vitest

Security advisories

Grouped by the version that fixes them, so one upgrade reads as one step.

• Fixed in 5.0.0-rc.2 · 1 advisory

  • MODERATEVitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect MockGHSA-82fw-gwwq-j7x9

• Fixed in 4.1.0 · 1 advisory

  • CRITICALWhen Vitest UI server is listening, arbitrary file can be read and executedGHSA-5xrq-8626-4rwp

• Fixed in 3.0.5 · 1 advisory

  • CRITICALVitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listeningGHSA-9crc-q9x8-hgqq

Every stable release, newest first. Notes are quoted as the maintainers published them.

1. 5.0.4

   12 October 2026
   experimental: Tag cache directories with CACHEDIR.TAG

   Features

   • experimental: Tag cache directories with CACHEDIR.TAG

   • experimental: Support test.ui.theme option

   • experimental: Highlight selector multiple matches in trace view

   • experimental: Print how many tests were affected and a total when running --changed

   • experimental: Add an option to cache dependencies instead of statically parsing them

   • experimental: Add fit and zoom controls to trace viewer

   Bug Fixes

   • Fail the run on git and location filter errors

   • Enable fsModuleCache by default

   • Track project files and mocks with --changed

   • Refactor caching, fix : in project and change the shape of results cache

   • Keep full $ string values when taskTitleValueFormatTruncate is 0

   • Resolve node builtins in client environments

   • Fix module graph builtin externals after #11421

   • Wrap module mocks during in-source testing

   • Handle line endings in snapshot

   • Respect root in projects

   • Resolve mocks in directories with spaces

   • api: Publish the api token atomically

   • browser: Close the mock route interception race

   • browser: Allow toHaveTextContent without arguments

   • browser: Apply API options without browser config

   • browser: Preserve undefined command arguments

   • browser: Wait for setup mocks before importing a test file

   • browser: Avoid extra scroll outside the iframe

   • browser: Run browser instances as workers

     • ⚠️ This can degrade performance if you have a custom maxWorkers setting. Previously, it was applied incorrectly and could lead to Vitest using too many resources. For example, a lower number would still open too many browsers. Fixing it means Vitest opens less instances by default now.

   • browser: Open one cdp session per tester

   • browser: Clean up unmocked and pending mocks

   • coverage: V8 browser memory leak between test files

2. 5.0.3

   30 September 2026
   Isolate result.status between repeats runs

   Bug Fixes

   • Isolate result.status between repeats runs

   • Don't print an interceptor warning in browser mode

   • Don't retry when test.fails expectedly failed

   • Scope cache key generators to projects

   • browser: Delay server listen until tests start running

   • browser: Check mock path boundaries

   • browser: Keep config of browser-consumed environments

   • browser: Ignore page crash while cancelling

   • browser: toMatchScreenshot uses wrong reference on retried tests

   • cache: Revalidate imports of cached modules

   • deps: Pin why-is-node-running to 3.2.1 to avoid users running into ERR_PNPM_TRUST_DOWNGRADE

   • expect: Pass current equality testers to expect.extend asymmetric matchers

   • jsdom: Support Blob on jsdom 30.1

   • pool: Preserve unique pool ids when groupOrder is set

   • ui: Split-pane handle overlapping iframe

   • vitest: Remove root temp dir on close

   • vm: Do not optimize deps from index.html

   • vm: Don't reuse scripts across vite environments

3. 5.0.2

   25 September 2026
   Bind process in case global is overwritten

   Bug Fixes

   • Bind process in case global is overwritten

   • detect-async-leaks: Ignore process.stdio handles

   • expect: Fix toMatchObject with asymmetric matchers

   • jsdom: Fix Request with Blob body on jsdom 28+

   • reporter: agent to respect --silent

   • reporters: Handle concurrent createReport calls

   • reporters: hanging-process to use ESM entrypoint

   • spy: Fix stack overflow when spying Set.prototype.add

   • ui: Persist authentication cookie beyond current browser session

4. 5.0.1

   15 September 2026
   ui: Move trace attempts selector to viewer header

   Features

   • ui: Move trace attempts selector to viewer header

   • ui: Add focused trace view layout mode

   Bug Fixes

   • Exit 1 when vitest list fails collection

   • Keep parse error details in static collection

   • Avoid recursive prototype in automocking

   • Prevent false Vitest import resolution

   • Keep metadata file when clearing the cache

   • Correct typos in error message and comments

   • Resolve ResolvedConfig exactOptionalPropertyTypes errors

   • Share the server on self-referencing extends

   • Warn when deprecated deps.optimizer.web is used

   • browser: Avoid double quotes in config.define

   • doctor: Measure vm pools for custom environments

   • expect: Correct return value in toMatchAriaSnapshot

   • fakeTimers: Force queueMicrotask and nextTick in toNotFake

   • snapshot: Report obsolete keys next to skipped tests

   • types: Make public declarations self-contained

   • ui: Fix collapse/expand suite with file name search

   • ui: Fix explorer file summary count

   • utils: Fix deepMerge to handle prototype

5. 5.0.0

   3 September 2026
   Vitest 5 is officially out! This release focuses on performance and brings a lot of new features while fixing long-standing bugs. See our blog post for the official announcement.

   Vitest 5 is officially out! This release focuses on performance and brings a lot of new features while fixing long-standing bugs. See our blog post for the official announcement.

   Breaking Changes

   • breaking

     Replace loupe.inspect with pretty-format

   • breaking

     Remove quotes from string values in test.for/each title $ variable (take 2)

   • breaking

     Default attachmentsDir from .vitest-attachements/ to .vitest/attachments/

   • breaking

     Remove sequential test/suite options in favor of concurrent

   • breaking

     Represent locator as an object instead of a string

   • breaking

     Inline expect package

   • breaking

     Remove deprecated entry points

   • breaking

     Require Node.js 22 and Vite 6.4

   • breaking

     Fail expect.poll when function didn't resolve in time

   • breaking

     Throw an error if hoistable methods are outside the top level scope

   • breaking

     toHaveTextContent is strict, add toMatchTextContent as alternative

   • breaking

     Don't lookup config file from ancestor directories

   • breaking

     Inline @vitest/runner package, do not publish it anymore

   • breaking

     Allow mutating happy-dom/jsdom window object

   • breaking

     Expose concurrencyId/workerId on TestModule's diagnostics, make id 1-based

   • breaking

     Add screenshotDirectory config to browser.expect.toMatchScreenshot

   • breaking

     Update @sinonjs/fake-timers and support mocking Temporal

   • breaking

     Remove webdriverio package

   • breaking

     Clear mocks by default before each test

   • breaking

     Don't emit localStorage warnings on Node 26, fail gracefully when worker fails to start

   • breaking

     Separate config resolution from the server creation

   • breaking

     Inline projects extend the root config by default

   • breaking

     Enable mocking Temporal without fake timers

   • breaking

     Support nested projects

   • breaking

     Use > as separator in -t, calculate only once

   • breaking

     Fail the test when an asynchronous assertion is not awaited

   • breaking

     Share the Vite server between inline projects

   • breaking

     Parse files statically in vitest list by default

6. 4.1.11

   18 August 2026
   Revive global concurrency limit for test lifecycle [backport to v4]

   Bug Fixes

   • Revive global concurrency limit for test lifecycle [backport to v4]

   • browser: Encode iframeId in tester iframe URL [backport to v4]

   • browser: Trigger playwright/chromium gc on lower disk availability [backport to v4]

   • mocker: Restrict redirect mocks to the fs allowlist [backport to v4]

Major versions

• 5.xsince 3 September 2026 · latest 5.0.4 · 5 releases
• 4.xsince 22 October 2025 · latest 4.1.11 · 31 releases
• 3.xsince 16 January 2025 · latest 3.2.7 · 23 releases
• 2.xsince 8 July 2024 · latest 2.1.9 · 16 releases
• 1.xsince 4 December 2023 · latest 1.6.1 · 21 releases
• 0.xsince 3 December 2021 · latest 0.34.6 · 318 releases