fix: bump eval fixture vitest past the CVE-2026-47429 range

[tjoignant]

What

Bumps the vitest pin from ^1.6.0 to ^3.2.6 in the three bmad-project-context eval fixtures (fixture-standalone, fixture-refresh, fixture-brownfield).

Why

vitest < 3.2.6 carries CVE-2026-47429 (critical, arbitrary file read/execute via the Vitest UI server). The fixtures are inert eval inputs and are never installed, so there is no real exposure — but GitHubs dependency graph parses every package.json on the default branch. In any repo that installs BMad into .claude/skills/, these three files show up as three open critical Dependabot alerts, sitting on top of that repos genuine findings.

Downstream cannot fix this locally: .claude/skills/ is installer-managed, so a hand-bumped pin is overwritten on the next bmm refresh. I bumped it twice in my own repo and the installer reverted it both times.

How

• Three one-line pin changes, nothing else.
• ^3.2.6 rather than ^4.x — the minimum that clears the advisory, and it keeps the wavecart fixtures slightly-behind-a-real-project character.
• The lockfile stub in fixture-brownfield is deliberately left alone.

Testing

evals/cases.json asserts on the test command (vitest), never a version, so no expectation changes. Grepped the eval tree to confirm 1.6 appears nowhere else.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 0824452c-f1ed-4375-9533-d013ff8916ac

📥 Commits

Reviewing files that changed from the base of the PR and between 05e295f and 1cb396a.

📒 Files selected for processing (3)

• src/bmm-skills/plan/bmad-project-context/evals/files/fixture-brownfield/package.json
• src/bmm-skills/plan/bmad-project-context/evals/files/fixture-refresh/package.json
• src/bmm-skills/plan/bmad-project-context/evals/files/fixture-standalone/package.json

---

📝 Walkthrough

Walkthrough

The three bmad-project-context evaluation fixtures upgrade their vitest development dependency from ^1.6.0 to ^3.2.6.

Changes

Vitest fixture updates

Layer / File(s)	Summary
Update fixture Vitest versions src/bmm-skills/plan/bmad-project-context/evals/files/fixture-*/package.json	The brownfield, refresh, and standalone fixtures now specify Vitest ^3.2.6.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• bmad-code-org/BMAD-METHOD#2674: Modifies the same evaluation fixture package.json files.

Suggested reviewers: bmadcode

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the Vitest dependency update and its purpose of addressing CVE-2026-47429.
Description check	✅ Passed	The description accurately explains the affected fixtures, security rationale, scope, and testing performed.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

Updates the Vitest development-dependency constraint from ^1.6.0 to ^3.2.6 in three static project-context evaluation fixtures.

• Moves all three fixture manifests beyond the affected CVE range.
• Preserves the existing package scripts and fixture structure.
• Leaves the intentionally minimal brownfield lockfile stub unchanged.

Confidence Score: 5/5

The PR appears safe to merge because the dependency changes occur only in static eval inputs and do not alter an installed or executed dependency path.

The evaluation flow reads these manifests as project context and checks the Vitest command or framework identity rather than resolving or executing the declared version, so the three version updates preserve existing behavior.

Important Files Changed

Filename	Overview
src/bmm-skills/plan/bmad-project-context/evals/files/fixture-brownfield/package.json	Safely updates the inert brownfield fixture’s Vitest constraint without affecting its evaluation contract.
src/bmm-skills/plan/bmad-project-context/evals/files/fixture-refresh/package.json	Safely updates the inert refresh fixture’s Vitest constraint beyond the vulnerable range.
src/bmm-skills/plan/bmad-project-context/evals/files/fixture-standalone/package.json	Safely updates the inert standalone fixture’s Vitest constraint beyond the vulnerable range.

_{Reviews (1): Last reviewed commit: "fix: bump eval fixture vitest past the C..." | Re-trigger Greptile}