URGENT: Fix security bug Vitest 2.1.4 [Vulnerability CVE-2025-24964]

[MedAkramYoussef]

Hello,

I wanted to fix a security bug in Vitest, but I couldn't open an issue.
So, the problem is that the Vitest version used in the package is 2.1.4, which contains a vulnerability reported in GHSA-9crc-q9x8-hgqq .
The solution is to upgrade to version >=2.1.9,<3.0.0 by changing the configuration in package.json.
I hope I haven't missed anything.

Thanks,

[bakerkretzmar]

Thanks, updated.

[MedAkramYoussef]

Thank you for this fix. But there's no Tag or Release, it was just fixed in the branch 2.x.

[bakerkretzmar]

Yeah vitest is just a dev dependency so it's not installed when people install Ziggy, I don't think we need a release because for end users nothing changes right.

[MedAkramYoussef]

But when I use dependency check on a laravel project, even it's in vendor I still get package vulnerability.

[bakerkretzmar]

Not sure what dependency check you're doing but vitest doesn't get installed when you install Ziggy so you're fine.