PR Custody

security: upgrade vitest to ^4.1.0 to patch GHSA-5xrq-8626-4rwp (critical RCE)

@Dotify71checks n/achecks…security/upgrade-vitest-ghsa-5xrq-8626-4rwp → next9 files · +553 −1107review: @jkomynoupdated 1w ago

GitHub

▸Description· 1 comment · 2 noise

What this PR does

Upgrades vitest across the entire monorepo from ^3.2.4 to ^4.1.0 to patch a critical severity remote code execution (RCE) vulnerability.

Vulnerability


Advisory	GHSA-5xrq-8626-4rwp
Severity	Critical
Vulnerable range	`vitest <4.1.0`
Patched version	`>=4.1.0`

When the vitest UI server is listening, an unauthenticated attacker on the same network can read and execute arbitrary files on the host machine. This affects developer machines and CI runners that run vitest with the --ui flag.

I found this by running pnpm audit on the current next branch:

87 vulnerabilities found
Severity: 10 low | 42 moderate | 33 high | 2 critical

Changes

pnpm-workspace.yaml

Bump catalog entry: vitest: ^3.2.4 → vitest: ^4.1.0
This single change upgrades vitest across all 20+ packages that consume the catalog

ts/packages/providers/mastra/package.json

The mastra provider had a hardcoded ^3.1.4 that bypassed the catalog entirely
Switched it to "vitest": "catalog:" so it inherits the patched version and stays in sync going forward

Testing

No test logic was changed — only the version constraint. The vitest 4.x API is backward-compatible with 3.x for the features used in this repo.

Closes #3502

@Dotify711w ago

I have addressed all the feedback raised by the Cursor Bugbot and stabilized the test environment across the monorepo:

Vitest UI: Migrated @vitest/ui to the workspace catalog and bumped it to ^4.1.0 to ensure the UI server RCE vulnerability is fully patched. Cloudflare Tests: Upgraded @cloudflare/vitest-pool-workers to ^0.16.12, migrated the config files to the new cloudflareTest syntax, and bumped the repo's .nvmrc to 22.12.0 to meet the runtime requirement. Effect Tests: Upgraded @effect/vitest to ^0.29.0 and bumped the effect peer dependency to ^3.21.0 in the workspace catalog. The lockfile is fully synchronized, and Cursor Bugbot is now reporting zero issues. Ready for another look!

▸ 2 bot/status comments hidden

@vercel[bot]1w ago

@Dotify71 is attempting to deploy a commit to the Composio Team on Vercel.

A member of the Team first needs to authorize it.

@socket-security[bot]1w ago

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

View full report

loading diff…