[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
vitest (source)	^3.0.0 → ^5.0.0
vitest (source)	^3.2.3 → ^5.0.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Vitest: Path Traversal / Arbitrary File Read via @​vitest/mocker Redirect Mock

CVE-2026-84373 / GHSA-82fw-gwwq-j7x9

More information

Details

Summary

@vitest/mocker registers a redirect mock's target path without validating it
against the dev server's file-serving allowlist. An attacker who can reach the
dev server's WebSocket can register a redirect mock pointing outside the project
root; when the mocked module is requested, the plugin's load hook returns
readFile(<attacker path>) as the module source, disclosing local files.

This is exploitable without authentication only through the public
mockerPlugin / standalone interceptorPlugin exports (used by third-party dev
servers), which register the handler on Vite's unauthenticated HMR socket.
Vitest's own browser mode registers mocks over a token-authenticated RPC and
is not remotely reachable by default (see Scope).

Affected code

packages/mocker/src/node/interceptorPlugin.ts.

The load hook is the file-read sink:

if (mock.type === 'redirect') {
  return readFile(mock.redirect, 'utf-8')
}

mock.redirect is derived from client input at registration time with no
boundary check:

if (event.type === 'redirect') {
  const redirectUrl = new URL(event.redirect)
  event.redirect = join(server.config.root, redirectUrl.pathname)
}
registry.register(event)

There is no server.fs.allow / server.fs.deny check and no assertion that the
resolved path stays within the project root.

Registration paths and trust boundaries

• Public mockerPlugin / interceptorPlugin (unauthenticated). In
  configureServer, the plugin registers server.ws.on('vitest:interceptor:register', …)
  on Vite's HMR WebSocket. That socket performs no token, Origin, or same-origin
  check, so any client that can reach it can register a redirect mock. This is
  the path the "unauthenticated" impact applies to.
• Vitest browser mode (authenticated). Mocks register over the browser RPC
  (registerMock), which sits behind a per-run token (isValidApiRequest, a
  random api.token). The interceptor's configureServer socket is not used for
  registration here (in v5 it does not run at all, as the plugin is injected per
  environment). The same missing boundary check exists on the authenticated RPC
  path, but reaching it requires the token, so it is not a remote-unauthenticated
  read.

Path handling

new URL(redirect).pathname combined with join(root, pathname) does not
confine reads to the root:

• Special/hierarchical schemes (file:, http:) are normalized by WHATWG URL,
  so .. segments are collapsed and the result stays under the root. Payloads of
  the form file:///../../etc/passwd do not escape.
• A non-special (opaque) scheme preserves .. in pathname, so
  join(root, "../../…/etc/passwd") resolves outside the root and reads an
  arbitrary file.

Even without escaping the root, the missing server.fs check allows reading any
in-root file the dev server would otherwise refuse to serve (for example an
in-root .env or source that is denied by server.fs.deny).

Scope / preconditions

• This is a development-server issue. The dev server binds to localhost by
  default and is not reachable from the network unless the developer exposes it
  (server.host / 0.0.0.0, a LAN bind, or a proxy).
• A raw (non-browser) client against a reachable server bypasses browser origin
  and CORS protections entirely and can both register the mock and read the
  response.
• A browser-based drive-by against a localhost server is substantially mitigated
  by Vite defaults: the default CORS origin allowlist is limited to localhost
  origins, and server.allowedHosts blocks DNS-rebinding, so a cross-origin page
  cannot read the file contents back.

Impact

Disclosure of local files readable by the dev-server process (source, in-root
.env/secrets, and, via the opaque-scheme payload, files outside the project
root). No integrity or availability impact.

Affected versions

Present since @vitest/mocker was introduced.

• Affected: @vitest/mocker >= 2.1.0 (shipped in vitest and
  @vitest/browser >= 2.1.0), through 4.1.x and the 5.0.0 pre-releases.
• Fixed: Vitest 4.1.11 and 5.0.0. Older majors (2.1.x, 3.x) are not
  maintained and are not planned to receive the fix.

Fix

Validate the resolved redirect target against Vite's file-serving allowlist
(isFileLoadingAllowed) before registering it, at every registration site, and
stop registering the interceptor WebSocket events in Vitest's browser mode
(mocks there flow through the authenticated RPC).

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9
• https://nvd.nist.gov/vuln/detail/CVE-2026-84373
• https://github.com/vitest-dev/vitest/pull/10972
• https://github.com/vitest-dev/vitest/pull/10974
• https://github.com/vitest-dev/vitest/commit/51edf2b072902aec6d30c90ebaafd8f121c6f9d8
• https://github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33aec4
• https://github.com/vitest-dev/vitest/commit/fe5a11d3ceac5ec10d6d7d21a46d4caca132c48f
• https://github.com/vitest-dev/vitest/releases/tag/v4.1.11
• https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-rc.2
• https://github.com/advisories/GHSA-82fw-gwwq-j7x9

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

vitest-dev/vitest (vitest)

v5.1.0

Compare Source

   🚀 Features

• Add --last-failed to run only failed tests  -  by @​sheremet-va in #​11558 (82f63)
• Support Temporal.Instant and Temporal.ZonedDateTime in vi.setSystemTime()  -  by @​Prajwal2246, Prajwal2246, Claude Opus 5.5 (1M context), @​hi-ogawa and Codex (GPT-6) in #​11321 (f150f)
• Introduce --since-last-run flag  -  by @​sheremet-va in #​11516 (08bd9)
• Expose per-retry/repeat attempt result  -  by @​hi-ogawa, Codex (GPT-6) and Claude Opus 5.5 (1M context) in #​11232 (21be4)
• Support fake timers for node:timers and node:timers/promise  -  by @​hi-ogawa, OpenCode and Codex (GPT-6) in #​10899 (fbe97)
• Allow coverage providers to store data in fs module cache  -  by @​AriPerkkio in #​11747 (54a2b)
• Interactively review failed snapshots  -  by @​macarie and @​hi-ogawa in #​11325 (54e5b)
• browser:
  • Mock modules through an import map  -  by @​sheremet-va in #​11534 (707f8)
  • Drop experimental label from trace view  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11518 (44c3c)
  • Introduce experimental pointer API  -  by @​macarie in #​10780 (5dc09)
  • Capture aria snapshot in trace view  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11492 (0cc39)
  • Show trace steps timeline on terminal on test failure  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11594 (973dc)
  • Add failure-only trace view mode  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11612 (d5d7d)
  • Enable failure-only trace view by default  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11766 (f37b6)
• coverage:
  • V8 to support ignoreNode option  -  by @​erickserra and @​AriPerkkio in #​11688 (e02db)
• experimental:
  • Add trace timeline for node  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11753 (4e985)
  • Add message option to vi.waitFor and vi.waitUntil  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11754 (fd145)

   🐞 Bug Fixes

• Rerun setup files after --changed filtering  -  by @​sheremet-va in #​11621 (3a39c)
• Return the mock to concurrent imports  -  by @​sheremet-va in #​11623 (1453b)
• Don't fail on console log pending at teardown  -  by @​sheremet-va in #​11619 (a60b8)
• Reference chai types in every d.ts chunk  -  by @​sheremet-va in #​11618 (fb150)
• Detect mock factory cycles that form later  -  by @​sheremet-va in #​11642 (e9554)
• Skip fs module cache for typed import.meta.glob  -  by @​sheremet-va in #​11666 (79501)
• Run tests that import a deleted file  -  by @​sheremet-va in #​11669 (80aa1)
• Keep syntax highlighting in code frames  -  by @​sheremet-va in #​11705 (d39f5)
• Respect CLI filters when prewarming browsers  -  by @​sheremet-va and Benjamin Tang in #​11706 (10947)
• Read cached source as utf-8  -  by @​juan-fernandez in #​11682 and #​11709 (867a5)
• Inherit watch from the root config in projects  -  by @​nstepien and Claude Opus 5.5 (1M context) in #​11724 (77c12)
• Prefix expect.poll message to all errors  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11756 (cab58)
• Support api.port 0  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11641 (3667c)
• Show attempts in test error logs of retried tests  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11696 (77a94)
• Preserve rootDir in project paths  -  by @​btea in #​11816 (bf96d)
• browser:
  • Change default port to 23315  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11640 (a2ec4)
  • Advance fake timers in actions and expect.element  -  by @​julienw, @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11242 (68190)
  • Drop trace view warning without html reporter  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11665 (e6407)
  • Detect shared chunks via the optimizer  -  by @​sheremet-va in #​11661 (e2e9c)
  • Clear screenshot stability timeout  -  by @​sheremet-va in #​11659 (fbe37)
  • Measure prepare duration with one clock  -  by @​sheremet-va in #​11667 (a3ed4)
  • Keep failure screenshot per attempt  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11694 (a5022)
  • Print trace timeline of each attempt  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11695 (27229)
  • Don't hang in page.viewport()  -  by @​sheremet-va in #​11738 (49ff4)
  • Skip trace entries after their attempt ended  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11771 (7a56f)
  • Focus the iframe before clicking in playwright  -  by @​sheremet-va in #​11798 (eb20a)
  • Fail the run when a tester cannot connect  -  by @​sheremet-va in #​11802 (605bf)
  • Treat edge as chromium in toHaveStyle  -  by @​aliamanatali in #​11813 (f4dd9)
• cache:
  • Handle concurrent cache clearing  -  by @​7rulnik in #​11697 (09076)
  • Key module cache on the deps optimizer  -  by @​MO2k4 and Martin Oehlert in #​11775 (52485)
  • Do not fail when the cache dir is unwritable  -  by @​ezefernandezyf in #​11781 (274ab)
• cli:
  • Use camelCase for sinceLastRun help  -  by @​fengmk2 in #​11707 (5c674)
• coverage:
  • V8 autoAttachSubprocess to use .tmp directory  -  by @​AriPerkkio in #​11632 (de5af)
  • V8 to ignore Vite's generated CJS namespace import helper  -  by @​AriPerkkio in #​11676 (5901f)
• deps:
  • Update all non-major dependencies  -  by @​sheremet-va in #​11637 (2b18e)
• expect:
  • Keep soft .resolves/.rejects error location  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11792 (42770)
• mocker:
  • Don't change the original prototype chain  -  by @​sheremet-va and Max Schwenk in #​11737 (cca42)
  • Use root mocks for linked packages  -  by @​sheremet-va in #​7708 and #​11739 (810ec)
• runner:
  • Don't drop throttled task updates  -  by @​sheremet-va in #​11795 (8e837)
• ui:
  • Escape search text in explorer highlight  -  by @​sheremet-va in #​11672 (3c6d6)
  • Fix html reporter crash when --bail cancels files  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11693 (36a5f)
  • Fix quirks mode in trace view replay  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11744 (b9b73)
  • Let coverage report follow UI color scheme  -  by @​AriPerkkio in #​11765 (59c2d)
  • Open trace view only for tests with a trace  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11770 (c022d)
• vm:
  • Strip hashbang before compiling CommonJS dependencies  -  by @​cwoebker in #​11731 (1a77c)
  • Keep node globals after teardown  -  by @​francesco-agnoletto in #​11380 and #​11681 (a57b4)
  • Reset fake timers after each test file  -  by @​francesco-agnoletto in #​11679 and #​11779 (78c46)
  • Keep assignable accessor globals writable in node environment  -  by @​MO2k4 and Martin Oehlert in #​11834 (a5ec3)

   🏎 Performance

• Reuse fsModuleCache in static collection  -  by @​sheremet-va in #​11622 (1766c)
• Cache setup/mock resolves in reused workers  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11760 (5de10)
• Don't refetch warm modules in reused runners  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11761 (4f135)
• browser:
  • Map only first frame for trace locations  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11613 (a967d)
  • Disable WebSocketServer's allowSynchronousEvents  -  by @​nstepien in #​11794 (d4572)
• coverage:
  • Istanbul to use magic-string+rolldown for instrumentation  -  by @​AriPerkkio in #​11648 (2470b)
  • Istanbul to collect uncovered files in Promise.all  -  by @​AriPerkkio in #​11713 (f1092)
  • Istanbul to not store input source maps in coverage data  -  by @​AriPerkkio in #​11686 (2debb)
• expect:
  • Compare typed arrays in one loop  -  by @​sheremet-va in #​11658 (908eb)

    View changes on GitHub

v5.0.5

Compare Source

   🐞 Bug Fixes

• Keep vite default fs.deny with api token file  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11578 (28dc1)
• Handle quoted file names in --changed  -  by @​sheremet-va in #​11583 (14921)
• Add data to the import.meta.hot stub  -  by @​sheremet-va in #​11590 (3a828)
• Set skip in skipIf, ignore undefined options  -  by @​sheremet-va in #​11591 (d523a)
• Skip builtin loading in async leak detector  -  by @​sheremet-va in #​11598 (fe86a)
• Keep the import frame in native loader errors  -  by @​sheremet-va in #​11599 (9697b)
• Run hook cleanups when a later hook fails  -  by @​sheremet-va in #​11605 (6c5a4)
• Release mocks of finished test files  -  by @​sheremet-va in #​11607 (e9c3d)
• Abort all running tests on cancel  -  by @​sheremet-va in #​11606 (6621a)
• browser:
  • Ignore synthetic pagehide events  -  by @​sheremet-va in #​11582 (ca081)
  • Run plugin buildStart on server creation  -  by @​sheremet-va in #​11593 (ea611)
  • Drop late connections of closed sessions  -  by @​sheremet-va in #​11600 (f161e)
  • Wait 30s for the browser to close  -  by @​sheremet-va in #​11601 (6498b)
  • Run global setup once with instances  -  by @​sheremet-va in #​11596 (8dd67)
• reporter:
  • End reason &#​39;failed&#​39; on worker crash  -  by @​AriPerkkio in #​11568 (6ae8e)

    View changes on GitHub

v5.0.4

Compare Source

   🚀 Features

• experimental:
  • Tag cache directories with CACHEDIR.TAG  -  by @​lifeiscontent in #​11461 (a8ea3)
  • Support test.ui.theme option  -  by @​sheremet-va in #​11499 (1da66)
  • Highlight selector multiple matches in trace view  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11489 (5abba)
  • Print how many tests were affected and a total when running --changed  -  by @​sheremet-va in #​11424 (a2336)
  • Add an option to cache dependencies instead of statically parsing them  -  by @​sheremet-va in #​11515 (c0601)
  • Add fit and zoom controls to trace viewer  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11490 (f5dd9)

   🐞 Bug Fixes

• Fail the run on git and location filter errors  -  by @​sheremet-va in #​11430 (30d03)
• Enable fsModuleCache by default  -  by @​sheremet-va in #​11435 (ad208)
• Track project files and mocks with --changed  -  by @​sheremet-va in #​11432 (b0f2b)
• Refactor caching, fix : in project and change the shape of results cache  -  by @​sheremet-va in #​11453 (9673c)
• Keep full $ string values when taskTitleValueFormatTruncate is 0  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11485 (4f7e1)
• Resolve node builtins in client environments  -  by @​sheremet-va in #​11417 (56b31)
• Fix module graph builtin externals after #​11421  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11491 and #​11421 (008e1)
• Wrap module mocks during in-source testing  -  by @​sheremet-va in #​11505 (36d19)
• Handle line endings in snapshot  -  by @​sheremet-va in #​11522 (4c468)
• Respect root in projects  -  by @​sheremet-va in #​11521 (26642)
• Resolve mocks in directories with spaces  -  by @​sheremet-va in #​11539 (caaef)
• api:
  • Publish the api token atomically  -  by @​umairnawaz333 in #​11323 (6f990)
• browser:
  • Close the mock route interception race  -  by @​cplieger and @​sheremet-va in #​8339 and #​11083 (d6620)
  • Allow toHaveTextContent without arguments  -  by @​nomadical in #​11425 (8ebcf)
  • Apply API options without browser config  -  by @​sheremet-va in #​10852 (ad055)
  • Preserve undefined command arguments  -  by @​sheremet-va and @​AriPerkkio in #​11497 (1576d)
  • Wait for setup mocks before importing a test file  -  by @​kasperpeulen in #​11520 (b61d1)
  • Avoid extra scroll outside the iframe  -  by @​sheremet-va in #​11523 (662e8)
  • Run browser instances as workers  -  by @​sheremet-va in #​11525 (bf04b)
    • ⚠️ This can degrade performance if you have a custom maxWorkers setting. Previously, it was applied incorrectly and could lead to Vitest using too many resources. For example, a lower number would still open too many browsers. Fixing it means Vitest opens less instances by default now.
  • Open one cdp session per tester  -  by @​sheremet-va in #​11542 (69e63)
  • Clean up unmocked and pending mocks  -  by @​sheremet-va in #​11537 (5c955)
• coverage:
  • V8 browser memory leak between test files  -  by @​AriPerkkio in #​11466 (2297d)
  • allowExternal fails to include uncovered files  -  by @​AriPerkkio in #​11513 (4ef00)
  • Filenames containing brackets incorrectly showing as uncovered  -  by @​AriPerkkio in #​11531 (0fa80)
  • Istanbul coverage wrong when module transform warmups  -  by @​AriPerkkio in #​11529 (9f61d)
• deps:
  • Update all non-major dependencies  -  by @​sheremet-va in #​11167 (c74e0)
• expect:
  • Fix Map and Set deep equality in some assertions  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11402 (b4e79)
  • Check value in chai-style returned  -  by @​sheremet-va in #​11500 (1aca0)
• mocker:
  • Fix native loader mocking edge cases  -  by @​sheremet-va in #​11540 (cd423)
• pretty-format:
  • Support boxed symbols  -  by @​lehni in #​11445 and #​11446 (eba44)
• reporters:
  • Junit to strip ANSI sequences from all XML attributes  -  by @​meganemura and Claude Opus 5.5 in #​11407 (e1a73)
• runner:
  • Don't cache failed fixture setups  -  by @​hamed-bavar in #​11237 and #​11238 (4ee66)
• typecheck:
  • Use typescript pool in toTestSpecification  -  by @​sheremet-va in #​11451 (5f273)
• ui:
  • Remove duplicate browser-open call opening two tabs  -  by @​feastyr69 in #​11356 and #​11358 (d7e13)
  • Simplify explorer filtering + fix nested tests when search matches a suite  -  by @​hi-ogawa, Hiroshi Ogawa, Codex and Claude Opus 5.5 in #​11262 (a627b)
  • Store module graph once per environment  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11421 (af903)
  • Mount index.html handler on the ui base path  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11517

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE could not resolve
npm error
npm error While resolving: vitest@5.1.0
npm error Found: @vitest/ui@3.2.6
npm error node_modules/@vitest/ui
npm error   dev @vitest/ui@"^3.0.0" from @netlify/build-info@11.3.1
npm error   packages/build-info
npm error     @netlify/build-info@11.3.1
npm error     node_modules/@netlify/build-info
npm error       workspace packages/build-info from the root project
npm error   dev @vitest/ui@"^3.0.0" from @netlify/opentelemetry-sdk-setup@4.0.1
npm error   packages/opentelemetry-sdk-setup
npm error     @netlify/opentelemetry-sdk-setup@4.0.1
npm error     node_modules/@netlify/opentelemetry-sdk-setup
npm error       workspace packages/opentelemetry-sdk-setup from the root project
npm error       1 more (@netlify/build)
npm error   1 more (@netlify/opentelemetry-utils)
npm error
npm error Could not resolve dependency:
npm error peerOptional @vitest/ui@"5.1.0" from vitest@5.1.0
npm error packages/build-info/node_modules/vitest
npm error   dev vitest@"^5.0.0" from @netlify/build-info@11.3.1
npm error   packages/build-info
npm error     @netlify/build-info@11.3.1
npm error     node_modules/@netlify/build-info
npm error       workspace packages/build-info from the root project
npm error   peer vitest@"5.1.0" from @vitest/coverage-v8@5.1.0
npm error   packages/build-info/node_modules/@vitest/coverage-v8
npm error     peerOptional @vitest/coverage-v8@"5.1.0" from vitest@5.1.0
npm error
npm error Conflicting peer dependency: @vitest/ui@5.1.0
npm error node_modules/@vitest/ui
npm error   peerOptional @vitest/ui@"5.1.0" from vitest@5.1.0
npm error   packages/build-info/node_modules/vitest
npm error     dev vitest@"^5.0.0" from @netlify/build-info@11.3.1
npm error     packages/build-info
npm error       @netlify/build-info@11.3.1
npm error       node_modules/@netlify/build-info
npm error         workspace packages/build-info from the root project
npm error     peer vitest@"5.1.0" from @vitest/coverage-v8@5.1.0
npm error     packages/build-info/node_modules/@vitest/coverage-v8
npm error       peerOptional @vitest/coverage-v8@"5.1.0" from vitest@5.1.0
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-11-11T21_42_03_338Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-11-11T21_42_03_338Z-debug-0.log

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 494355bd-8d62-41f4-bda5-a839cde04fb0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

[github-actions]

e18e dependency analysis

No dependency warnings found.