fix(deps): bump vitest to ^3.2.6 (CVE-2026-47429)

package.json

@@ -46,7 +46,7 @@
     "typedoc": "^0.27.5",
     "typescript": "^5.3.3",
     "vite": "6.3.5",
-    "vitest": "^2.1.9"
+    "vitest": "^3.2.6"
   },
   "lint-staged": {
     "*.{js,jsx,ts,tsx,json,css,scss,md,json}": [

packages/astro-plugin/package.json

@@ -58,7 +58,7 @@
   "devDependencies": {
     "@rollup/plugin-replace": "^5.0.5",
     "@types/node": "^20.11.15",
-    "@vitest/coverage-v8": "^2.1.9",
+    "@vitest/coverage-v8": "^3.2.6",
     "astro": "^5.0.9",
     "codecovProdRollupPlugin": "npm:@codecov/rollup-plugin@1.5.0",
     "msw": "^2.7.0",
@@ -67,7 +67,7 @@
     "typescript": "^5.3.3",
     "unbuild": "^2.0.0",
     "vite": "6.3.5",
-    "vitest": "^2.1.9"
+    "vitest": "^3.2.6"
   },
   "peerDependencies": {
     "astro": "4.x || 5.x"

packages/bundle-analyzer/package.json

@@ -49,7 +49,7 @@
     "format:check": "prettier '**/*.{cjs,mjs,ts,tsx,md,json}' --ignore-path ../.gitignore --ignore-unknown --no-error-on-unmatched-pattern --check",
     "test:unit": "vitest run",
     "test:unit:watch": "vitest watch",
-    "test:unit:ci": "vitest --coverage --reporter=junit --outputFile=./bundle-analyzer.junit.xml run",
+    "test:unit:ci": "vitest --coverage --reporter=default --reporter=junit --outputFile=./bundle-analyzer.junit.xml run",
     "test:unit:update": "vitest -u run",
     "generate:typedoc": "typedoc --options ./typedoc.json"
   },
@@ -63,14 +63,14 @@
     "@types/micromatch": "^4.0.9",
     "@types/node": "^20.11.15",
     "@types/yargs": "^17.0.33",
-    "@vitest/coverage-v8": "^2.1.9",
+    "@vitest/coverage-v8": "^3.2.6",
     "codecovProdRollupPlugin": "npm:@codecov/rollup-plugin@1.5.0",
     "msw": "^2.7.0",
     "ts-node": "^10.9.2",
     "typedoc": "^0.27.5",
     "unbuild": "^2.0.0",
     "vite": "6.3.5",
-    "vitest": "^2.1.9"
+    "vitest": "^3.2.6"
   },
   "volta": {
     "extends": "../../package.json"

packages/bundle-analyzer/src/cli.test.ts

@@ -7,22 +7,29 @@ import {
   afterEach,
   beforeEach,
 } from "vitest";
-import { execSync, execFileSync } from "node:child_process";
+import { exec, execFile } from "node:child_process";
+import { promisify } from "node:util";
 import path from "node:path";
 import * as url from "node:url";
 import fs from "node:fs";
 
-export const runCLI = (args: string[]): string | undefined => {
+const execAsync = promisify(exec);
+const execFileAsync = promisify(execFile);
+
+// Spawn the CLI asynchronously: a synchronous spawn blocks the vitest worker
+// thread, which under vitest 3.2 trips the "onTaskUpdate" RPC timeout on slower
+// machines (e.g. CI) even though the test itself passes.
+export const runCLI = async (args: string[]): Promise<string | undefined> => {
   const cliPath = path.resolve(
     path.dirname(url.fileURLToPath(import.meta.url)),
     "../src/cli.ts",
   );
 
   try {
-    const cmd = "npx";
-    const allArgs = ["tsx", cliPath, ...args];
-
-    return execFileSync(cmd, allArgs, { encoding: "utf-8" });
+    const { stdout } = await execFileAsync("npx", ["tsx", cliPath, ...args], {
+      encoding: "utf-8",
+    });
+    return stdout;
   } catch (error) {
     if (error instanceof Error) {
       return JSON.stringify(error);
@@ -32,9 +39,9 @@ export const runCLI = (args: string[]): string | undefined => {
 };
 
 describe("CLI script", () => {
-  beforeAll(() => {
+  beforeAll(async () => {
     // Ensure the build completes before tests
-    execSync("pnpm run build", { stdio: "inherit" });
+    await execAsync("pnpm run build");
 
     // Verify that the build directory exists
     const thisBuildPath = path.resolve(
@@ -53,18 +60,18 @@ describe("CLI script", () => {
     vi.clearAllMocks();
   });
 
-  it("should exit with an error if build directory paths are missing", () => {
-    const output = runCLI([]);
+  it("should exit with an error if build directory paths are missing", async () => {
+    const output = await runCLI([]);
     expect(output).toContain(
       "Not enough non-option arguments: got 0, need at least 1",
     );
   });
 
-  it("should exit with success if upload token is in an env var", () => {
+  it("should exit with success if upload token is in an env var", async () => {
     const originalToken = process.env.CODECOV_UPLOAD_TOKEN;
     process.env.CODECOV_UPLOAD_TOKEN = "token123";
 
-    const output = runCLI([
+    const output = await runCLI([
       "./src",
       "../bundle-analyzer",
       "--bundle-name=someName",
@@ -80,8 +87,8 @@ describe("CLI script", () => {
     );
   });
 
-  it("should exit with success when valid inputs are provided", () => {
-    const output = runCLI([
+  it("should exit with success when valid inputs are provided", async () => {
+    const output = await runCLI([
       "./src",
       "../bundle-analyzer",
       "--bundle-name=someName",
@@ -96,8 +103,8 @@ describe("CLI script", () => {
     );
   });
 
-  it("should log an error message if the directory doesn't exist", () => {
-    const output = runCLI([
+  it("should log an error message if the directory doesn't exist", async () => {
+    const output = await runCLI([
       "./doesnt-exist",
       "--bundle-name=someName",
       "--upload-token=token123",
@@ -106,8 +113,8 @@ describe("CLI script", () => {
     expect(output).toContain("An error occurred:");
   });
 
-  it("should handle multiple ignore patterns correctly", () => {
-    const output = runCLI([
+  it("should handle multiple ignore patterns correctly", async () => {
+    const output = await runCLI([
       "./src",
       "../bundle-analyzer",
       "--bundle-name=someName",
@@ -125,8 +132,8 @@ describe("CLI script", () => {
     expect(output).not.toContain(".test.js");
   });
 
-  it("should log an error for invalid CLI arguments", () => {
-    const output = runCLI([
+  it("should log an error for invalid CLI arguments", async () => {
+    const output = await runCLI([
       "./src",
       "../bundle-analyzer",
       "--bundle-name=someName",
@@ -223,10 +230,20 @@ describe("test CLI functions directly", () => {
     fs.unlinkSync(configFilePath); // Clean up after test
 
     expect(consoleSpy).toHaveBeenCalled();
-    // the CLI argument should override anything supplied in the config file
-    expect(consoleSpy.mock.calls[0]?.[0]).toContain(
-      `bundleName":"this-is-the-name"`,
-    );
+    // the CLI argument should override anything supplied in the config file.
+    // Importing ./cli triggers a stray top-level runCli invocation, so match
+    // the report this test produced rather than assuming a call index.
+    const loggedReports = consoleSpy.mock.calls.map((call) => String(call[0]));
+    expect(
+      loggedReports.some((report) =>
+        report.includes(`bundleName":"this-is-the-name"`),
+      ),
+    ).toBe(true);
+    expect(
+      loggedReports.some((report) =>
+        report.includes(`bundleName":"this-name-should-be-ignored"`),
+      ),
+    ).toBe(false);
   });
 
   it("should load options from a configuration file with error if file does not exist", async () => {

packages/bundle-analyzer/vitest.config.ts

@@ -12,6 +12,14 @@ const packageJson = await import("./package.json", {
 
 export default defineConfig({
   ...config,
+  test: {
+    ...config.test,
+    // CLI tests spawn `npx tsx` subprocesses (the first invocation downloads
+    // tsx); vitest 3.2 enforces timeouts on synchronous test bodies, so the
+    // default 5s is not enough for these process spawns and the build hook.
+    testTimeout: 60_000,
+    hookTimeout: 60_000,
+  },
   files: ["./setup.ts"],
   transformMode: {
     web: [/\.tsx?$/],

packages/bundler-plugin-core/package.json

@@ -51,7 +51,7 @@
     "@sentry/core": "^8.42.0",
     "@types/node": "^20.11.15",
     "@types/semver": "^7.5.6",
-    "@vitest/coverage-v8": "^2.1.9",
+    "@vitest/coverage-v8": "^3.2.6",
     "codecovProdRollupPlugin": "npm:@codecov/rollup-plugin@1.5.0",
     "msw": "^2.7.0",
     "testdouble": "^3.20.1",
@@ -60,7 +60,7 @@
     "typedoc": "^0.27.5",
     "typescript": "^5.3.3",
     "unbuild": "^2.0.0",
-    "vitest": "^2.1.9"
+    "vitest": "^3.2.6"
   },
   "volta": {
     "extends": "../../package.json"

packages/bundler-plugin-core/src/utils/__tests__/Output.test.ts

@@ -15,6 +15,7 @@ import chalk from "chalk";
 
 import { detectProvider } from "../provider";
 import { Output } from "../Output";
+import { FailedFetchError } from "../../errors/FailedFetchError";
 
 vi.mock("../provider");
 
@@ -654,7 +655,11 @@ describe("Output", () => {
         expect(sentryScope.addBreadcrumb).toHaveBeenCalledWith({
           category: "output.write.getPreSignedURL",
           level: "error",
-          data: { error: Error("Failed to fetch pre-signed URL") },
+          data: {
+            error: new FailedFetchError("Failed to fetch pre-signed URL", {
+              cause: new Error("Failed to fetch pre-signed URL"),
+            }),
+          },
         });
       });
     });
@@ -848,7 +853,7 @@ describe("Output", () => {
         expect(sentryScope.addBreadcrumb).toHaveBeenCalledWith({
           category: "output.write.uploadStats",
           level: "error",
-          data: { error: Error("Failed to upload stats") },
+          data: { error: new FailedFetchError("Failed to upload stats") },
         });
       });
     });

packages/nextjs-webpack-plugin/package.json

@@ -54,15 +54,15 @@
     "@rollup/plugin-replace": "^5.0.5",
     "@types/node": "^20.10.0",
     "@types/webpack": "^5.28.5",
-    "@vitest/coverage-v8": "^2.1.9",
+    "@vitest/coverage-v8": "^3.2.6",
     "codecovProdRollupPlugin": "npm:@codecov/rollup-plugin@1.5.0",
     "msw": "^2.7.0",
     "next": "^14.2.25",
     "ts-node": "^10.9.2",
     "typedoc": "^0.27.5",
     "typescript": "^5.3.3",
     "unbuild": "^2.0.0",
-    "vitest": "^2.1.9",
+    "vitest": "^3.2.6",
     "webpack": "^5.96.1"
   },
   "peerDependencies": {

packages/nuxt-plugin/package.json

@@ -53,7 +53,7 @@
   "devDependencies": {
     "@rollup/plugin-replace": "^5.0.5",
     "@types/node": "^20.11.15",
-    "@vitest/coverage-v8": "^2.1.9",
+    "@vitest/coverage-v8": "^3.2.6",
     "codecovProdRollupPlugin": "npm:@codecov/rollup-plugin@1.5.0",
     "msw": "^2.7.0",
     "ts-node": "^10.9.2",
@@ -62,7 +62,7 @@
     "nuxt": "^3.16.0",
     "unbuild": "^2.0.0",
     "vite": "6.3.5",
-    "vitest": "^2.1.9"
+    "vitest": "^3.2.6"
   },
   "peerDependencies": {
     "nuxt": "3.x"

packages/remix-vite-plugin/package.json

@@ -52,15 +52,15 @@
   "devDependencies": {
     "@rollup/plugin-replace": "^5.0.5",
     "@types/node": "^20.11.15",
-    "@vitest/coverage-v8": "^2.1.9",
+    "@vitest/coverage-v8": "^3.2.6",
     "codecovProdRollupPlugin": "npm:@codecov/rollup-plugin@1.5.0",
     "msw": "^2.7.0",
     "ts-node": "^10.9.2",
     "typedoc": "^0.27.5",
     "typescript": "^5.3.3",
     "unbuild": "^2.0.0",
     "vite": "6.3.5",
-    "vitest": "^2.1.9"
+    "vitest": "^3.2.6"
   },
   "peerDependencies": {
     "remix": "2.x"

packages/rollup-plugin/package.json

@@ -51,15 +51,15 @@
   "devDependencies": {
     "@rollup/plugin-replace": "^5.0.5",
     "@types/node": "^20.11.15",
-    "@vitest/coverage-v8": "^2.1.9",
+    "@vitest/coverage-v8": "^3.2.6",
     "codecovProdRollupPlugin": "npm:@codecov/rollup-plugin@1.5.0",
     "msw": "^2.7.0",
     "rollup": "4.22.4",
     "ts-node": "^10.9.2",
     "typedoc": "^0.27.5",
     "typescript": "^5.3.3",
     "unbuild": "^2.0.0",
-    "vitest": "^2.1.9"
+    "vitest": "^3.2.6"
   },
   "peerDependencies": {
     "rollup": "3.x || 4.x"

packages/rollup-plugin/vitest.config.ts

@@ -7,6 +7,7 @@ const packageJson = await import("./package.json");
 export default defineConfig({
   ...config,
   plugins: [
+    //@ts-expect-error handle conflicting version types
     {
       ...replace({
         preventAssignment: true,

packages/solidstart-plugin/package.json

@@ -52,15 +52,15 @@
   "devDependencies": {
     "@rollup/plugin-replace": "^5.0.5",
     "@types/node": "^20.11.15",
-    "@vitest/coverage-v8": "^2.1.9",
+    "@vitest/coverage-v8": "^3.2.6",
     "codecovProdRollupPlugin": "npm:@codecov/rollup-plugin@1.5.0",
     "msw": "^2.7.0",
     "ts-node": "^10.9.2",
     "typedoc": "^0.27.5",
     "typescript": "^5.3.3",
     "unbuild": "^2.0.0",
     "vite": "6.3.5",
-    "vitest": "^2.1.9"
+    "vitest": "^3.2.6"
   },
   "peerDependencies": {
     "@solidjs/start": "1.x"

packages/sveltekit-plugin/package.json

@@ -52,15 +52,15 @@
   "devDependencies": {
     "@rollup/plugin-replace": "^5.0.5",
     "@types/node": "^20.11.15",
-    "@vitest/coverage-v8": "^2.1.9",
+    "@vitest/coverage-v8": "^3.2.6",
     "codecovProdRollupPlugin": "npm:@codecov/rollup-plugin@1.5.0",
     "msw": "^2.7.0",
     "ts-node": "^10.9.2",
     "typedoc": "^0.27.5",
     "typescript": "^5.3.3",
     "unbuild": "^2.0.0",
     "vite": "6.3.5",
-    "vitest": "^2.1.9"
+    "vitest": "^3.2.6"
   },
   "peerDependencies": {
     "@sveltejs/kit": "2.x",

packages/vite-plugin/package.json

@@ -51,15 +51,15 @@
   "devDependencies": {
     "@rollup/plugin-replace": "^5.0.5",
     "@types/node": "^20.11.15",
-    "@vitest/coverage-v8": "^2.1.9",
+    "@vitest/coverage-v8": "^3.2.6",
     "codecovProdRollupPlugin": "npm:@codecov/rollup-plugin@1.5.0",
     "msw": "^2.7.0",
     "ts-node": "^10.9.2",
     "typedoc": "^0.27.5",
     "typescript": "^5.3.3",
     "unbuild": "^2.0.0",
     "vite": "6.3.5",
-    "vitest": "^2.1.9"
+    "vitest": "^3.2.6"
   },
   "peerDependencies": {
     "vite": "4.x || 5.x || 6.x"