CVE-2026-47429: vitest < 4.1.0 — arbitrary file read/execute when the
Vitest UI server is listening. dev-only tool but still flagged as critical
by Dependabot.
vitest ^1.5.0 → ^4.1.0 (resolved: 4.1.8)
vite (new) → ^6.0.0 (resolved: 6.4.3, required peer dep for vitest 4.x)
115/115 tests pass with the upgraded versions.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
