Summary
Dependabot PR #957 attempts to bump vite (5.4.19 → 8.2.2), vitest (1.6.1 → 5.0.0), and @vitest/coverage-istanbul (1.4.0 → 5.0.0) together to resolve a high-severity security alert on vite. The PR is currently broken and should not be merged as-is — this issue tracks doing the upgrade correctly.
Why we can't just merge #957
vitest@5.0.0 has a peer dependency on @types/node@"^22.0.0 || >=24.0.0", but this repo pins @types/node@^20 in package.json. This causes npm ci to fail with an ERESOLVE conflict. Confirmed locally and in CI — both the quality and test GitHub Actions jobs fail at the "Install dependencies" step, before lint/typecheck/build/tests even run.
Verified locally with npm ci --legacy-peer-deps as a workaround: once the peer conflict is bypassed, everything else works fine — typecheck passes, next build succeeds, and all 102 vitest tests pass. So the vite/vitest 5 upgrade itself is not functionally broken, it's just missing a companion @types/node bump.
About the underlying alert
The high-severity alert covers CVE-2026-39363 / -39364 / -39365 (arbitrary file read / path traversal via the Vite dev server's WebSocket — GHSA-p9ff-h696-f583). These have no fix within the vite 5.x line — the first patched releases are 6.4.2 / 7.3.2 / 8.0.5+, which is why Dependabot is proposing a multi-major-version jump instead of a patch bump.
Exploitability note: the vulnerability requires the Vite dev server to be exposed to the network (--host / server.host) with server.ws not disabled. In this repo, vite is only pulled in transitively via vitest for running tests — the app's actual dev server is Next.js/webpack (next dev -p 1234 --webpack), and we never run a network-exposed vite dev server. So real-world exploitability here is low, but we should still clear the alert properly rather than leave it open.
What needs to happen
Summary
Dependabot PR #957 attempts to bump
vite(5.4.19 → 8.2.2),vitest(1.6.1 → 5.0.0), and@vitest/coverage-istanbul(1.4.0 → 5.0.0) together to resolve a high-severity security alert onvite. The PR is currently broken and should not be merged as-is — this issue tracks doing the upgrade correctly.Why we can't just merge #957
vitest@5.0.0has a peer dependency on@types/node@"^22.0.0 || >=24.0.0", but this repo pins@types/node@^20inpackage.json. This causesnpm cito fail with an ERESOLVE conflict. Confirmed locally and in CI — both thequalityandtestGitHub Actions jobs fail at the "Install dependencies" step, before lint/typecheck/build/tests even run.Verified locally with
npm ci --legacy-peer-depsas a workaround: once the peer conflict is bypassed, everything else works fine — typecheck passes,next buildsucceeds, and all 102 vitest tests pass. So the vite/vitest 5 upgrade itself is not functionally broken, it's just missing a companion@types/nodebump.About the underlying alert
The high-severity alert covers CVE-2026-39363 / -39364 / -39365 (arbitrary file read / path traversal via the Vite dev server's WebSocket — GHSA-p9ff-h696-f583). These have no fix within the vite 5.x line — the first patched releases are 6.4.2 / 7.3.2 / 8.0.5+, which is why Dependabot is proposing a multi-major-version jump instead of a patch bump.
Exploitability note: the vulnerability requires the Vite dev server to be exposed to the network (
--host/server.host) withserver.wsnot disabled. In this repo,viteis only pulled in transitively viavitestfor running tests — the app's actual dev server is Next.js/webpack (next dev -p 1234 --webpack), and we never run a network-exposed vite dev server. So real-world exploitability here is low, but we should still clear the alert properly rather than leave it open.What needs to happen
@types/nodefrom^20to^22(or>=24) inpackage.jsonviteto 8.2.2 (or latest patched major)vitestto 5.0.0 (or latest)@vitest/coverage-istanbulto 5.0.0 (or latest, must match vitest major)npm ciclean (no--legacy-peer-deps) to confirm the peer dependency conflict is resolvednext buildto confirm no regressions