[Snyk] Upgrade vitest from 2.1.9 to 4.0.10 #1328
Open
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Snyk has created this PR to upgrade vitest from 2.1.9 to 4.0.10.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 61 versions ahead of your current version.
The recommended version was released 22 days ago.
Release notes
Package name: vitest
-
4.0.10 - 2025-11-17
- Remove
- browser:
- Don't scale the iframe if UI is disabled - by @ sheremet-va in #9018 (5406e)
- Handle dependency stack traces with external source maps. Resolves: #9003 - by @ iclectic in #9016 and #9003 (57ae5)
- bun:
- Parsing of stack trace for bun runtime - by @ nazarhussain in #9032 (f3ec6)
- core:
- Prevent starting new run when cancelling - by @ AriPerkkio in #8991 (eb98d)
- pool:
- Prevent writing to closed worker - by @ AriPerkkio and @ sheremet-va in #9023 (042c6)
- reporters:
- Report correct test run duration at the end - by @ sheremet-va in #8969 (bc3a6)
- ui:
- Use execution time from ws reporter (
-
4.0.9 - 2025-11-14
- expect: Add Set support to toBeOneOf - by @ tim-we and @ sheremet-va in #8906 (a415d)
- browser: Add favicon icons to the browser mode ui - by @ userquin in #8972 (353ee)
- forks: Increase worker start timeout - by @ AriPerkkio in #9027 (5e750)
- jsdom: Cloned request is an instance of
- ui: Collect file/suite/test duration correctly - by @ userquin in #8976 (8016d)
-
4.0.8 - 2025-11-07
- Workaround
- Missed context.d.ts file - by @ termorey in #8965 (9044d)
- Incorrect error message for non-awaited
- browser: Cleanup frame-ancestors from CSP header at coverage middleware - by @ userquin in #8941 (1f730)
- deps: Update all non-major dependencies - by @ sheremet-va in #8636 (da8b9)
- forks: Do not fail with Windows Defender enabled - by @ sheremet-va in #8967 (c79f4)
- runner: Properly encode Uint8Array body in annotations - by @ Livan-pro in #8951 (997ca)
- spy: Copy static properties if spy is initialised with
- webdriverio: When no argument is passed to the .click interaction command, the webdriver command should also have no argument - by @ julienw in #8937 (069e6)
-
4.0.7 - 2025-11-04
- Bind
- Create environment once per worker with
- Add Locator as a possible element type in
- browser: Inherit
- cli: Parse
- jsdom: Support
- pool: Avoid
- typecheck: Handle re-runs outside
- pool:
- Sort test files by project by default - by @ AriPerkkio in #8914 (680a6)
- reporters:
- Optimize getting the tests stats - by @ Connormiha in #8908 (06d62)
- Remove unnecessary
-
4.0.6 - 2025-10-31
- Don't merge errors with different diffs for reporting - by @ hi-ogawa in #8871 (3e19f)
- Do not throw when importing a type from an external package - by @ sheremet-va in #8875 (7e6c3)
- Improve spying types - by @ sheremet-va in #8878 (ca041)
- Reuse the same environment when
- browser:
- Support module tracking - by @ sheremet-va in #8877 (9e24a)
- Ensure setup files are re-evaluated on each test run - by @ yjaaidi in #8883 and #8884 (f50ea)
- coverage:
- Prevent filtering out virtual files before remapping to sources - by @ AriPerkkio in #8860 (e3b77)
- happy-dom:
- Properly teardown additional keys - by @ sheremet-va in #8888 (10a06)
- jsdom:
- Pass down Node.js
-
4.0.5 - 2025-10-29
- Respect
- Allow module in --config - by @ sheremet-va in #8864 (b9521)
- browser: Allow
- module-runner: Don't return node builtins for
- pool: Rename
- Pass testfiles at once when
- expect: Optimize checking the input type - by @ Connormiha in #8840 (06968)
-
4.0.4 - 2025-10-27
- browser:
- Correct typo - by @ benmccann in #8796 (ede1f)
- Publish a missing context file for webdriverio - by @ sheremet-va in #8824 (7c7b6)
- mocker:
- Support mocking builtins without
- pool:
- Runner's error listener causing
- Capture workers
- spy:
- Allow classes in
- worker:
- Rpc listener leak when
- utils: Optimized reducer to avoid creating new objects - by @ Connormiha in #8818 (d19ce)
-
4.0.3 - 2025-10-24
- Preserve reporter options from config when CLI reporters override them - by @ Copilot and sheremet-va in #8794 (15552)
- browser: More stable in-source testing validation - by @ sheremet-va in #8793 (62297)
- happy-dom: Support fetch globals - by @ sheremet-va in #8791 (0fb74)
- init: Use correct jsx/tsx extension - by @ sheremet-va in #8792 (abc04)
-
4.0.2 - 2025-10-23
- browser:
- Don't print the deprecation notice in node_modules - by @ sheremet-va in #8779 (588f7)
- pool:
- Assign envs before running tests to keep in sync with process.env - by @ sheremet-va in #8769 (26ce8)
- spy:
- Properly inherit implementation's
- Reset spies if both
-
4.0.1 - 2025-10-22
- Move the
- pool: Don't teardown the communication channel too soon if something is running after the test - by @ sheremet-va in #8767 (3fae7)
-
4.0.0 - 2025-10-22
-
4.0.0-beta.19 - 2025-10-21
-
4.0.0-beta.18 - 2025-10-15
-
4.0.0-beta.17 - 2025-10-06
-
4.0.0-beta.16 - 2025-10-03
-
4.0.0-beta.15 - 2025-10-01
-
4.0.0-beta.14 - 2025-10-01
-
4.0.0-beta.13 - 2025-09-24
-
4.0.0-beta.12 - 2025-09-22
-
4.0.0-beta.11 - 2025-09-11
-
4.0.0-beta.10 - 2025-09-01
-
4.0.0-beta.9 - 2025-08-26
-
4.0.0-beta.8 - 2025-08-12
-
4.0.0-beta.7 - 2025-08-08
-
4.0.0-beta.6 - 2025-08-04
-
4.0.0-beta.5 - 2025-07-28
-
4.0.0-beta.4 - 2025-07-22
-
4.0.0-beta.3 - 2025-07-15
-
4.0.0-beta.2 - 2025-06-24
-
4.0.0-beta.1 - 2025-06-20
-
3.2.4 - 2025-06-17
-
3.2.3 - 2025-06-09
-
3.2.2 - 2025-06-05
-
3.2.1 - 2025-06-03
-
3.2.0 - 2025-06-02
-
3.2.0-beta.3 - 2025-05-28
-
3.2.0-beta.2 - 2025-05-19
-
3.2.0-beta.1 - 2025-05-05
-
3.1.4 - 2025-05-19
-
3.1.3 - 2025-05-05
-
3.1.2 - 2025-04-21
-
3.1.1 - 2025-03-31
-
3.1.0 - 2025-03-31
-
3.1.0-beta.2 - 2025-03-21
-
3.1.0-beta.1 - 2025-03-17
-
3.0.9 - 2025-03-17
-
3.0.8 - 2025-03-06
-
3.0.7 - 2025-02-24
-
3.0.6 - 2025-02-18
-
3.0.5 - 2025-02-03
-
3.0.4 - 2025-01-23
-
3.0.3 - 2025-01-21
-
3.0.2 - 2025-01-17
-
3.0.1 - 2025-01-16
-
3.0.0 - 2025-01-16
-
3.0.0-beta.4 - 2025-01-08
-
3.0.0-beta.3 - 2024-12-20
-
3.0.0-beta.2 - 2024-12-10
-
3.0.0-beta.1 - 2024-12-05
-
2.2.0-beta.2 - 2024-11-18
-
2.2.0-beta.1 - 2024-11-13
-
2.1.9 - 2025-02-03
from vitest GitHub release notes🐞 Bug Fixes
onCancelwhen worker is terminated - by @ sheremet-va in #9033 (6d7f0)onFinished) - by @ userquin in #8975 (f56dc)View changes on GitHub
🚀 Experimental Features
🐞 Bug Fixes
Request- by @ sheremet-va in #8985 (506a9)View changes on GitHub
🐞 Bug Fixes
noExternalmerging bug on Vite 6 - by @ hi-ogawa in #8950 (bcb13)expect.element()- by @ StyleShit in #8954 (9638d)vi.fn(), fix types forvi.spyOn(obj, class)- by @ sheremet-va in #8956 (75e7f)View changes on GitHub
🐞 Bug Fixes
processin case global is overwritten - by @ AriPerkkio in #8916 (6240d)isolate: false- by @ sheremet-va in #8915 (c9078)toContainElement()matcher - by @ vitalybaev in #8910 and #8927 (35a27)isolateoption, deprecatebrowser.isolate/browser.fileParallelism- by @ sheremet-va in #8890 (9d2b4)--execArgvas array - by @ AriPerkkio in #8924 (751c3)URL.createObjectURL,FormData.set(prop, blob)- by @ sheremet-va in #8935 (a1b73)--requireargument when running in deno - by @ pi0 in #8897 (d41fa)tsc- by @ AriPerkkio in #8920 (fdb2e)🏎 Performance
Array.fromcall - by @ Connormiha in #8907 (b6014)View changes on GitHub
🐞 Bug Fixes
isolateandfileParallelismare false - by @ sheremet-va in #8889 (31706)FormDatatoRequest- by @ sheremet-va in #8880 (197ca)View changes on GitHub
🐞 Bug Fixes
ssr.noExternalwhen externalizing dependencies, fix Svelte and Astro - by @ sheremet-va in #8862 (a4f86)Locatortype in selectOptions element parameter - by @ rzzf and @ sheremet-va in #8848 (7ee28)getBuiltinsunconditionally - by @ sapphi-red in #8863 (0e858)groupIdtogroupOrderin error message - by @ Yohannfra in #8856 (b9aab)🏎 Performance
--no-isolate --maxWorkers=1- by @ AriPerkkio in #8835 (584aa)View changes on GitHub
🐞 Bug Fixes
node:prefix - by @ sheremet-va in #8829 (06208)MaxListenersExceededWarning- by @ AriPerkkio in #8820 (d1bff)stdioto logger - by @ AriPerkkio in #8809 (fb95f)vi.mockedutility - by @ sheremet-va in #8839 (f8756)isolate: false- by @ AriPerkkio in #8821 (573dc)🏎 Performance
View changes on GitHub
🐞 Bug Fixes
View changes on GitHub
🐞 Bug Fixes
length- by @ sheremet-va in #8778 (d4c2b)restoreMocksandmockResetare set in the config - by @ sheremet-va in #8781 (2eedb)View changes on GitHub
🐞 Bug Fixes
getBuiltinscheck - by @ sheremet-va in #8765 (81000)View changes on GitHub
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information:
[//]: # 'snyk:metadata:{"breakingChangeRiskLevel":null,"FF_showPullRequestBreakingChanges":false,"FF_showPullRequestBreakingChangesWebSearch":false,"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"vitest","from":"2.1.9","to":"4.0.10"}],"env":"prod","hasFixes":false,"isBreakingChange":true,"isMajorUpgrade":true,"issuesToFix":[],"prId"...