fix(root): resolve critical vitest vulnerability

[cursor]

Summary

Upgrades vitest across the entire monorepo to >=4.1.0 (currently resolving to 4.1.7) to address GHSA-5xrq-8626-4rwp — When Vitest UI server is listening, arbitrary file can be read and executed (critical).

Field	Value
Advisory	GHSA-5xrq-8626-4rwp
Severity	critical
Vulnerable	< 4.1.0
Patched	>= 4.1.0
Resolved version	4.1.7 (latest within minimumReleaseAge)

Fix strategy

Strategy B — pnpm override. A single override entry in pnpm-workspace.yaml forces every direct and transitive consumer to resolve to a patched release:

vitest@<4.1.0: ^4.1.0

Before the fix, vitest was installed at 1.6.1, 2.1.9, and 3.2.x across direct dev-deps in 10 workspaces (and as a transitive dev-peer of better-auth for the dashboard / enterprise/packages/auth). The override cascades through all of them.

Build adjustments

The override surfaced two pre-existing rough edges that prevented pnpm build:v2 from passing on a clean rebuild. Both are addressed in-place:

• enterprise/workers/scheduler/package.json — bump @cloudflare/vitest-pool-workers from ^0.12.7 → ^0.16.10 and vitest devDep from ~3.2.0 → ^4.1.0. The 0.12.x line pins its peer to vitest 2.0.x - 3.2.x, so leaving it in place would force pnpm to keep an old vitest in the tree purely to satisfy that peer. 0.13.x+ already requires ^4.1.0, matching the override.
• packages/novu/src/commands/wizard/pipeline/steps/run-agent.spec.ts — vitest 4 changes vi.fn type generics from the old vi.fn<[Args], Return>() shape (2 type args) to vi.fn<(args) => Return>() (1 type arg). The package's build step runs tsc -p tsconfig.json which type-checks *.spec.ts files, so three call sites needed the syntactic update.

Validation

• pnpm audit --json no longer reports advisory GHSA-5xrq-8626-4rwp (vitest). Remaining advisories are unrelated:
  • aws-sdk (low) — requires v2→v3 SDK rewrite of consuming code; skipped per the bot's "no breaking direct-dep bumps" rule.
  • mailparser (low) — requires 0.6 → 3.9 API rewrite (MailParser class → simpleParser); skipped for the same reason.
  • better-auth (moderate) — already in flight in fix(root): resolve moderate better-auth vulnerability fixes NV-7915 #11365.
• pnpm build:v2 succeeds for @novu/api-service, @novu/worker, @novu/ws, @novu/dashboard, and all tag:type:package projects.

Notes

• The vitest 4 release notes include a large set of breaking changes (module-runner replacing vite-node, rewritten spy implementation, removed deprecated APIs, etc.). The build step does not run tests, so this PR validates only the build path. Individual test suites may need follow-up adjustments when each team next runs pnpm test — but those are local test-only changes and won't affect production builds, services, or published artifacts.
• Linear ticket: the Linear MCP server is not authenticated in this environment, so the ticket could not be created automatically. Please attach the appropriate NV-XXXX ticket when merging.

  

[greptile-apps]

PR author is not in the allowed authors list.

[netlify]

✅ Deploy Preview for dashboard-v2-novu-staging canceled.

Name	Link
🔨 Latest commit	144fb68
🔍 Latest deploy log	https://app.netlify.com/projects/dashboard-v2-novu-staging/deploys/6a1e793140a4be0008b9fa6f

[github-actions]

Hey there and thank you for opening this pull request! 👋

We require pull request titles to follow specific formatting rules and it looks like your proposed title needs to be adjusted.

Your PR title is: fix(root): resolve critical vitest vulnerability

Requirements:

1. Follow the Conventional Commits specification
2. As a team member, include Linear ticket ID at the end: fixes TICKET-ID or include it in your branch name

Expected format: feat(scope): Add fancy new feature fixes NOV-123

Details:

PR title must end with 'fixes TICKET-ID' (e.g., 'fixes NOV-123') or include ticket ID in branch name

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​cloudflare/​vitest-pool-workers@​0.16.11
	vitest@​2.1.9 ⏵ 4.1.7	+1	+75	+1
	vitest@​2.1.9 ⏵ 4.1.8	+3	+75	+1	-1

View full report