v3.0.5

This release includes security patches for:

• Remote Code Execution when accessing a malicious website while Vitest API server is listening | CVE-2025-24964

🚀 Features

• ui: Insert message "no tests found" in ui - by @DevJoaoLopes in #7366 (92da4)

🐞 Bug Fixes

• Validate websocket request - by @hi-ogawa and @AriPerkkio in #7317 (191ef)
• Don't toggle cli cursor on non-TTY - by @AriPerkkio in #7336 (3c805)
• vite-node: Differentiate file url with hash and query - by @hi-ogawa in #7365 (926ca)

View changes on GitHub

v2.1.9

This release includes security patches for:

• Browser mode serves arbitrary files | CVE-2025-24963
• Remote Code Execution when accessing a malicious website while Vitest API server is listening | CVE-2025-24964

   🐞 Bug Fixes

• backport #7317 to v2 - by @hi-ogawa in #7318
• (backport #7340 to v2) restrict served files from /__screenshot-error - by @hi-ogawa in #7343

    View changes on GitHub

v1.6.1

This release includes security patches for:

• Remote Code Execution when accessing a malicious website while Vitest API server is listening | CVE-2025-24964

   🐞 Bug Fixes

• backport #7317 to v1 - by @hi-ogawa in #7319

    View changes on GitHub

v3.0.4

This release includes security patches for:

• Browser mode serves arbitrary files | CVE-2025-24963

   🐞 Bug Fixes

• Filter projects eagerly during config resolution  -  by @sheremet-va and @AriPerkkio in #7313 (dff44)
• Apply development|production condition on Vites 6 by @hi-ogawa and @sheremet-va (#7301) (ef146)
• browser: Restrict served files from /__screenshot-error  -  by @hi-ogawa in #7340 (ed9ae)
• deps: Update all non-major dependencies  -  by @sheremet-va in #7297 (38ea8)
• runner: Timeout long sync hook  -  by @hi-ogawa in #7289 (c60ee)
• typechecking: Support typechecking parsing with Vite 6  -  by @sheremet-va in #7335 (bff70)
• types: Fix public types  -  by @mrginglymus and @sheremet-va in #7328 (ce6af)

    View changes on GitHub

v3.0.3

   🐞 Bug Fixes

• browser:
  • Don't throw a validation error if v8 coverage is used with filtered instances  -  by @sheremet-va in #7306 (fa463)
  • Don't fail when running --browser.headless if the browser projest is part of the workspace  -  by @sheremet-va in #7311 (e43a8)

   🏎 Performance

• reporters: Update summary only when needed  -  by @AriPerkkio in #7291 (7f36b)

    View changes on GitHub

v3.0.2

   🐞 Bug Fixes

• Don't await an empty timeout after every test  -  by @sheremet-va in #7281 (ef1aa)
• expect: Fix expect().resolves/rejects chain typings  -  by @hi-ogawa in #7273 (fa415)

    View changes on GitHub

v3.0.1

   🐞 Bug Fixes

• Revert "fix: re-apply default conditions if using vite 6 or later (#7071)"  -  by @sheremet-va in #7071 and #7271 (755ec)
• deps: Update all non-major dependencies  -  by @sheremet-va in #7147 (537fa)

    View changes on GitHub

v3.0.0

Vitest 3 is here! There are a few breaking changes, but we expect the migration to be smooth. This release page lists all changes made to the project during the beta. For the migration guide, please refer to the documentation.

   🚨 Breaking Changes

• spy.mockReset changes  -  by @Lordfirespeed in #6426 (db7a8)
• Pass down context to test hooks  -  by @sheremet-va in #7034 (82c2e)
• Support Vite 6  -  by @sheremet-va in #7026 (7abe8)
• coverage: Always exclude test files  -  by @AriPerkkio in #7254 (b5268)
• deps: Update fake-timers to v14.0.0  -  by @xxzefgh and @hi-ogawa in #7097 (c98b4)
• expect: Check more properties for error equality  -  by @hi-ogawa and @sheremet-va in #5876 (10023)
• runner: Support describe(..., { shuffle: boolean }) and inherit from parent suite  -  by @hi-ogawa in #6670 (aa1da)
• snapshot: Reset snapshot state for retry and repeats  -  by @hi-ogawa in #6817 (e8ce9)
• spy: SpyOn reuses mock if method is already spyed on  -  by @sheremet-va and @hi-ogawa in #6464 (b3e43)
• vitest: Don't expose default toFake config  -  by @sheremet-va in #6288 (e3144)

   🚀 Features

• Support inline diff options and support printBasicPrototype  -  by @hi-ogawa, @sheremet-va and Michał Grzegorzewski in #6740 (39186)
• Allow a custom note when calling ctx.skip() dynamically  -  by @sheremet-va in #6805 (697c3)
• Allow inline workspace configuration  -  by @sheremet-va in #6923 (562e1)
• Provide the current project to the global setup  -  by @sheremet-va in #6942 (a5bbc)
• Print project name as a label  -  by @sheremet-va in #6925 (a3bef)
• Print a deprecation warning if suite or test uses object as the third argument  -  by @sheremet-va in #7031 (407f1)
• Expose versions from vitest/node entry point and statically on Vitest  -  by @sheremet-va in #7029 (be8d4)
• diff.printBasicPrototype: false by default  -  by @hi-ogawa in #7043 (2b5c5)
• Prepare the Vitest API to be stable  -  by @sheremet-va in #6962 (9a1b5)
• Support Vite v6 in mocker package  -  by @cexbrayat in #7058 (96f47)
• Allow multi-browser configuration  -  by @sheremet-va in #6975 (78b62)
• Add resolved project names to the reporter API  -  by @userquin in #7213 (91758)
• Introduce the new reporter API  -  by @sheremet-va and @AriPerkkio in #7069 (76662)
• Add describe.for  -  by @hi-ogawa in #7253 (0ad28)
• api:
  • Add onBrowserInit event  -  by @sheremet-va in #7255 (80ce0)
• browser:
  • Support actionTimeout as playwright provider options  -  by @hi-ogawa in #6984 (e2c29)
  • Support clipboard api userEvent.copy, cut, paste  -  by @hi-ogawa in #6769 (843a6)
  • Implement locator.nth()  -  by @xeger and @sheremet-va in #7137 (38458)
• cli:
  • Support excluding projects with --project=!pattern  -  by @haines in #6924 (ebfe9)
  • Support specifying a line number when filtering tests  -  by @mzhubail and @sheremet-va in #6411 (4d94b)
  • Support location filters for suites  -  by @mzhubail in #7048 (751e2)
• coverage:
  • thresholds to support maximum uncovered items  -  by @jonahkagan in #7061 (bde98)
• expect:
  • Add toHaveBeenCalledExactlyOnceWith expect matcher  -  by @jacoberdman2147 and @sheremet-va in #6894 (ff662)
  • Add toHaveBeenCalledAfter and toHaveBeenCalledBefore utility  -  by @Barbapapazes and @sheremet-va in #6056 (85e6f)
  • Add toSatisfy asymmetric matcher  -  by @hi-ogawa in #7022 (f691a)
  • Add toBeOneOf matcher  -  by @zirkelc and @hi-ogawa in #6974 (3d742)
• reporter:
  • Add support for function type to classname option in the junit reporter  -  by @jpleclerc, Jean-Philippe Leclerc and @hi-ogawa in #6839 (dc238)
• reporters:
  • summary option for verbose and default reporters  -  by @AriPerkkio in #6893 (511b7)
• runner:
  • Test context can inject values from the config's provide  -  by @sheremet-va in #6813 (85c64)
  • Add "queued" state  -  by @sheremet-va and @AriPerkkio in #6931 (5f8d2)
• snapshot:
  • Provide config to resolveSnapshotPath  -  by @hi-ogawa in #6800 (746d8)
• ui:
  • Allow run individual tests/suites from the UI  -  by @userquin in #6641 (d9cc8)
  • Make clicking on a test in the UI open the report section and scroll to the test failure if applicable  -  by @jacoberdman2147 in #6900 (1bf27)
  • Allow hide/show node_modules in module graph tab  -  by @userquin in #7217 (50cf6)
• vitest:
  • Include coverageMap in json report &nb...

v3.0.0-beta.4

   🚨 Breaking Changes

• deps: Update fake-timers to v14.0.0  -  by @xxzefgh and @hi-ogawa in #7097 (c98b4)

   🚀 Features

• browser:
  • Support clipboard api userEvent.copy, cut, paste  -  by @hi-ogawa in #6769 (843a6)
  • Implement locator.nth()  -  by @xeger and @sheremet-va in #7137 (38458)

   🐞 Bug Fixes

• Fix missing chai types  -  by @hi-ogawa in #7149 (6a09c)
• cancelCurrentRun awaits runningPromise  -  by @sheremet-va in #7168 (1dbf5)
• Add Locator typings for nth, first and last.  -  by @xeger in #7176 (d262e)
• Batch console logs by microtask  -  by @hi-ogawa in #7183 (53d1d)
• Allow getMockImplementation to return "once" implementation  -  by @chaptergy in #7033 (39125)
• benchmark:
  • Rewrite reporter without log-update  -  by @AriPerkkio in #7019 (6d23f)
• browser:
  • Fix provider options types  -  by @hi-ogawa in #7115 (579bd)
  • Only use locator.element on last expect.element attempt  -  by @tsirlucas in #7139 and #7152 (847d3)
  • Use correct project when filtering entries in the browser mode  -  by @sheremet-va in #7167 (423d6)
• coverage:
  • Prevent crash when v8 incorrectly merges static_initializer's  -  by @AriPerkkio in #7150 (cb6db)
• deps:
  • Update all non-major dependencies  -  in #7116 (de5ce)
  • Update dependency pathe to v2  -  in #7181 (74dbe)
• diff:
  • Truncate to avoid crash on diff large objects  -  by @hi-ogawa in #7133 (2a9d6)
• runner:
  • Mark tests of describe.todo as 'todo'  -  by @AriPerkkio in #7171 (1d458)
• snapshot:
  • Fix "obsolete" message on snapshot update re-run  -  by @hi-ogawa in #7129 (c2beb)
  • Preserve white space of toMatchFileSnapshot  -  by @hi-ogawa in #7156 (a437b)
  • Fix obsoleteness check of toMatchSnapshot("...")  -  by @hi-ogawa in #7126 (ac9ba)
• typecheck:
  • Use unique temp and tsbuildinfo file for each tsconfig file  -  by @masnormen in #7107 and #7112 (61b30)
  • Fix error test case mapping for @ts-expect-error  -  by @hi-ogawa in #7125 (27d34)
• vite-node:
  • Properly normalize file url import  -  by @hi-ogawa in #7087 (31675)
  • Fix mandatory node prefix  -  by @hi-ogawa in #7179 (b6284)

    View changes on GitHub

v3.0.0-beta.3

   🚀 Features

• Support Vite v6 in mocker package  -  by @cexbrayat in #7058 (96f47)
• Allow multi-browser configuration  -  by @sheremet-va in #6975 (78b62)
• coverage: thresholds to support maximum uncovered items  -  by @jonahkagan in #7061 (bde98)
• expect: Add toBeOneOf matcher  -  by @zirkelc and @hi-ogawa in #6974 (3d742)
• runner: Add "queued" state  -  by @sheremet-va and @AriPerkkio in #6931 (5f8d2)

   🐞 Bug Fixes

• Don't use dim color for passed tests  -  by @sheremet-va in #7059 (8a6f5)
• benchmark: Disable type testing while benchmarking  -  by @AriPerkkio in #7068 (4e603)
• deps: Update all non-major dependencies  -  in #7085 (8cc92)

    View changes on GitHub