chore(deps): update dependency vitest to v5 [security]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
vitest (source)	^2.0.0 → ^5.0.0

---

When Vitest UI server is listening, arbitrary file can be read and executed

CVE-2026-47429 / GHSA-5xrq-8626-4rwp

More information

Details

Summary

Arbitrary file can be read on Windows when Vitest UI server is listening, especially when exposed to the network.

Impact

Only users that match either of the following conditions are affected:

• explicitly exposes the Vitest UI server to the network (using --api.host or api.host config option)
• running the Vitest UI or Browser Mode on Windows

Details

The API handler for /__vitest_attachment__ uses the deprecated isFileServingAllowed incorrectly.
https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/ui/node/index.ts#L77
The function expects the passed value to use cleanUrl after the check before file system related operation.
Because of this, it is possible to bypass the check by \\?\\..\\. This is not possible on Linux as Linux errors if a directory named ? does not exist.

A similar problem exists in other places as well.

• https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/vitest/src/api/setup.ts#L103-L105
• https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/vitest/src/api/setup.ts#L119-L121
• https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/browser/src/node/commands/fs.ts#L10-L11
• https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/browser/src/node/plugin.ts#L194-L196
• https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/browser/src/node/rpc.ts#L115-L121

That said, this isFileServingAllowed check does not actually prevent the API to be abused. Since the API has rerun feature and file write feature, it's possible to run arbitrary script by writing a script as a test file using saveTestFile and running it using rerun. This means exposing the API / Vitest UI is equivalent to giving script execution access.
On the browser mode side, there're readFile / writeFile / saveSnapshotFile. So exposing the browser mode is equivalent to giving file read / write access.

PoC

1. Run Vitest UI
2. Get the API token by curl http://localhost:51204/__vitest__/
3. Run curl "http://localhost:51204/__vitest_attachment__?path=C:\\path\\to\\project\\?\\..\\..\\secret.txt&contentType=text/plain&token=$TOKEN" (TOKEN is the API token)
4. curl shows the content of secret.txt that is outside the project directory

Mitigations

Vitest now ships two configuration flags, allowWrite and allowExec, that gate the privileged operations exploited by this vulnerability. Both are disabled by default whenever the API server is bound to a non-localhost host, ensuring that exposing the server to the network no longer implicitly grants write or execute capabilities to remote clients.

When these flags are disabled, the UI also enters a read-only mode: in-browser code editing and test file execution are turned off, removing the attack surface that allowed remote code execution. Many Browser Mode features are also disabled, like attachments, artifacts or snapshots. See browser.api.

Users who require the full interactive UI on a networked host must explicitly opt in by setting allowWrite and/or allowExec to true.

Severity

• CVSS Score: 9.8 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

• https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp
• https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/browser/src/node/commands/fs.ts#L10-L11
• https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/browser/src/node/plugin.ts#L194-L196
• https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/browser/src/node/rpc.ts#L115-L121
• https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/ui/node/index.ts#L77
• https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/vitest/src/api/setup.ts#L103-L105
• https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/vitest/src/api/setup.ts#L119-L121
• https://nvd.nist.gov/vuln/detail/CVE-2026-47429
• https://github.com/vitest-dev/vitest/pull/10445
• https://github.com/vitest-dev/vitest/pull/9350
• https://github.com/vitest-dev/vitest/commit/20e00ef7808de6d330c5e2fda530f686e08f1c8d
• https://github.com/vitest-dev/vitest/commit/af88b1f5d82844a4761ea9a977156c98e2b14ca8
• https://github.com/vitest-dev/vitest/releases/tag/v3.2.5
• https://github.com/vitest-dev/vitest/releases/tag/v4.1.0
• https://github.com/advisories/GHSA-5xrq-8626-4rwp

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

vitest-dev/vitest (vitest)

v5.0.1

Compare Source

   🚀 Features

• ui:
  • Move trace attempts selector to viewer header  -  by @​hi-ogawa, Hiroshi Ogawa and Codex in #​11189 (5dc4b)
  • Add focused trace view layout mode  -  by @​hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and Codex in #​11190 (376dc)

   🐞 Bug Fixes

• Exit 1 when vitest list fails collection  -  by @​hamed-bavar in #​11145 and #​11146 (6108b)
• Keep parse error details in static collection  -  by @​hamed-bavar in #​11150 and #​11151 (7c818)
• Avoid recursive prototype in automocking  -  by @​sheremet-va in #​11195 (99fc5)
• Prevent false Vitest import resolution  -  by @​sheremet-va in #​11196 (b426c)
• Keep metadata file when clearing the cache  -  by @​sheremet-va in #​11199 (73614)
• Correct typos in error message and comments  -  by @​shinji00222 and Shinji in #​11187 (115c3)
• Resolve ResolvedConfig exactOptionalPropertyTypes errors  -  by @​LukeAbby in #​11175 (498fb)
• Share the server on self-referencing extends  -  by @​sheremet-va in #​11034 (23dda)
• Warn when deprecated deps.optimizer.web is used  -  by @​im10furry in #​11214 (2ce29)
• browser:
  • Avoid double quotes in config.define  -  by @​sheremet-va in #​11198 (972e2)
• doctor:
  • Measure vm pools for custom environments  -  by @​sheremet-va in #​11212 (91ab1)
• expect:
  • Correct return value in toMatchAriaSnapshot  -  by @​sheremet-va in #​11208 (c119b)
• fakeTimers:
  • Force queueMicrotask and nextTick in toNotFake  -  by @​kingmakeruix, kingmakeruix, Hiroshi Ogawa, Codex and @​hi-ogawa in #​11261 (a47d7)
• snapshot:
  • Report obsolete keys next to skipped tests  -  by @​hamed-bavar, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in #​11157 and #​11158 (17e2b)
• types:
  • Make public declarations self-contained  -  by @​ZoeySigel in #​11141 (45546)
• ui:
  • Fix collapse/expand suite with file name search  -  by @​hi-ogawa, Hiroshi Ogawa and Codex in #​11260 (0a712)
  • Fix explorer file summary count  -  by @​hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and Codex in #​11125 (05982)
• utils:
  • Fix deepMerge to handle prototype  -  by @​hi-ogawa, Hiroshi Ogawa and Codex in #​11215 (4944c)

    View changes on GitHub

v5.0.0

Compare Source

   🚨 Breaking Changes

• Replace loupe.inspect with pretty-format  -  by @​hi-ogawa, Claude Opus 5 (1M context) and OpenAI Codex in #​9609 (3f802)
• Remove quotes from string values in test.for/each title $ variable (take 2)  -  by @​hi-ogawa in #​10170 (04d37)
• Default attachmentsDir from .vitest-attachements/ to .vitest/attachments/  -  by @​MdSadiqMd in #​10186 (1ba73)
• Remove sequential test/suite options in favor of concurrent  -  by @​hi-ogawa and OpenAI Codex in #​10198 (9229f)
• Represent locator as an object instead of a string  -  by @​sheremet-va in #​10212 (80f07)
• Inline expect package  -  by @​sheremet-va in #​10221 (ad162)
• Remove deprecated entry points  -  by @​sheremet-va in #​10222 (994c6)
• Require Node.js 22 and Vite 6.4  -  by @​sheremet-va in #​10178 (38762)
• Fail expect.poll when function didn't resolve in time  -  by @​hi-ogawa and OpenAI Codex in #​10233 (4df04)
• Throw an error if hoistable methods are outside the top level scope  -  by @​sheremet-va in #​10460 (d0b4f)
• toHaveTextContent is strict, add toMatchTextContent as alternative  -  by @​sheremet-va in #​10473 (18f30)
• Don't lookup config file from ancestor directories  -  by @​hi-ogawa, OpenAI Codex and Hiroshi Ogawa in #​10428 (945d9)
• Inline @vitest/runner package, do not publish it anymore  -  by @​sheremet-va in #​10511 (6d6e4)
• Allow mutating happy-dom/jsdom window object  -  by @​hi-ogawa, Hiroshi Ogawa and OpenAI Codex in #​10373 (206e8)
• Expose concurrencyId/workerId on TestModule's diagnostics, make id 1-based  -  by @​sheremet-va in #​10516 (bdd98)
• Add screenshotDirectory config to browser.expect.toMatchScreenshot  -  by @​macarie in #​10592 (a60de)
• Update @sinonjs/fake-timers and support mocking Temporal  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in #​10654 (f8b15)
• Remove webdriverio package  -  by @​sheremet-va in #​10675 (5fed6)
• Clear mocks by default before each test  -  by @​sheremet-va in #​10613 (0f646)
• Don't emit localStorage warnings on Node 26, fail gracefully when worker fails to start  -  by @​sheremet-va in #​10293 (334ed)
• Separate config resolution from the server creation  -  by @​sheremet-va in #​10554 (1c0ec)
• Inline projects extend the root config by default  -  by @​sheremet-va in #​10750 (fec00)
• Enable mocking Temporal without fake timers  -  by @​fabon-f, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in #​10757 (ac2d4)
• Support nested projects  -  by @​sheremet-va in #​10846 (ec367)
• Use > as separator in -t, calculate only once  -  by @​sheremet-va in #​10686 (a0b20)
• Fail the test when an asynchronous assertion is not awaited  -  by @​sheremet-va in #​10868 (86d4a)
• Share the Vite server between inline projects  -  by @​sheremet-va in #​10848 (d87c9)
• Parse files statically in vitest list by default  -  by @​sheremet-va in #​11088 (51e94)
• benchmark:
  • Rewrite the public API  -  by @​sheremet-va in #​10113 (19f6e)
• browser:
  • Iframe scale  -  by @​macarie in #​9745 (b6398)
  • Enable locators.exact by default  -  by @​sheremet-va in #​10430 (e2032)
  • Require sessionId for orchestrator html request  -  by @​hi-ogawa, Hiroshi Ogawa and OpenAI Codex in #​10522 (79b7d)
  • Save failure screenshots in attachmentsDir  -  by @​macarie in #​10917 (3b5bb)
• coverage:
  • include/exclude globs too eager  -  by @​AriPerkkio in #​9818 (edacb)
  • Allow thresholds.perFile to accept an object  -  by @​vladlenskiy and @​AriPerkkio in #​10190 (13b78)
• expect:
  • Fix toThrow("") behavior by reverting #​6710  -  by @​hi-ogawa in #​9643 and #​6710 (6c3e4)
• mocker:
  • Deserialize automock as automock  -  by @​nami8824 in #​10192 (2f892)
• reporters:
  • blob reporter and --merge-reports default to .vitest/blob/  -  by @​AriPerkkio in #​10232 (d22b0)
  • Write json and junit reporter output files to .vitest by default  -  by @​hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and @​AriPerkkio in #​10621 (58577)
• spy:
  • Preserve class mock prototype methods on instances  -  by @​sheremet-va in #​10910 (6093d)
• types:
  • Add better promise support in expects and matchers  -  by @​samchungy and @​sheremet-va in #​8266 (41f55)
• ui:
  • Harden UI API access  -  by @​hi-ogawa, Hiroshi Ogawa and OpenAI Codex in #​10583 (4c26d)
  • Change html reporter default output to .vitest  -  by @​hi-ogawa and Hiroshi Ogawa in #​10620 (29c36)

   🚀 Features

• Add createReport and .vitest report directory convention  -  by @​AriPerkkio in #​9993 (72a6d)
• Expose default reporters through configDefaults.reporters  -  by @​hi-ogawa and Claude Opus 5 (1M context) in #​10219 (083f6)
• Support merge reports for non-sharded multi-environment runs (take 2)  -  by @​hi-ogawa, Claude Opus 5 (1M context), OpenAI Codex and @​AriPerkkio in #​10031 (e60b2)
• Add logger.formatError  -  by @​hi-ogawa and OpenAI Codex in #​10268 (2c5f3)
• Support typescript build mode  -  by @​lishaduck in #​9870 (106da)
• Add toggable injectCjsGlobals option  -  by @​sheremet-va in #​10709 (82671)
• Promote fsModuleCache to a top-level option  -  by @​sheremet-va in #​10734 (78ed7)
• Support non-ascii characters in for/each title placeholders  -  by @​k-yle in #​10773 (15e0a)
• Report the duration breakdown as percentages  -  by @​sheremet-va and @​AriPerkkio in #​10820 (c67d2)
• Promote parseSpecifications out of experimental  -  by @​sheremet-va in #​11087 (b628c)
• Promote clearCache out of experimental  -  by @​sheremet-va in #​11086 (d4fe1)
• api:
  • Expose logs recorded during the test  -  by @​sheremet-va in #​10277 (cba20)
• benchmark:
  • Add pluggable benchmark provider API  -  by @​GuillaumeLagrange and @​sheremet-va in #​10799 (86c70)
• browser:
  • Export aria tree utils  -  by @​hi-ogawa in #​10171 (c3423)
  • Support dom snapshot trace view  -  by @​hi-ogawa, Claude Opus 5 (1M context) and OpenAI Codex in #​10102 (7eddd)
  • Provide project reference in ToMatchScreenshotResolvePath  -  by @​macarie and @​sheremet-va in #​10138 (16654)
  • Show aria tree on locator element error  -  by @​hi-ogawa and OpenAI Codex in #​10257 (04f04)
  • Support custom kind in page.mark  -  by @​AriPerkkio in #​10302 (053e8)
  • Live update trace view on watch UI  -  by @​hi-ogawa and OpenAI Codex in #​10296 (78c11)
  • Add context.mark for custom command tracing  -  by @​AriPerkkio in #​10329 (aa514)
  • Show trace view steps in editor panel  -  by @​hi-ogawa and OpenAI Codex in #​10404 (8c4b6)
  • Display nested mark trace in UI  -  by @​hi-ogawa, Hiroshi Ogawa and OpenAI Codex in #​10437 (86ffc)
• cli:
  • Add --repeats CLI option  -  by @​todor-a in #​10504 (ee48b)
  • Support -p shorthand for --project  -  by @​sheremet-va in #​10826 (1addd)
• coverage:
  • V8 to track node:child_process and node:worker_threads contexts  -  by @​AriPerkkio in #​9976 (9baa5)
  • thresholds.autoUpdate to receive previous threshold as argument  -  by @​wouterkroes in #​10495 (04f81)
  • Switch to @vitest/istanbuljs packages  -  by @​AriPerkkio in #​11053 (5f6a5)
• junit-reporter:
  • Add jest-junit-compatible naming options  -  by @​neumaennl, neumaennl, Martin Neumann and Copilot in #​10189 (27393)
• reporter:
  • Support html reporter single file output  -  by @​hi-ogawa, OpenAI Codex and Claude Opus 5 (1M context) in #​10235 (f757e)
  • Add custom GitHub Actions summary title  -  by @​heyJonBray and @​macarie in #​10891 (4363c)
• ui:
  • Highlight editor source locations  -  by @​sheremet-va, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in #​11004 (bce2d)
  • Navigate trace steps with keyboard and remove indirect editor focus  -  by @​sheremet-va, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in #​11005 (6816f)
  • Persist trace view selection in URL  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in #​10981 (3069e)
  • Toggle trace target highlight  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in #​11049 (cd63e)
  • Add link to open playwright trace  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in #​11059 (58f02)
• vitest:
  • Create vi.when()  -  by @​macarie in #​10174 (3900e)
• vm:
  • Support require(esm) in vm pools  -  by @​sheremet-va in #​10829 (01298)

   🐞 Bug Fixes

• Global sequence.concurrent: true with top-level test(..., { concurrent: false }) + depreacte sequential test API and options  -  by @​hi-ogawa, OpenAI Codex and @​sheremet-va in #​10194 (9387f)
• Test tags options should overwrite inherited suite options + inherit suite options in task API  -  by @​hi-ogawa and OpenAI Codex in #​10216 (457db)
• Udpate optimize deps config  -  by @​sheremet-va in #​10223 (95dc6)
• Shell injection safety via github.ref_name in publish workflow  -  by @​lloyd-c137 and lloyd-c137 in #​10327 (dd020)
• Make attachmentsDir root only config  -  by @​hi-ogawa and OpenAI Codex in #​10334 (fab1b)
• Apply cjs interop for truthy __esModule  -  by @​hi-ogawa in #​10363 (2b135)
• Preserve vi.defineHelper callsite for async error stack  -  by @​macayu17 and @​hi-ogawa in #​10415 (ac697)
• Respect disableConsoleIntercept in browser mode  -  by @​Copilot, Hiroshi Ogawa, @​hi-ogawa and OpenAI Codex in #​10391 (66110)
• ForceRerunTriggers uses directory globs against files  -  by @​Patrick-Clausen and Patrick Clausen in #​10421 and #​10420 (4fee2)
• Unify typechecking and ast collection  -  by @​sheremet-va in #​10449 (af993)
• Don't print typecheck warning more than once  -  by @​sheremet-va in #​10461 (15275)
• Correct collumn when parsing tests  -  by @​sheremet-va in #​10467 (7c2fc)
• Fix mixed stdout/stderr log timestamps in onUserConsoleLog  -  by @​Copilot, Hiroshi Ogawa, @​hi-ogawa and @​sheremet-va in #​10308 (62756)
• Fix importOriginal with optimizer and query import  -  by @​davidxharris, David Harris, @​hi-ogawa, Hiroshi Ogawa and OpenAI Codex in #​10469 (6a3bb)
• Correct transform time calculation in merged report  -  by @​potatomatoooo and @​hi-ogawa in #​10570 and #​10578 (b7897)
• Fix setImmediate await in detect-async-leak  -  by @​hi-ogawa and Hiroshi Ogawa in #​10608 (dd62b)
• Fix per-project sequence config  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in #​10659 (40cdc)
• Add handshake timeout to iframe communication  -  by @​sheremet-va in #​10656 (3545f)
• Don't print column in test names when includeTaskLocation is enabled  -  by @​sheremet-va in #​10681 (bd9cc)
• Disable server HMR before plugins read it in their config hook  -  by @​sheremet-va in #​10731 (e060b)
• Close the pool before the Vite servers  -  by @​sheremet-va in #​10725 (96fa6)
• Remove listeners in the typecheck worker's off  -  by @​sheremet-va in #​10741 (d758b)
• Keep per-file isolation in vm pools when maxWorkers is 1  -  by @​sheremet-va in #​10743 (83ab9)
• Node.js 20 deprecation warning for ci.yml  -  by @​hirehamir in #​10759 (2127f)
• Prevent node builtins double prefix  -  by @​malobre in #​10630 and #​10767 (22d35)
• Set non-zero exit code when teardown throws during close  -  by @​zakcutner and @​AriPerkkio in #​10794 (22116)
• Don't race the typechecker spawn grace period on windows  -  by @​xevrion in #​10814 (b19e5)
• Coalesce concurrent watch-mode restarts, deflake the pool stderr fixture  -  by @​sheremet-va in #​10822 (a31f8)
• Prevent vitest --typecheck from reporting a false success when the tsc process crashes  -  by @​hitenkalda and Hiten Kalda in #​10705 (a1b05)
• Collect in-source tests when the module is cached  -  by @​koutaro-masaki in #​10577 and #​10589 (a7bf2)
• Swap replace() arguments so timeout error stack shows the real message  -  by @​lazerg in #​10875 (aba0f)
• Stale mock metadata breaks automocking with isolate:false  -  by @​kade-robertson in #​10145 and #​10541 (8e210)
• Don't lose worker output on teardown, deflake timing-sensitive tests  -  by @​sheremet-va in #​10842 (1216b)
• Revive global concurrency limit for test lifecycle  -  by @​hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and @​sheremet-va in #​10928 (cf917)
• Own the post-restart rerun, keep process.exit disabled in workers  -  by @​sheremet-va in #​10963 (5e69a)
• Preserve correct root during resolve config  -  by @​AriPerkkio and @​sheremet-va in #​10909 (210ba)
• Combine multiple --project filters correctly  -  by @​sheremet-va in #​10988 (66c1c)
• Fix recordArtifact location with vi.defineHelper  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in #​11047 (c2186)
• Invalidate resolved setup files  -  by @​sheremet-va in #​11073 and #​11081 (488c0)
• Accept awaited value in vi.when thenResolve  -  by @​sheremet-va in #​11084 (c10a1)
• Ignore computed member calls in static collection  -  by @​sheremet-va in #​11085 (130f7)
• Don't duplicte oxc.target if user provides a custom array  -  by @​sheremet-va in #​11095 (848d7)
• Propagate --maxWorkers to projects  -  by @​Gaurav1112 in #​11102 (2122f)
• Apply queued mocks from doMock() in queue order  -  by @​juliandescottes and Claude Opus 5 (1M context) in #​10706 and #​11127 (f08ce)
• Add a warning if inline project has duplicate plugins due to unexpected extends: true  -  by @​sheremet-va in #​11120 (584cf)
• Treat test.describe as a suite during static collection  -  by @​sheremet-va in #​11128 (d46a7)
• browser:
  • Fix trace highlight of shadow dom on webdriverio  -  by @​hi-ogawa in #​10227 (b01af)
  • Simplify orchestrator otel carrier  -  by @​hi-ogawa in #​10283 (3514f)
  • Remove orphaned Playwright route when same module is mocked via multiple ids  -  by @​Zelys-DFKH in #​9957 and #​10267 (41db6)
  • Skip wrapDynamicImport transform on ssr environment  -  by @​hi-ogawa in #​10355 (d3c96)
  • Fix stale source map on watch mode  -  by @​hi-ogawa in #​10389 (6d772)
  • Escape inline orchestrator scripts  -  by @​hi-ogawa and OpenAI Codex in #​10412 (c22cf)
  • Disable client cdp API when allowWrite/allowExec: false  -  by @​hi-ogawa and OpenAI Codex in #​10444 (63e3b)
  • Wait for orchestrator readiness before resolving browser sessions  -  by @​soconnor-seeq in #​10397 (fe5ed)
  • Wait for iframe tester readiness before preparing  -  by @​soconnor-seeq in #​10497 (f2655)
  • Encode iframeId in tester iframe URL  -  by @​Pduhard, Pduhard and Claude Opus 5 (1M context) in #​10520 and [#&Update dependency typescript to ~5.9.0 #8

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

🦙 MegaLinter status: ✅ SUCCESS

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ COPYPASTE	jscpd	yes		no	no	1.88s
✅ EDITORCONFIG	editorconfig-checker	1		0	0	0.21s
✅ JSON	jsonlint	1		0	0	0.39s
✅ JSON	npm-package-json-lint	yes		no	no	0.34s
✅ JSON	v8r	1		0	0	7.53s
✅ REPOSITORY	git_diff	yes		no	no	0.24s
✅ REPOSITORY	secretlint	yes		no	no	0.74s
✅ REPOSITORY	syft	yes		no	no	3.53s
✅ REPOSITORY	trivy	yes		no	no	8.97s
✅ REPOSITORY	trivy-sbom	yes		no	no	1.14s
✅ REPOSITORY	trufflehog	yes		no	no	22.04s

See detailed report in MegaLinter reports
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff