreateRequire- by @sheremet-va in #9441 (e3422)external/noExternalduringconfigEnvironmenthook - by @hi-ogawa and Claude Opus 4.6 in #9508 (59ea2)browser.isolateis used - by @sheremet-va in #9410 (3d48e)vi.mock({ spy: true })node v8 coverage - by @hi-ogawa, hi-ogawa and Claude Opus 4.6 in #9541 (687b6).namefrom statically collected test - by @sheremet-va in #9596 (b66ff)expect.soft- by @iumehara, @hi-ogawa and Claude Opus 4.6 in #9231 (3eb2c)sequence.shuffle.testsis enabled - by @kaigritun, Kai Gritun and @sheremet-va in #9576 (8182b)expect/src/utilsfromvitest- by @hi-ogawa in #9616 (48739)--detect-async-leaks- by @AriPerkkio in #9638 (9fd4c)aroundEach/Allwhen inneraroundEach/Allthrows - by @hi-ogawa in #9657 (4ec6c)aroundEach/Allsetup timed out - by @hi-ogawa in #9670 (bb013)VitestRunnerConfigoptional fields withSerializedConfig- by @hi-ogawa in #9661 (79520)toBe*spy assertions in favor oftoHaveBeen*(andtoThrowError) - by @sheremet-va in #9665 (4d390)aroundEach/Allerrors but aggregate them on runner - by @hi-ogawa in #9673 (b6365)resolves/rejectschained assertion error - by @hi-ogawa in #9679 (c6151)maxConcurrency- by @hi-ogawa in #9653 (16d13)resolve.conditionsfor externals - by @hi-ogawa in #9717 (1d498)mockObjectchange backwards compatible - by @sheremet-va in #9744 (84c69)URL.nameon jsdom - by @hi-ogawa in #9767 (031f3)vi.importActual()for virtual modules - by @hi-ogawa and Claude Opus 4.6 in #9772 (1e89e)FixtureAccessErrorif suite hook accesses undefined fixture - by @sheremet-va in #9786 (fc2ce)loadortransformoriginal module - by @hi-ogawa and Claude Opus 4.6 in #9774 (a8216)hideSkippedTestsshould not hidetest.todo- by @oilater in #9562 and #9781 (8181e)beforeEachhooks - by @hi-ogawa and Claude Opus 4.6 in #9826 (99e52)performance.nowto measure test timeout duration - by @hi-ogawa and Claude Opus 4.6 in #9795 (f48a6)toMatchScreenshotpasses - by @macarie in #9289 (46aab)toMatchScreenshot- by @macarie in #9552 (83ca0)--remote-debugging-addressfrom chrome args - by @hi-ogawa and @AriPerkkio in #9712 (f09bb)ensureAwaited- by @sheremet-va in #9732 (97685)getCDPSessionandcdp()- by @AriPerkkio in #9716 (689a2)deepEqualin the config because it's not serializable - by @sheremet-va in #9666 (9ee99)thresholds.autoUpdateto preserve ending whitespace - by @AriPerkkio in #9436 (7e534)/config/#optionhash links causing hydration errors - by @hi-ogawa, Claude Opus 4.6 and @sheremet-va in #9610 (a603c)toMatchObject(Map/Set)should expectMap/Seton left hand side - by @hi-ogawa and Claude Opus 4.6 in #9532 (381da)toThrowand make Error detection robust - by @hi-ogawa and Claude Opus 4.6 in #9570 (de215)dotreporter leaves pending tests - by @AriPerkkio in #9684 (4d793)undefined- by @sheremet-va in #9511 (6f181)bench.reportersno longer gives type errors when passing file name string paths - by @Bertie690 in #9695 (093c8)🏎 Performance
View changes on GitHub
v4.0.18Compare Source
🚀 Experimental Features
onModuleRunnerhook toworker.init- by @sheremet-va in #9286 (ea837)🐞 Bug Fixes
meta.urlincreateRequire- by @sheremet-va in #9441 (e0572)View changes on GitHub
v4.0.17Compare Source
🚀 Experimental Features
🐞 Bug Fixes
addEventHandler#9371 - by @ThibautMarechal in #9372 and #9371 (40841)process.envandimport.meta.envdefines in inline project - by @hi-ogawa in #9239 (b70c9)ErrorEvent.messagewhen unhandledErrorEvent.erroris null - by @hi-ogawa in #9322 (5d84e)fileParallelismon an instance - by @sheremet-va in #9328 (15006)istanbul-lib-source-mapsusage - by @AriPerkkio in #9344 (b0940)View changes on GitHub
v4.0.16Compare Source
🐞 Bug Fixes
process.versionsstub - by @AriPerkkio in #9174 (78cfb)test.poolOptionsif it's set - by @sheremet-va in #9226 (f7f6a)recordArtifactfrom the vitest package - by @macarie in #9186 (01c56)import.meta.envdefine - by @hi-ogawa in #9205 (01a9a)setupEnvironmentfor custom pools - by @AriPerkkio in #9187 (5d26b)View changes on GitHub
v4.0.15Compare Source
🚀 Experimental Features
🐞 Bug Fixes
optimizeDeps.rolldownOptionsto fix depreated warning + fixssr.external: true- by @hi-ogawa in #9121 (fd8bd)deps.optimizer- by @hi-ogawa in #9125 (4c754)toMatchScreenshotonly once when used withexpect.element- by @macarie in #9132 (0d2e7)--browser.providerfrom docs - by @sheremet-va in #9115 (120b3)currentTestNamein extended matchers - by @macarie in #9106 (e4345)CTRL+cforceful exits - by @AriPerkkio in #9140 (d57d8)View changes on GitHub
v4.0.14Compare Source
🚀 Experimental Features
utils.configurePrettyDOM- by @sheremet-va in #9103 (2cc34)toMatchScreenshotwith comparison slider - by @macarie in #8813 (c37c2)🐞 Bug Fixes
collecttoimport, removeprepare- by @sheremet-va in #9091 (1256b)onCancelon rpc destroy - by @AriPerkkio in #9088 (f5b72)VITEST_POOL_ID+VITEST_WORKER_IDbefore environment setup - by @AriPerkkio in #9085 (37918)postMessageto send ports to workers - by @whitphx and @AriPerkkio in #9078 (9d176)🏎 Performance
debugwithobug- by @sxzz and @AriPerkkio in #9057 (acc51)View changes on GitHub
v4.0.13Compare Source
🐞 Bug Fixes
🏎 Performance
fsCacheModuleis enabled, read from the memory when possible - by @sheremet-va in #9076 (6b9a1)View changes on GitHub
v4.0.12Compare Source
🐞 Bug Fixes
fsModuleCachePathby default - by @sheremet-va in #9063 (9a8bc)@opentelemetry/apiin public types - by @sheremet-va in #9066 (e944a)View changes on GitHub
v4.0.11Compare Source
🚀 Experimental Features
taskinMatchState- by @macarie in #9022 (afd1f)🏎 Performance
View changes on GitHub
v4.0.10Compare Source
🐞 Bug Fixes
onCancelwhen worker is terminated - by @sheremet-va in #9033 (6d7f0)onFinished) - by @userquin in #8975 (f56dc)View changes on GitHub
v4.0.9Compare Source
🚀 Experimental Features
🐞 Bug Fixes
Request- by @sheremet-va in #8985 (506a9)View changes on GitHub
v4.0.8Compare Source
🐞 Bug Fixes
noExternalmerging bug on Vite 6 - by @hi-ogawa in #8950 (bcb13)expect.element()- by @StyleShit in #8954 (9638d)vi.fn(), fix types forvi.spyOn(obj, class)- by @sheremet-va in #8956 (75e7f)View changes on GitHub
v4.0.7Compare Source
🐞 Bug Fixes
processin case global is overwritten - by @AriPerkkio in #8916 (6240d)isolate: false- by @sheremet-va in #8915 (c9078)toContainElement()matcher - by @vitalybaev in #8910 and #8927 (35a27)isolateoption, deprecatebrowser.isolate/browser.fileParallelism- by @sheremet-va in #8890 (9d2b4)--execArgvas array - by @AriPerkkio in #8924 (751c3)URL.createObjectURL,FormData.set(prop, blob)- by @sheremet-va in #8935 (a1b73)--requireargument when running in deno - by @pi0 in #8897 (d41fa)tsc- by @AriPerkkio in #8920 (fdb2e)🏎 Performance
Array.fromcall - by @Connormiha in #8907 (b6014)View changes on GitHub
v4.0.6Compare Source
🐞 Bug Fixes
isolateandfileParallelismare false - by @sheremet-va in #8889 (31706)FormDatatoRequest- by @sheremet-va in #8880 (197ca)View changes on GitHub
v4.0.5Compare Source
🐞 Bug Fixes
ssr.noExternalwhen externalizing dependencies, fix Svelte and Astro - by @sheremet-va in #8862 (a4f86)Locatortype in selectOptions element parameter - by @rzzf and @sheremet-va in #8848 (7ee28)getBuiltinsunconditionally - by @sapphi-red in #8863 (0e858)groupIdtogroupOrderin error message - by @Yohannfra in #8856 (b9aab)🏎 Performance
--no-isolate --maxWorkers=1- by @AriPerkkio in #8835 (584aa)View changes on GitHub
v4.0.4Compare Source
🐞 Bug Fixes
node:prefix - by @sheremet-va in #8829 (06208)MaxListenersExceededWarning- by @AriPerkkio in #8820 (d1bff)stdioto logger - by @AriPerkkio in #8809 (fb95f)vi.mockedutility - by @sheremet-va in #8839 (f8756)isolate: false- by @AriPerkkio in #8821 (573dc)🏎 Performance
View changes on GitHub
v4.0.3Compare Source
🐞 Bug Fixes
View changes on GitHub
v4.0.2Compare Source
🐞 Bug Fixes
length- by @sheremet-va in #8778 (d4c2b)restoreMocksandmockResetare set in the config - by @sheremet-va in #8781 (2eedb)View changes on GitHub
v4.0.1Compare Source
🐞 Bug Fixes
getBuiltinscheck - by @sheremet-va in #8765 (81000)View changes on GitHub
v4.0.0Compare Source
Vitest 4.0 is out!
To stay updated, read our blog post and check the migration guide.
🚨 Breaking Changes
'basic'reporter - by @AriPerkkio in #7884 (82fcf)vitest/nodeexports - by @sheremet-va in #8197 (dc848)vitest/nodeinstead - by @sheremet-va in #8200 (1e60c)workspaceoption in favor ofprojects- by @sheremet-va in #8218 (76fb7)--standalonewhen CLI filename filter is used - by @AriPerkkio in #8262 (013bf)minWorkersand set it automatically to 0 in non watch mode - by @sheremet-va in #8454 (2c2d1)treereporter - by @sheremet-va and @AriPerkkio in #8500 (25fd3)tinypool- by @AriPerkkio and @sheremet-va in #8705 (4822d)todoif no function is passed down totestordescribe- by @sheremet-va in #8346 (1a81c)🚀 Features
onUnhandledErrorcallback - by @sheremet-va in #8162 (924cb)expect.assertfor type narrowing - by @sheremet-va in #8695 (fe589)displayAnnotationsoption togithub-options- by @sheremet-va in #8706 (4a66d)experimental_parseSpecifications- by @sheremet-va in #8408 (fdeb2)enableCoverageanddisableCoveragemethods - by @sheremet-va and @AriPerkkio in #8412 (61eb7)getGlobalTestNamePatternmethod - by @sheremet-va in #8438 (bdb70)relativeModuleIdtoTestModule- by @sheremet-va in #8505 (3be09)getSeedmethod - by @sheremet-va in #8592 (438c4)toBeInViewportutility method to assert element is in viewport or not - by @Shinyaigeek in #8234 (ceed5)vitest initcli command - by @thejackshelton in #8330 (1638b)toMatchScreenshotfor Visual Regression Testing - by @macarie in #8041 (d45f9)trackUnhandledErrorsoption - by @sheremet-va in #8386 (c0ec0)lengthproperty to locators,toHaveLengthnow accepts locators - by @sheremet-va in #8512 (2308c)optionsonBrowserProviderOption- by @sheremet-va in #8609 (0d0e5)--inspectoption in webdriverio - by @sheremet-va in #8613 (38adc)autoUpdateto support percentage formatting - by @Battjmo and @AriPerkkio in #8456 (99e01)toBeNullableexpect function to check provided value is nullish - by @Shinyaigeek and @sheremet-va in #8294 (eeec5)automockerentry - by @sheremet-va in #8301 (e9c92)🐞 Bug Fixes
test.extend- by @AriPerkkio in #8278 (43977)--changedflag support tovitest listcommand - by @haakonjackfloat in #8270 and #8272 (e71a5)browser- by @sheremet-va in #8334 (0417a)oxcinstead ofesbuildonrolldown-vite- by @hi-ogawa in #8378 (e922e)stacksproperty in Node.js context - by @sheremet-va in #8392 (b825e)import.meta.resolveon Vite 7 - by @hi-ogawa in #8493 (549d3)expect.pollassertion fails - by @sheremet-va in #8483 (fb450)useFakeTimersis called multiple times - by @sheremet-va in #8504 (ed7e3)expect.extendmatchers - by @lzl0304 in #8520 (96945)globalSetupfiles - by @sheremet-va in #8534 (8978a)$and%formatting totest.for/eachtitle - by @hi-ogawa in #8557 (ea6d7)"./*"with specific files in vitest package - by @hi-ogawa in #8560 (ce746)optimizeDeps.includefor browser mode - by @jake-danton in #8570 (cdcf7)enginesfield to drop Node 18 support - by @sheremet-va in #8608 (9a0bf)baseoption doesn't crash vitest - by @sheremet-va in #8760 (9f0ec)locator.element()returnsHTMLElementorSVGElement- by @sheremet-va in #8440 (c1ac1)vitedirectly - by @sheremet-va in #8541 (d7fca)not.toBeInTheDocument()- by @sheremet-va in #8751 (f5d06)objectContainingexpect utility to have more compatibility to jest's one - by @Shinyaigeek in #8241 (480be)--projectfilter - by @gtbuchanan in #7885 (761be)vitest:coverage-transformplugin - by @AriPerkkio in #8477 (ff517)coverage.exclude- by @sheremet-va in #8731 (c9c30)regexpHoistableto allow whitespace before parentheses - by @cszhjh in #8231 (a0f9a)resolvedSourcescorrectly - by @sheremet-va in #8736 (8fc52)vitest --standalone- by @AriPerkkio in #8248 (37cc2)config.includeoption withconfig.browser.instances[].includeoption if it is specified - by @Shinyaigeek in #8260 (010fc)🏎 Performance
process.title- by @sheremet-va in #8453 (0a766)@vitest/expect- by @sheremet-va in #8461 (cc98c)workerIdfrom a global object - by @sheremet-va in #8507 (46b13)meta.resolveflag instead of a custom loader - by @sheremet-va in #8567 (2e063)View changes on GitHub
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.