happy-dom 14.12.3 vulnerabilities

[Nick-Minutello]

npm ls --all is showing that vitest (latest:3.0.5) is bringing in happy-dom 14.12.3 (which has some critical vulnerabilities).
(That said, I don't actually see happy-dom in the package.json.)

If indeed vitest is using happy-dom, can it be upgraded ?

[sheremet-va]

Vitest doesn't specify happy-dom in dependencies, only in peerDependencies. We also don't specify the version, so you can use any version.

[Nick-Minutello]

Thanks!
(How are the peerDependencies specified/derived?)

[sheremet-va]

peer dependencies are dependencies that are not required for the package to work, but the consumer can install them to unlock a certain functionality

peer dependencies are specified here:

vitest/packages/vitest/package.json

Line 124 in 01b91b5

"peerDependencies": {