[dependabot]

Bumps the npm_and_yarn group with 2 updates in the / directory: @vitest/ui and undici.

Updates @vitest/ui from 5.0.4 to 5.0.5

Release notes

Sourced from @​vitest/ui's releases.

v5.0.5

   🐞 Bug Fixes

• Keep vite default fs.deny with api token file  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11578 (28dc1)
• Handle quoted file names in --changed  -  by @​sheremet-va in vitest-dev/vitest#11583 (14921)
• Add data to the import.meta.hot stub  -  by @​sheremet-va in vitest-dev/vitest#11590 (3a828)
• Set skip in skipIf, ignore undefined options  -  by @​sheremet-va in vitest-dev/vitest#11591 (d523a)
• Skip builtin loading in async leak detector  -  by @​sheremet-va in vitest-dev/vitest#11598 (fe86a)
• Keep the import frame in native loader errors  -  by @​sheremet-va in vitest-dev/vitest#11599 (9697b)
• Run hook cleanups when a later hook fails  -  by @​sheremet-va in vitest-dev/vitest#11605 (6c5a4)
• Release mocks of finished test files  -  by @​sheremet-va in vitest-dev/vitest#11607 (e9c3d)
• Abort all running tests on cancel  -  by @​sheremet-va in vitest-dev/vitest#11606 (6621a)
• browser:
  • Ignore synthetic pagehide events  -  by @​sheremet-va in vitest-dev/vitest#11582 (ca081)
  • Run plugin buildStart on server creation  -  by @​sheremet-va in vitest-dev/vitest#11593 (ea611)
  • Drop late connections of closed sessions  -  by @​sheremet-va in vitest-dev/vitest#11600 (f161e)
  • Wait 30s for the browser to close  -  by @​sheremet-va in vitest-dev/vitest#11601 (6498b)
  • Run global setup once with instances  -  by @​sheremet-va in vitest-dev/vitest#11596 (8dd67)
• reporter:
  • End reason &[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/ui/issues/39);failed&[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/ui/issues/39); on worker crash  -  by @​AriPerkkio in vitest-dev/vitest#11568 (6ae8e)

    View changes on GitHub

Commits

• 7a825db chore: release v5.0.5 (#11609)
• See full diff in compare view

Updates undici from 8.12.1 to 8.12.3

Release notes

Sourced from undici's releases.

v8.12.3

What's Changed

• ci: use Python 3.14 for the WPT server on macOS by @​mrityunjay-pandey in nodejs/undici#6029
• build(deps-dev): bump neostandard from 0.13.0 to 0.14.0 by @​dependabot[bot] in nodejs/undici#6006
• build(deps-dev): bump eslint from 9.39.4 to 10.12.0 by @​dependabot[bot] in nodejs/undici#5967
• docs: document the options of interceptors.cache() by @​qodelicious in nodejs/undici#6050
• fix(h2): replace a connection that stops responding after a stream timeout by @​mcollina in nodejs/undici#6052
• fix(pool): keep caller async context for queued requests by @​mcollina in nodejs/undici#5982

New Contributors

• @​qodelicious made their first contribution in nodejs/undici#6050

Full Changelog: nodejs/undici@v8.12.2...v8.12.3

v8.12.2

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.

TLS certificate validation bypass through dropped Agent options

CVE-2026-109383 · GHSA-2m5v-pch6-74hx

Agent used a JSON-based clone for constructor options, which silently removed function-valued TLS options such as checkServerIdentity. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers.

Cache poisoning and cross-user disclosure through cross-origin redirects

CVE-2026-109829 · GHSA-4w7w-5xrc-9h26

When an originless Agent combined redirect and shared-cache interceptors as compose(redirect(), cache()), a response from a cross-origin redirect could be stored under the original URL. This could allow persistent cache poisoning or disclosure of user-specific responses to later callers. This release verifies the response origin before caching and preserves redirect-hop cache-control policy.

Denial of service through excessive Content-Encoding values

CVE-2026-109869 · GHSA-xjj6-f33q-929c

A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although fetch() rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely.

Medium severity

Denial of service through the decompress interceptor

CVE-2026-87029 · GHSA-55wc-3pg8-jfw6

... (truncated)

Commits

• ff9cc5e Bumped v8.12.3 (#6053)
• 0bbf614 fix(pool): keep caller async context for queued requests (#5982)
• aa1eef1 fix(h2): replace a connection that stops responding after a stream timeout (#...
• e34b872 docs: document the options of interceptors.cache() (#6050)
• e8f3423 build(deps-dev): bump eslint from 9.39.4 to 10.12.0 (#5967)
• b777e40 build(deps-dev): bump neostandard from 0.13.0 to 0.14.0 (#6006)
• 43700ff ci: use Python 3.14 for the WPT server on macOS (#6029)
• bb6cc0a Bumped v8.12.2 (#6021)
• b217373 fix(websocket): bound automatic PONG writes under backpressure
• 789ef26 fix(eventsource): bound retained SSE parser state
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

📦 Extension Build Ready!

Version: 1.1.9

📥 Download Extension (tabee.zip)

Installation

1. Download and extract the zip file
2. Open Chrome → chrome://extensions/
3. Enable "Developer mode" (top right)
4. Click "Load unpacked" → Select the extracted folder

Status

• ✅ All tests passed
• ✅ Build successful
• ✅ Ready for testing

---

_{🤖 Auto-generated by GitHub Actions}

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	59.24%	692 / 1168
🔵	Statements	59.55%	729 / 1224
🔵	Functions	66.35%	142 / 214
🔵	Branches	54.75%	351 / 641

File Coverage

No changed files found.

Generated in workflow #485 for commit e51671b by the Vitest Coverage Report Action

[sebastienfontaine]

Thanks Dependabot! Superseded by #581: @vitest/ui@5.0.5 requires exactly vitest@5.0.5, so #581 bumps vitest, @vitest/ui and @vitest/coverage-v8 to 5.0.5 together, along with undici 8.12.3.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml