fix(deps): upgrade vitest 1.5→4.1 + add vite 6 to patch CVE-2026-47429

Browse Source

CVE-2026-47429: vitest < 4.1.0 — arbitrary file read/execute when the
Vitest UI server is listening. dev-only tool but still flagged as critical
by Dependabot.

  vitest  ^1.5.0 → ^4.1.0  (resolved: 4.1.8)
  vite    (new)  → ^6.0.0  (resolved: 6.4.3, required peer dep for vitest 4.x)

115/115 tests pass with the upgraded versions.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

...

This commit is contained in:

harshgupta-mem0

2026-06-04 20:36:25 +05:30

co-authored by Claude Sonnet 4.6

parent a3154d59e5

commit 638924c544

2 changed files with 343 additions and 478 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

cli/node/pnpm-lock.yaml

Generated

+341 -477

File diff suppressed because it is too large Load Diff