Bump @vitest/browser to ^2.1.8 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@vitest/browser (source)	2.1.8 -> 2.1.9

GitHub Vulnerability Alerts

CVE-2025-24963

Summary

__screenshot-error handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by browser.api.host: true, an attacker can send a request to that handler from remote to get the content of arbitrary files.

Details

This __screenshot-error handler on the browser mode HTTP server responds any file on the file system.
https://github.com/vitest-dev/vitest/blob/f17918a79969d27a415f70431e08a9445b051e45/packages/browser/src/node/plugin.ts#L88-L130

This code was added by vitest-dev/vitest@2d62051.

PoC

1. Create a directory and change the current directory to that directory
2. Run npx vitest init browser
3. Run npm run test:browser
4. Run curl http://localhost:63315/__screenshot-error?file=/path/to/any/file

Impact

Users explicitly exposing the browser mode server to the network by browser.api.host: true may get any files exposed.

---

Release Notes

vitest-dev/vitest (@​vitest/browser)

v2.1.9

Compare Source

This release includes security patches for:

• Browser mode serves arbitrary files | CVE-2025-24963
• Remote Code Execution when accessing a malicious website while Vitest API server is listening | CVE-2025-24964

   🐞 Bug Fixes

• backport https://github.com/vitest-dev/vitest/issues/7317 to v2 - by @​hi-ogawa in https://github.com/vitest-dev/vitest/pull/7318
• (backport #​7340 to v2) restrict served files from /__screenshot-error - by @​hi-ogawa in https://github.com/vitest-dev/vitest/pull/7343

    View changes on GitHub

---

Configuration

📅 Schedule: Branch creation - "" in timezone UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[netlify]

✅ Deploy Preview for base-ui ready!

Name	Link
🔨 Latest commit	aa7c076
🔍 Latest deploy log	https://app.netlify.com/sites/base-ui/deploys/67a36fee81d85e00085aad75
😎 Deploy Preview	https://deploy-preview-1412--base-ui.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.