[Snyk] Upgrade vitest from 1.3.1 to 1.6.1

[nn6n]

Snyk has created this PR to upgrade vitest from 1.3.1 to 1.6.1.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 7 versions ahead of your current version.

• The recommended version was released 6 months ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Excessive Platform Resource Consumption within a Loop SNYK-JS-BRACES-6838727	222	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-CROSSSPAWN-8303230	222	Proof of Concept
	Inefficient Regular Expression Complexity SNYK-JS-MICROMATCH-6838728	222	No Known Exploit
	Incorrect Authorization SNYK-JS-VITE-9653016	222	Proof of Concept
	Improper Input Validation SNYK-JS-NANOID-8492085	222	No Known Exploit
	Cross-site Scripting (XSS) SNYK-JS-ROLLUP-8073097	222	Proof of Concept
	Improper Access Control SNYK-JS-VITE-6531286	222	Proof of Concept
	Information Exposure SNYK-JS-VITE-8023174	222	Proof of Concept
	Origin Validation Error SNYK-JS-VITE-8648411	222	Proof of Concept
	Incorrect Authorization SNYK-JS-VITE-9512410	222	Mature
	Access Control Bypass SNYK-JS-VITE-9576207	222	Proof of Concept
	Information Exposure SNYK-JS-VITE-9685035	222	Proof of Concept
	Directory Traversal SNYK-JS-VITE-9919777	222	Proof of Concept
	Missing Origin Validation in WebSockets SNYK-JS-VITEST-8688130	222	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-BRACEEXPANSION-9789073	222	Proof of Concept
	Cross-site Scripting (XSS) SNYK-JS-VITE-8022916	222	Proof of Concept

Release notes

Package name: vitest

• 1.6.1 - 2025-02-03
  

  This release includes security patches for:

  • Remote Code Execution when accessing a malicious website while Vitest API server is listening | CVE-2025-24964

     🐞 Bug Fixes

  • backport #7317 to v1 - by @ hi-ogawa in #7319

      View changes on GitHub

• 1.6.0 - 2024-05-03
• 1.5.3 - 2024-04-30
• 1.5.2 - 2024-04-25
• 1.5.1 - 2024-04-24
• 1.5.0 - 2024-04-11
• 1.4.0 - 2024-03-15
• 1.3.1 - 2024-02-20

from vitest GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[gemini-code-assist]

Summary of Changes

Hello @nn6n, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request focuses on a crucial dependency upgrade for the vitest testing framework. The primary goal is to enhance the project's security posture by updating vitest to its latest recommended version, which resolves a significant number of identified vulnerabilities. This ensures the application benefits from the most recent security patches and bug fixes, contributing to a more robust and secure development environment.

Highlights

• Dependency Upgrade: The vitest testing framework has been upgraded from version 1.3.1 to 1.6.1.
• Security Fixes: This upgrade addresses numerous security vulnerabilities, including high-severity issues such as Excessive Platform Resource Consumption, Regular Expression Denial of Service (ReDoS), and Incorrect Authorization.
• Critical Vulnerability Patch: Specifically, version 1.6.1 includes a critical security patch for Remote Code Execution (CVE-2025-24964) when accessing a malicious website while the Vitest API server is listening.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request, generated by Snyk, upgrades the vitest dependency from version 1.3.1 to 1.6.1. This update is important as it addresses multiple high and medium severity security vulnerabilities. The change is confined to wasm/hello-world/package.json and is correct. I recommend merging this PR to enhance the project's security.