[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
vitest (source)	^1.6.0 → ^5.0.0

---

When Vitest UI server is listening, arbitrary file can be read and executed

CVE-2026-47429 / GHSA-5xrq-8626-4rwp

More information

Details

Summary

Arbitrary file can be read on Windows when Vitest UI server is listening, especially when exposed to the network.

Impact

Only users that match either of the following conditions are affected:

• explicitly exposes the Vitest UI server to the network (using --api.host or api.host config option)
• running the Vitest UI or Browser Mode on Windows

Details

The API handler for /__vitest_attachment__ uses the deprecated isFileServingAllowed incorrectly.
https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/ui/node/index.ts#L77
The function expects the passed value to use cleanUrl after the check before file system related operation.
Because of this, it is possible to bypass the check by \\?\\..\\. This is not possible on Linux as Linux errors if a directory named ? does not exist.

A similar problem exists in other places as well.

• https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/vitest/src/api/setup.ts#L103-L105
• https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/vitest/src/api/setup.ts#L119-L121
• https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/browser/src/node/commands/fs.ts#L10-L11
• https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/browser/src/node/plugin.ts#L194-L196
• https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/browser/src/node/rpc.ts#L115-L121

That said, this isFileServingAllowed check does not actually prevent the API to be abused. Since the API has rerun feature and file write feature, it's possible to run arbitrary script by writing a script as a test file using saveTestFile and running it using rerun. This means exposing the API / Vitest UI is equivalent to giving script execution access.
On the browser mode side, there're readFile / writeFile / saveSnapshotFile. So exposing the browser mode is equivalent to giving file read / write access.

PoC

1. Run Vitest UI
2. Get the API token by curl http://localhost:51204/__vitest__/
3. Run curl "http://localhost:51204/__vitest_attachment__?path=C:\\path\\to\\project\\?\\..\\..\\secret.txt&contentType=text/plain&token=$TOKEN" (TOKEN is the API token)
4. curl shows the content of secret.txt that is outside the project directory

Mitigations

Vitest now ships two configuration flags, allowWrite and allowExec, that gate the privileged operations exploited by this vulnerability. Both are disabled by default whenever the API server is bound to a non-localhost host, ensuring that exposing the server to the network no longer implicitly grants write or execute capabilities to remote clients.

When these flags are disabled, the UI also enters a read-only mode: in-browser code editing and test file execution are turned off, removing the attack surface that allowed remote code execution. Many Browser Mode features are also disabled, like attachments, artifacts or snapshots. See browser.api.

Users who require the full interactive UI on a networked host must explicitly opt in by setting allowWrite and/or allowExec to true.

Severity

• CVSS Score: 9.8 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

• https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp
• https://nvd.nist.gov/vuln/detail/CVE-2026-47429
• https://github.com/vitest-dev/vitest/pull/10445
• https://github.com/vitest-dev/vitest/pull/9350
• https://github.com/vitest-dev/vitest/commit/20e00ef7808de6d330c5e2fda530f686e08f1c8d
• https://github.com/vitest-dev/vitest/commit/af88b1f5d82844a4761ea9a977156c98e2b14ca8
• https://github.com/vitest-dev/vitest
• https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/browser/src/node/commands/fs.ts#L10-L11
• https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/browser/src/node/plugin.ts#L194-L196
• https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/browser/src/node/rpc.ts#L115-L121
• https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/ui/node/index.ts#L77
• https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/vitest/src/api/setup.ts#L103-L105
• https://github.com/vitest-dev/vitest/blob/eb1abf08573032a532015b999ad3501c5e89e3bb/packages/vitest/src/api/setup.ts#L119-L121
• https://github.com/vitest-dev/vitest/releases/tag/v3.2.5
• https://github.com/vitest-dev/vitest/releases/tag/v4.1.0

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

vitest-dev/vitest (vitest)

v5.0.5

Compare Source

   🐞 Bug Fixes

• Keep vite default fs.deny with api token file  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11578 (28dc1)
• Handle quoted file names in --changed  -  by @​sheremet-va in #​11583 (14921)
• Add data to the import.meta.hot stub  -  by @​sheremet-va in #​11590 (3a828)
• Set skip in skipIf, ignore undefined options  -  by @​sheremet-va in #​11591 (d523a)
• Skip builtin loading in async leak detector  -  by @​sheremet-va in #​11598 (fe86a)
• Keep the import frame in native loader errors  -  by @​sheremet-va in #​11599 (9697b)
• Run hook cleanups when a later hook fails  -  by @​sheremet-va in #​11605 (6c5a4)
• Release mocks of finished test files  -  by @​sheremet-va in #​11607 (e9c3d)
• Abort all running tests on cancel  -  by @​sheremet-va in #​11606 (6621a)
• browser:
  • Ignore synthetic pagehide events  -  by @​sheremet-va in #​11582 (ca081)
  • Run plugin buildStart on server creation  -  by @​sheremet-va in #​11593 (ea611)
  • Drop late connections of closed sessions  -  by @​sheremet-va in #​11600 (f161e)
  • Wait 30s for the browser to close  -  by @​sheremet-va in #​11601 (6498b)
  • Run global setup once with instances  -  by @​sheremet-va in #​11596 (8dd67)
• reporter:
  • End reason &#​39;failed&#​39; on worker crash  -  by @​AriPerkkio in #​11568 (6ae8e)

    View changes on GitHub

v5.0.4

Compare Source

   🚀 Features

• experimental:
  • Tag cache directories with CACHEDIR.TAG  -  by @​lifeiscontent in #​11461 (a8ea3)
  • Support test.ui.theme option  -  by @​sheremet-va in #​11499 (1da66)
  • Highlight selector multiple matches in trace view  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11489 (5abba)
  • Print how many tests were affected and a total when running --changed  -  by @​sheremet-va in #​11424 (a2336)
  • Add an option to cache dependencies instead of statically parsing them  -  by @​sheremet-va in #​11515 (c0601)
  • Add fit and zoom controls to trace viewer  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11490 (f5dd9)

   🐞 Bug Fixes

• Fail the run on git and location filter errors  -  by @​sheremet-va in #​11430 (30d03)
• Enable fsModuleCache by default  -  by @​sheremet-va in #​11435 (ad208)
• Track project files and mocks with --changed  -  by @​sheremet-va in #​11432 (b0f2b)
• Refactor caching, fix : in project and change the shape of results cache  -  by @​sheremet-va in #​11453 (9673c)
• Keep full $ string values when taskTitleValueFormatTruncate is 0  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11485 (4f7e1)
• Resolve node builtins in client environments  -  by @​sheremet-va in #​11417 (56b31)
• Fix module graph builtin externals after #​11421  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11491 and #​11421 (008e1)
• Wrap module mocks during in-source testing  -  by @​sheremet-va in #​11505 (36d19)
• Handle line endings in snapshot  -  by @​sheremet-va in #​11522 (4c468)
• Respect root in projects  -  by @​sheremet-va in #​11521 (26642)
• Resolve mocks in directories with spaces  -  by @​sheremet-va in #​11539 (caaef)
• api:
  • Publish the api token atomically  -  by @​umairnawaz333 in #​11323 (6f990)
• browser:
  • Close the mock route interception race  -  by @​cplieger and @​sheremet-va in #​8339 and #​11083 (d6620)
  • Allow toHaveTextContent without arguments  -  by @​nomadical in #​11425 (8ebcf)
  • Apply API options without browser config  -  by @​sheremet-va in #​10852 (ad055)
  • Preserve undefined command arguments  -  by @​sheremet-va and @​AriPerkkio in #​11497 (1576d)
  • Wait for setup mocks before importing a test file  -  by @​kasperpeulen in #​11520 (b61d1)
  • Avoid extra scroll outside the iframe  -  by @​sheremet-va in #​11523 (662e8)
  • Run browser instances as workers  -  by @​sheremet-va in #​11525 (bf04b)
    • ⚠️ This can degrade performance if you have a custom maxWorkers setting. Previously, it was applied incorrectly and could lead to Vitest using too many resources. For example, a lower number would still open too many browsers. Fixing it means Vitest opens less instances by default now.
  • Open one cdp session per tester  -  by @​sheremet-va in #​11542 (69e63)
  • Clean up unmocked and pending mocks  -  by @​sheremet-va in #​11537 (5c955)
• coverage:
  • V8 browser memory leak between test files  -  by @​AriPerkkio in #​11466 (2297d)
  • allowExternal fails to include uncovered files  -  by @​AriPerkkio in #​11513 (4ef00)
  • Filenames containing brackets incorrectly showing as uncovered  -  by @​AriPerkkio in #​11531 (0fa80)
  • Istanbul coverage wrong when module transform warmups  -  by @​AriPerkkio in #​11529 (9f61d)
• deps:
  • Update all non-major dependencies  -  by @​sheremet-va in #​11167 (c74e0)
• expect:
  • Fix Map and Set deep equality in some assertions  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11402 (b4e79)
  • Check value in chai-style returned  -  by @​sheremet-va in #​11500 (1aca0)
• mocker:
  • Fix native loader mocking edge cases  -  by @​sheremet-va in #​11540 (cd423)
• pretty-format:
  • Support boxed symbols  -  by @​lehni in #​11445 and #​11446 (eba44)
• reporters:
  • Junit to strip ANSI sequences from all XML attributes  -  by @​meganemura and Claude Opus 5.5 in #​11407 (e1a73)
• runner:
  • Don't cache failed fixture setups  -  by @​hamed-bavar in #​11237 and #​11238 (4ee66)
• typecheck:
  • Use typescript pool in toTestSpecification  -  by @​sheremet-va in #​11451 (5f273)
• ui:
  • Remove duplicate browser-open call opening two tabs  -  by @​feastyr69 in #​11356 and #​11358 (d7e13)
  • Simplify explorer filtering + fix nested tests when search matches a suite  -  by @​hi-ogawa, Hiroshi Ogawa, Codex and Claude Opus 5.5 in #​11262 (a627b)
  • Store module graph once per environment  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11421 (af903)
  • Mount index.html handler on the ui base path  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11517 (1bc24)
  • Center split pane resize handle  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11506 (e658b)
• vm:
  • Bind this to module.exports  -  by @​sheremet-va in #​11504 (b618a)

   🏎 Performance

• Reuse fsModuleCache when filtering by source  -  by @​sheremet-va in #​11428 (7ebd9)
• spy: Reset only mocks that were called or reconfigured  -  by @​johan-gorter and Claude Opus 5.5 in #​11197 (28ef9)

    View changes on GitHub

v5.0.3

Compare Source

   🐞 Bug Fixes

• Isolate result.status between repeats runs  -  by @​hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in #​11218 (5dbeb)
• Don't print an interceptor warning in browser mode  -  by @​sheremet-va in #​11377 (15cc0)
• Don't retry when test.fails expectedly failed  -  by @​hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in #​11219 (b2458)
• Scope cache key generators to projects  -  by @​ecoyoung in #​11281 and #​11301 (92ba7)
• browser:
  • Delay server listen until tests start running  -  by @​sheremet-va in #​11366 (7d8ed)
  • Check mock path boundaries  -  by @​saryn17, Ryosei Sato and @​sheremet-va in #​11361 and #​11362 (1c388)
  • Keep config of browser-consumed environments  -  by @​kasperpeulen and Claude in #​11378 (aafc0)
  • Ignore page crash while cancelling  -  by @​sheremet-va in #​11386 (7c367)
  • toMatchScreenshot uses wrong reference on retried tests  -  by @​macarie in #​11393 (c22ab)
• cache:
  • Revalidate imports of cached modules  -  by @​sheremet-va in #​11381 (38f98)
• deps:
  • Pin why-is-node-running to 3.2.1 to avoid users running into ERR_PNPM_TRUST_DOWNGRADE  -  by @​AriPerkkio in #​11403 (f6c9a)
• expect:
  • Pass current equality testers to expect.extend asymmetric matchers  -  by @​hi-ogawa, Hiroshi Ogawa and Claude in #​11401 (3e794)
• jsdom:
  • Support Blob on jsdom 30.1  -  by @​sheremet-va in #​11379 (6c49b)
• pool:
  • Preserve unique pool ids when groupOrder is set  -  by @​mtorp in #​11392 (50312)
• ui:
  • Split-pane handle overlapping iframe  -  by @​macarie in #​11221 (f91db)
• vitest:
  • Remove root temp dir on close  -  by @​abhinav-phi in #​11248 (7c711)
• vm:
  • Do not optimize deps from index.html  -  by @​ezefernandezyf, Hiroshi Ogawa and Codex (GPT-6) in #​11329 and #​11360 (caf28)
  • Don't reuse scripts across vite environments  -  by @​MO2k4, Martin Oehlert and Claude in #​11395 (346d3)

    View changes on GitHub

v5.0.2

Compare Source

   🐞 Bug Fixes

• Bind process in case global is overwritten  -  by @​AriPerkkio in #​11343 (0b792)
• detect-async-leaks:
  • Ignore process.stdio handles  -  by @​AriPerkkio in #​11333 (0fd6b)
• expect:
  • Fix toMatchObject with asymmetric matchers  -  by @​ShreeBohara, Claude Opus 5, @​hi-ogawa, Hiroshi Ogawa and Codex (GPT-5) in #​11100 (42523)
• jsdom:
  • Fix Request with Blob body on jsdom 28+  -  by @​harshit-d3v in #​11295 (d1c3e)
• reporter:
  • agent to respect --silent  -  by @​Raj4478 and @​AriPerkkio in #​11271 (5b95e)
• reporters:
  • Handle concurrent createReport calls  -  by @​7rulnik in #​11278 (e8e55)
  • hanging-process to use ESM entrypoint  -  by @​AriPerkkio in #​11316 (4e91e)
• spy:
  • Fix stack overflow when spying Set.prototype.add  -  by @​fengmk2 in #​11299 (a0a93)
• ui:
  • Persist authentication cookie beyond current browser session  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in #​11066 (f8819)

    View changes on GitHub

v5.0.1

Compare Source

   🚀 Features

• ui:
  • Move trace attempts selector to viewer header  -  by @​hi-ogawa, Hiroshi Ogawa and Codex in #​11189 (5dc4b)
  • Add focused trace view layout mode  -  by @​hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and Codex in #​11190 (376dc)

   🐞 Bug Fixes

• Exit 1 when vitest list fails collection  -  by @​hamed-bavar in #​11145 and #​11146 (6108b)
• Keep parse error details in static collection  -  by @​hamed-bavar in #​11150 and #​11151 (7c818)
• Avoid recursive prototype in automocking  -  by @​sheremet-va in #​11195 (99fc5)
• Prevent false Vitest import resolution  -  by @​sheremet-va in #​11196 (b426c)
• Keep metadata file when clearing the cache  -  by @​sheremet-va in #​11199 (73614)
• Correct typos in error message and comments  -  by @​shinji00222 and Shinji in #​11187 (115c3)
• Resolve ResolvedConfig exactOptionalPropertyTypes errors  -  by @​LukeAbby in #​11175 (498fb)
• Share the server on self-referencing extends  -  by @​sheremet-va in #​11034 (23dda)
• Warn when deprecated deps.optimizer.web is used  -  by @​im10furry in #​11214 (2ce29)
• browser:
  • Avoid double quotes in config.define  -  by @​sheremet-va in #​11198 (972e2)
• doctor:
  • Measure vm pools for custom environments  -  by @​sheremet-va in #​11212 (91ab1)
• expect:
  • Correct return value in toMatchAriaSnapshot  -  by @​sheremet-va in #​11208 (c119b)
• fakeTimers:
  • Force queueMicrotask and nextTick in toNotFake  -  by @​kingmakeruix, kingmakeruix, Hiroshi Ogawa, Codex and @​hi-ogawa in #​11261 (a47d7)
• snapshot:
  • Report obsolete keys next to skipped tests  -  by @​hamed-bavar, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in #​11157 and #​11158 (17e2b)
• types:
  • Make public declarations self-contained  -  by @​ZoeySigel in #​11141 (45546)
• ui:
  • Fix collapse/expand suite with file name search  -  by @​hi-ogawa, Hiroshi Ogawa and Codex in #​11260 (0a712)
  • Fix explorer file summary count  -  by @​hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and Codex in #​11125 (05982)
• utils:
  • Fix deepMerge to handle prototype  -  by @​hi-ogawa, Hiroshi Ogawa and Codex in #​11215 (4944c)

    View changes on GitHub

v5.0.0

Compare Source

Vitest 5 is officially out! This release focuses on performance and brings a lot of new features while fixing long-standing bugs. See our blog post for the official announcement.

   🚨 Breaking Changes

• Replace loupe.inspect with pretty-format  -  by @​hi-ogawa, Claude Opus 5 (1M context) and OpenAI Codex in #​9609 (3f802)
• Remove quotes from string values in test.for/each title $ variable (take 2)  -  by @​hi-ogawa in #​10170 (04d37)
• Default attachmentsDir from .vitest-attachements/ to .vitest/attachments/  -  by @​MdSadiqMd in #​10186 (1ba73)
• Remove sequential test/suite options in favor of concurrent  -  by @​hi-ogawa and OpenAI Codex in #​10198 (9229f)
• Represent locator as an object instead of a string  -  by @​sheremet-va in #​10212 (80f07)
• Inline expect package  -  by @​sheremet-va in #​10221 (ad162)
• Remove deprecated entry points  -  by @​sheremet-va in #​10222 (994c6)
• Require Node.js 22 and Vite 6.4  -  by @​sheremet-va in #​10178 (38762)
• Fail expect.poll when function didn't resolve in time  -  by @​hi-ogawa and OpenAI Codex in #​10233 (4df04)
• Throw an error if hoistable methods are outside the top level scope  -  by @​sheremet-va in #​10460 (d0b4f)
• toHaveTextContent is strict, add toMatchTextContent as alternative  -  by @​sheremet-va in #​10473 (18f30)
• Don't lookup config file from ancestor directories  -  by @​hi-ogawa, OpenAI Codex and Hiroshi Ogawa in #​10428 (945d9)
• Inline @vitest/runner package, do not publish it anymore  -  by @​sheremet-va in #​10511 (6d6e4)
• Allow mutating happy-dom/jsdom window object  -  by @​hi-ogawa, Hiroshi Ogawa and OpenAI Codex in #​10373 (206e8)
• Expose concurrencyId/workerId on TestModule's diagnostics, make id 1-based  -  by @​sheremet-va in #​10516 (bdd98)
• Add screenshotDirectory config to browser.expect.toMatchScreenshot  -  by @​macarie in #​10592 (a60de)
• Update @sinonjs/fake-timers and support mocking Temporal  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in #​10654 (f8b15)
• Remove webdriverio package  -  by @​sheremet-va in #​10675 (5fed6)
• Clear mocks by default before each test  -  by @​sheremet-va in #​10613 (0f646)
• Don't emit localStorage warnings on Node 26, fail gracefully when worker fails to start  -  by @​sheremet-va in #​10293 (334ed)
• Separate config resolution from the server creation  -  by @​sheremet-va in #​10554 (1c0ec)
• Inline projects extend the root config by default  -  by @​sheremet-va in #​10750 (fec00)
• Enable mocking Temporal without fake timers  -  by @​fabon-f, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in #​10757 (ac2d4)
• Support nested projects  -  by @​sheremet-va in #​10846 (ec367)
• Use > as separator in -t, calculate only once  -  by @​sheremet-va in #​10686 (a0b20)
• Fail the test when an asynchronous assertion is not awaited  -  by @​sheremet-va in #​10868 (86d4a)
• Share the Vite server between inline projects  -  by @​sheremet-va in #​10848 (d87c9)
• Parse files statically in vitest list by default  -  by @​sheremet-va in #​11088 (51e94)
• benchmark:
  • Rewrite the public API  -  by @​sheremet-va in #​10113 (19f6e)
• browser:
  • Iframe scale  -  by @​macarie in #​9745 (b6398)
  • Enable locators.exact by default  -  by @​sheremet-va in #​10430 (e2032)
  • Require sessionId for orchestrator html request  -  by @​hi-ogawa, Hiroshi Ogawa and OpenAI Codex in #​10522 (79b7d)
  • Save failure screenshots in attachmentsDir  -  by @​macarie in #​10917 (3b5bb)
• coverage:
  • include/exclude globs too eager  -  by @​AriPerkkio in #​9818 (edacb)
  • Allow thresholds.perFile to accept an object  -  by @​vladlenskiy and @​AriPerkkio in #​10190 (13b78)
• expect:
  • Fix toThrow("") behavior by reverting #​6710  -  by @​hi-ogawa in #​9643 and #​6710 (6c3e4)
• mocker:
  • Deserialize automock as automock  -  by @​nami8824 in #​10192 (2f892)
• reporters:
  • blob reporter and --merge-reports default to .vitest/blob/  -  by @​AriPerkkio in #​10232 (d22b0)
  • Write json and junit reporter output files to .vitest by default  -  by @​hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and @​AriPerkkio in #​10621 (58577)
• spy:
  • Preserve class mock prototype methods on instances  -  by @​sheremet-va in #​10910 (6093d)
• types:
  • Add better promise support in expects and matchers  -  by @​samchungy and @​sheremet-va in #​8266 (41f55)
• ui:
  • Harden UI API access  -  by @​hi-ogawa, Hiroshi Ogawa and OpenAI Codex in #​10583 (4c26d)
  • Change html reporter default output to .vitest  -  by @​hi-ogawa and Hiroshi Ogawa in #​10620 (29c36)

   🚀 Features

• Add createReport and .vitest report directory convention  -  by @​AriPerkkio in #​9993 [(72a6d)](https://redirect.g

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.