Skip to content

Bump vite, @cloudflare/vitest-pool-workers and vitest - #199

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-4d1b6e7215
Closed

Bump vite, @cloudflare/vitest-pool-workers and vitest#199
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-4d1b6e7215

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 5, 2026

Copy link
Copy Markdown

Removes vite. It's no longer used after updating ancestor dependencies vite, @cloudflare/vitest-pool-workers and vitest. These dependencies need to be updated together.

Removes vite

Updates @cloudflare/vitest-pool-workers from 0.8.71 to 0.20.2

Release notes

Sourced from @​cloudflare/vitest-pool-workers's releases.

@​cloudflare/vitest-pool-workers@​0.20.2

Patch Changes

@​cloudflare/vitest-pool-workers@​0.20.1

Patch Changes

@​cloudflare/vitest-pool-workers@​0.20.0

Minor Changes

  • #14586 5a56dda Thanks @​emily-shen! - Breaking change: Remove several options from the miniflare override options

    The following options have been removed from the miniflare override options, as they were not intended to be exposed, were not functional, or have been superseded by other options:

    • wrappedBindings
    • cacheWarnUsage
    • fetchMock: you should use outboundService instead
    • containerEngine: containers were not supported in vitest-pool-workers. Consider using createTestHarness() instead if you want to test against actual containers.

    Additionally, cache has been deprecated and renamed to cacheAPI, but cache remains functional.

Patch Changes

@​cloudflare/vitest-pool-workers@​0.19.1

Patch Changes

@​cloudflare/vitest-pool-workers@​0.19.0

Minor Changes

... (truncated)

Changelog

Sourced from @​cloudflare/vitest-pool-workers's changelog.

0.20.2

Patch Changes

0.20.1

Patch Changes

0.20.0

Minor Changes

  • #14586 5a56dda Thanks @​emily-shen! - Breaking change: Remove several options from the miniflare override options

    The following options have been removed from the miniflare override options, as they were not intended to be exposed, were not functional, or have been superseded by other options:

    • wrappedBindings
    • cacheWarnUsage
    • fetchMock: you should use outboundService instead
    • containerEngine: containers were not supported in vitest-pool-workers. Consider using createTestHarness() instead if you want to test against actual containers.

    Additionally, cache has been deprecated and renamed to cacheAPI, but cache remains functional.

Patch Changes

0.19.1

Patch Changes

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​cloudflare/vitest-pool-workers since your current version.


Updates vitest from 3.2.4 to 4.1.10

Release notes

Sourced from vitest's releases.

v4.1.10

   🐞 Bug Fixes

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

    View changes on GitHub

v4.1.6

   🐞 Bug Fixes

   🏎 Performance

    View changes on GitHub

... (truncated)

Commits
  • db616d2 chore: release v4.1.10 (#10718)
  • bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
  • a7a61e7 chore: release v4.1.9 (#10598)
  • 934b0f5 fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...
  • 7fb2965 fix(browser): wait for orchestrator readiness before resolving browser sessio...
  • a518019 fix: fix importOriginal with optimizer and query import [backport to v4] (#...
  • e61f2dd chore: release v4.1.8
  • e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
  • a09d472 chore: release v4.1.7
  • a8fd24c chore: release v4.1.6
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vitest since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump vite, @cloudflare/vitest-pool-workers and vitest
5b8ba97 
Removes [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). It's no longer used after updating ancestor dependencies [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite), [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). These dependencies need to be updated together.


Removes `vite`

Updates `@cloudflare/vitest-pool-workers` from 0.8.71 to 0.20.2
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-pool-workers/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.20.2/packages/vitest-pool-workers)

Updates `vitest` from 3.2.4 to 4.1.10
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest)

---
updated-dependencies:
- dependency-name: vite
  dependency-version:
  dependency-type: indirect
- dependency-name: "@cloudflare/vitest-pool-workers"
  dependency-version: 0.20.2
  dependency-type: direct:development
- dependency-name: vitest
  dependency-version: 4.1.10
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file npm labels Aug 5, 2026
@dependabot dependabot Bot mentioned this pull request Aug 5, 2026
Closed
@socket-security

socket-security Bot commented Aug 5, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedvitest@​3.2.4 ⏵ 4.1.1098 +1100 +7579 +198100
Updated@​cloudflare/​vitest-pool-workers@​0.8.71 ⏵ 0.20.299 +110080 +396 -4100

View full report

@socket-security

socket-security Bot commented Aug 5, 2026

Copy link
Copy Markdown

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Block High
High CVE: npm undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

CVE: GHSA-4cwx-7wf7-3272 undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives (HIGH)

Affected versions: >= 7.0.0 < 7.29.0; >= 8.0.0 < 8.9.0

Patched version: 7.29.0

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2 → npm/undici@7.28.0

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/undici@7.28.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: npm @cloudflare/vitest-pool-workers in module node:child_process

Module: node:child_process

Location: Package overview

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@cloudflare/vitest-pool-workers@0.20.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @img/sharp-darwin-arm64 has 1 lines of code

Location: Package overview

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2 → npm/@img/sharp-darwin-arm64@0.35.2

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-darwin-arm64@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @img/sharp-darwin-x64 has 1 lines of code

Location: Package overview

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2 → npm/@img/sharp-darwin-x64@0.35.2

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-darwin-x64@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @img/sharp-linux-arm has 1 lines of code

Location: Package overview

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2 → npm/@img/sharp-linux-arm@0.35.2

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linux-arm@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @img/sharp-linux-arm64 has 1 lines of code

Location: Package overview

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2 → npm/@img/sharp-linux-arm64@0.35.2

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linux-arm64@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @img/sharp-linux-ppc64 has 1 lines of code

Location: Package overview

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2 → npm/@img/sharp-linux-ppc64@0.35.2

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linux-ppc64@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @img/sharp-linux-riscv64 has 1 lines of code

Location: Package overview

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2 → npm/@img/sharp-linux-riscv64@0.35.2

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linux-riscv64@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @img/sharp-linux-s390x has 1 lines of code

Location: Package overview

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2 → npm/@img/sharp-linux-s390x@0.35.2

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linux-s390x@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @img/sharp-linux-x64 has 1 lines of code

Location: Package overview

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2 → npm/@img/sharp-linux-x64@0.35.2

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linux-x64@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @img/sharp-linuxmusl-arm64 has 1 lines of code

Location: Package overview

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2 → npm/@img/sharp-linuxmusl-arm64@0.35.2

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linuxmusl-arm64@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Trivial package: npm @img/sharp-linuxmusl-x64 has 1 lines of code

Location: Package overview

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2 → npm/@img/sharp-linuxmusl-x64@0.35.2

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linuxmusl-x64@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @img/sharp-wasm32 in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2 → npm/@img/sharp-wasm32@0.35.2

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-wasm32@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Dynamic code execution: npm @img/sharp-wasm32

Eval Type: Function

Location: Package overview

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2 → npm/@img/sharp-wasm32@0.35.2

ℹ Read more on: This package | This alert | What is dynamic code execution?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-wasm32@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Potential security risk (AI signal): npm es-module-lexer is 66.0% likely risky

Notes: This wrapper is a WASM-backed parser, but it conditionally executes eval() on substrings extracted from attacker-controlled input when those substrings look like quoted literals. This creates a direct code-execution risk within the calling process (or at minimum enables attacker-controlled evaluation semantics). Additionally, it can include input excerpts in thrown errors. No explicit network/filesystem sabotage is visible in the JS wrapper; the embedded WASM behavior is largely opaque.

Confidence: 0.66

Severity: 0.70

From: package-lock.json → npm/vitest@4.1.10 → npm/ts-loader@9.5.4 → npm/es-module-lexer@2.3.1

ℹ Read more on: This package | This alert | What are AI-detected potential security risks?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/es-module-lexer@2.3.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm @cloudflare/vitest-pool-workers is 66.0% likely to have a medium risk anomaly

Notes: Overall, this module is internal-style Vitest worker infrastructure that processes untrusted request headers and WebSocket payloads and reconstructs complex objects from that input. Its dominant risk signal is deliberate dynamic code execution: it enables an unsafe eval mode and globally patches Function to route to unsafeEval.newFunction. While there is no clear evidence of classic malware/exfiltration in the snippet, the presence of an unsafe eval/Function execution surface combined with network-fed deserialization warrants a high-suspicion review and strict assurance that inputs and unsafeEval configuration cannot be attacker-controlled.

Confidence: 0.66

Severity: 0.65

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@cloudflare/vitest-pool-workers@0.20.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm @cloudflare/vitest-pool-workers is 66.0% likely to have a medium risk anomaly

Notes: This module is primarily a cross-platform process-launch helper and shows no direct evidence of stealthy malware behavior (no exfiltration, persistence, or credential theft). However, it has a security-relevant capability: on Windows/WSL it executes PowerShell with -ExecutionPolicy Bypass -EncodedCommand using a dynamically constructed script that incorporates caller-provided target/app/arguments. If upstream callers pass attacker-controlled input without strict validation/allowlisting, the encoded PowerShell execution path can become an injection risk. Treat as moderate risk for untrusted-input scenarios and ensure consumers sanitize/allowlist target/app values.

Confidence: 0.66

Severity: 0.53

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@cloudflare/vitest-pool-workers@0.20.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm @vitest/snapshot is 74.0% likely to have a medium risk anomaly

Notes: Not obviously malware, but this snapshot module contains a high-impact dynamic code execution primitive: it evaluates snapshot file contents using new Function('exports', snapshotContents). If snapshot contents can be influenced by an attacker, it becomes a direct arbitrary code execution vector during test execution. It also writes/deletes snapshot and test files via the provided snapshot environment; otherwise it performs typical snapshot comparison/serialization logic with no network exfiltration indicators.

Confidence: 0.74

Severity: 0.63

From: package-lock.json → npm/vitest@4.1.10 → npm/@cloudflare/vitest-pool-workers@0.20.2 → npm/@vitest/snapshot@4.1.10

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@vitest/snapshot@4.1.10. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm es-module-lexer is 72.0% likely to have a medium risk anomaly

Notes: An embedded WebAssembly-based parser extracts substrings from untrusted input and passes them to (0, eval) at runtime, creating a code-execution risk where attacker-controlled input can lead to arbitrary JavaScript execution and potential leakage through error messages. The threat remains even though parsing occurs inside the WASM module; the root cause is unsafe dynamic evaluation of attacker-influenced substrings. Avoid running parse() on untrusted data or sandbox/avoid eval-enabled builds.

Confidence: 0.72

Severity: 0.88

From: package-lock.json → npm/vitest@4.1.10 → npm/ts-loader@9.5.4 → npm/es-module-lexer@2.3.1

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/es-module-lexer@2.3.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm esbuild is 90.0% likely to have a medium risk anomaly

Notes: The esbuild package uses a postinstall install.js script to download platform-specific binaries from registry sources and verify them via hashes. While hash verification reduces risk, the elevated postinstall action creates a potential code-execution surface if the script is tampered with. Audit install.js and its endpoints, ensure artifacts are strictly verified against known hashes, and test in controlled environments before deployment.

Confidence: 0.90

Severity: 0.60

From: package-lock.json → npm/vitest@4.1.10 → npm/@cloudflare/vitest-pool-workers@0.20.2 → npm/esbuild@0.28.1

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/esbuild@0.28.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm rolldown is 66.0% likely to have a medium risk anomaly

Notes: This code is a native-binding loader. It does not show explicit indicators of overt malware in the JS wrapper, but it introduces meaningful security risk due to (1) a runtime 'pnpm i' install-and-load behavior in the WebContainer fallback, and (2) loading native/module code from an environment-controlled path (NAPI_RS_NATIVE_LIBRARY_PATH). These patterns increase supply-chain and environment-influence attack surfaces; the actual maliciousness would depend on the external native/WASI binding code that gets loaded or installed.

Confidence: 0.66

Severity: 0.68

From: package-lock.json → npm/vitest@4.1.10 → npm/rolldown@1.2.3

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rolldown@1.2.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm rolldown is 72.0% likely to have a medium risk anomaly

Notes: This module is a legitimate-looking HMR client but contains a high-impact execution mechanism: it dynamically imports modules from server-provided data.path and injects/executess module scripts from server-provided data.url, both driven by untrusted WebSocket JSON messages. If the WebSocket server/transport is compromised (notably if ws:// is used without TLS), an attacker could potentially trigger remote code execution in the client. No overt stealth/persistence/credential theft behavior is present in the snippet, but the trust boundary and dynamic code loading make the security risk significant for any non-fully-trusted development setup.

Confidence: 0.72

Severity: 0.66

From: package-lock.json → npm/vitest@4.1.10 → npm/rolldown@1.2.3

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rolldown@1.2.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm undici is 68.0% likely to have a medium risk anomaly

Notes: The code performs an in-place re-encoding of a local file (undici-fetch.js) and overwrites it with latin1-encoded data. There is no evidence of exfiltration, backdoors, or network activity. However, the lack of validation, error handling, and the fact that it can corrupt or permanently alter a source file constitutes a nontrivial risk. In a supply-chain or extension context, such a script could be misused to tamper with code. It is not inherently malicious by itself but is risky and should be restricted or audited before typical usage in a build or runtime environment.

Confidence: 0.68

Severity: 0.60

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2 → npm/undici@7.28.0

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/undici@7.28.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm wrangler is 62.0% likely to have a medium risk anomaly

Notes: No definitive malware behavior (no clear exfiltration/backdoor/keylogging) is evident in the provided fragment. However, the code contains high-impact execution patterns: (1) downloading and executing a remote binary (cloudflared) with disk writes, tar extraction, chmod, and spawn; (2) executing Windows PowerShell using -ExecutionPolicy Bypass and -EncodedCommand; and (3) spawning system commands for opening URLs. These are legitimate for tooling, but they substantially increase security risk if any portion of the command or download parameters can be attacker-controlled. This module should be treated as sensitive and verified via provenance/signature and dependency auditing.

Confidence: 0.62

Severity: 0.66

From: package-lock.json → npm/@cloudflare/vitest-pool-workers@0.20.2 → npm/wrangler@4.119.0

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/wrangler@4.119.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

See 3 more rows in the dashboard

View full report

@dependabot @github

dependabot Bot commented on behalf of github Aug 11, 2026

Copy link
Copy Markdown
Author

Superseded by #205.

@dependabot dependabot Bot closed this Aug 11, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/multi-4d1b6e7215 branch August 11, 2026 23:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@mackenly mackenly

Labels

dependencies Pull requests that update a dependency file npm

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mackenly