diff --git a/package.json b/package.json
index f16f77182485..e1ae78549d81 100644
--- a/package.json
+++ b/package.json
@@ -62,7 +62,7 @@
     "tinyglobby": "^0.2.10",
     "tsx": "^4.19.2",
     "typescript": "^5.7.3",
-    "vite": "^5.4.0",
+    "vite": "^5.4.14",
     "vitest": "workspace:*",
     "zx": "^8.3.0"
   },
diff --git a/packages/browser/src/client/client.ts b/packages/browser/src/client/client.ts
index 34fff8aea11b..8091874082b4 100644
--- a/packages/browser/src/client/client.ts
+++ b/packages/browser/src/client/client.ts
@@ -15,7 +15,7 @@ export const RPC_ID
 const METHOD = getBrowserState().method
 export const ENTRY_URL = `${
   location.protocol === 'https:' ? 'wss:' : 'ws:'
-}//${HOST}/__vitest_browser_api__?type=${PAGE_TYPE}&rpcId=${RPC_ID}&sessionId=${getBrowserState().sessionId}&projectName=${getBrowserState().config.name || ''}&method=${METHOD}`
+}//${HOST}/__vitest_browser_api__?type=${PAGE_TYPE}&rpcId=${RPC_ID}&sessionId=${getBrowserState().sessionId}&projectName=${getBrowserState().config.name || ''}&method=${METHOD}&token=${(window as any).VITEST_API_TOKEN}`
 
 let setCancel = (_: CancelReason) => {}
 export const onCancel = new Promise<CancelReason>((resolve) => {
diff --git a/packages/browser/src/client/public/esm-client-injector.js b/packages/browser/src/client/public/esm-client-injector.js
index 23d931e2165b..394baa032a4e 100644
--- a/packages/browser/src/client/public/esm-client-injector.js
+++ b/packages/browser/src/client/public/esm-client-injector.js
@@ -30,6 +30,7 @@
     method: { __VITEST_METHOD__ },
     providedContext: { __VITEST_PROVIDED_CONTEXT__ },
   };
+  window.VITEST_API_TOKEN = { __VITEST_API_TOKEN__ };
 
   const config = __vitest_browser_runner__.config;
 
diff --git a/packages/browser/src/node/rpc.ts b/packages/browser/src/node/rpc.ts
index 75cf0f779d94..7c80b3862e05 100644
--- a/packages/browser/src/node/rpc.ts
+++ b/packages/browser/src/node/rpc.ts
@@ -10,7 +10,7 @@ import { ServerMockResolver } from '@vitest/mocker/node'
 import { createBirpc } from 'birpc'
 import { parse, stringify } from 'flatted'
 import { dirname } from 'pathe'
-import { createDebugger, isFileServingAllowed } from 'vitest/node'
+import { createDebugger, isFileServingAllowed, isValidApiRequest } from 'vitest/node'
 import { WebSocketServer } from 'ws'
 
 const debug = createDebugger('vitest:browser:api')
@@ -33,6 +33,11 @@ export function setupBrowserRpc(globalServer: ParentBrowserProject) {
       return
     }
 
+    if (!isValidApiRequest(vitest.config, request)) {
+      socket.destroy()
+      return
+    }
+
     const type = searchParams.get('type')
     const rpcId = searchParams.get('rpcId')
     const sessionId = searchParams.get('sessionId')
diff --git a/packages/browser/src/node/serverOrchestrator.ts b/packages/browser/src/node/serverOrchestrator.ts
index b853e9386e21..d265675864bf 100644
--- a/packages/browser/src/node/serverOrchestrator.ts
+++ b/packages/browser/src/node/serverOrchestrator.ts
@@ -42,6 +42,7 @@ export async function resolveOrchestrator(
     __VITEST_SESSION_ID__: JSON.stringify(sessionId),
     __VITEST_TESTER_ID__: '"none"',
     __VITEST_PROVIDED_CONTEXT__: '{}',
+    __VITEST_API_TOKEN__: JSON.stringify(globalServer.vitest.config.api.token),
   })
 
   // disable CSP for the orchestrator as we are the ones controlling it
diff --git a/packages/browser/src/node/serverTester.ts b/packages/browser/src/node/serverTester.ts
index c6d2687c25c8..c70d91e17ad2 100644
--- a/packages/browser/src/node/serverTester.ts
+++ b/packages/browser/src/node/serverTester.ts
@@ -68,6 +68,7 @@ export async function resolveTester(
     __VITEST_SESSION_ID__: JSON.stringify(sessionId),
     __VITEST_TESTER_ID__: JSON.stringify(crypto.randomUUID()),
     __VITEST_PROVIDED_CONTEXT__: JSON.stringify(stringify(project.getProvidedContext())),
+    __VITEST_API_TOKEN__: JSON.stringify(globalServer.vitest.config.api.token),
   })
 
   const testerHtml = typeof browserProject.testerHtml === 'string'
diff --git a/packages/ui/client/constants.ts b/packages/ui/client/constants.ts
index 2c3607fda3e3..582860c23f98 100644
--- a/packages/ui/client/constants.ts
+++ b/packages/ui/client/constants.ts
@@ -4,6 +4,6 @@ export const PORT = import.meta.hot && !browserState ? '51204' : location.port
 export const HOST = [location.hostname, PORT].filter(Boolean).join(':')
 export const ENTRY_URL = `${
   location.protocol === 'https:' ? 'wss:' : 'ws:'
-}//${HOST}/__vitest_api__`
+}//${HOST}/__vitest_api__?token=${(window as any).VITEST_API_TOKEN}`
 export const isReport = !!window.METADATA_PATH
 export const BASE_PATH = isReport ? import.meta.env.BASE_URL : __BASE_PATH__
diff --git a/packages/ui/node/index.ts b/packages/ui/node/index.ts
index 69827c6c3a8f..2e9e0146e20e 100644
--- a/packages/ui/node/index.ts
+++ b/packages/ui/node/index.ts
@@ -1,5 +1,6 @@
 import type { Plugin } from 'vite'
 import type { Vitest } from 'vitest/node'
+import fs from 'node:fs'
 import { fileURLToPath } from 'node:url'
 import { toArray } from '@vitest/utils'
 import { basename, resolve } from 'pathe'
@@ -52,6 +53,28 @@ export default (ctx: Vitest): Plugin => {
         }
 
         const clientDist = resolve(fileURLToPath(import.meta.url), '../client')
+        const clientIndexHtml = fs.readFileSync(resolve(clientDist, 'index.html'), 'utf-8')
+
+        // serve index.html with api token
+        // eslint-disable-next-line prefer-arrow-callback
+        server.middlewares.use(function vitestUiHtmlMiddleware(req, res, next) {
+          if (req.url) {
+            const url = new URL(req.url, 'http://localhost')
+            if (url.pathname === base) {
+              const html = clientIndexHtml.replace(
+                '<!-- !LOAD_METADATA! -->',
+                `<script>window.VITEST_API_TOKEN = ${JSON.stringify(ctx.config.api.token)}</script>`,
+              )
+              res.setHeader('Cache-Control', 'no-cache, max-age=0, must-revalidate')
+              res.setHeader('Content-Type', 'text/html; charset=utf-8')
+              res.write(html)
+              res.end()
+              return
+            }
+          }
+          next()
+        })
+
         server.middlewares.use(
           base,
           sirv(clientDist, {
diff --git a/packages/vitest/rollup.config.js b/packages/vitest/rollup.config.js
index 5218a10769e0..8221b4cda508 100644
--- a/packages/vitest/rollup.config.js
+++ b/packages/vitest/rollup.config.js
@@ -72,6 +72,7 @@ const external = [
   'node:os',
   'node:stream',
   'node:vm',
+  'node:http',
   'inspector',
   'vite-node/source-map',
   'vite-node/client',
diff --git a/packages/vitest/src/api/check.ts b/packages/vitest/src/api/check.ts
new file mode 100644
index 000000000000..13eb5bfcc6ad
--- /dev/null
+++ b/packages/vitest/src/api/check.ts
@@ -0,0 +1,22 @@
+import type { IncomingMessage } from 'node:http'
+import type { ResolvedConfig } from '../node/types/config'
+import crypto from 'node:crypto'
+
+export function isValidApiRequest(config: ResolvedConfig, req: IncomingMessage): boolean {
+  const url = new URL(req.url ?? '', 'http://localhost')
+
+  // validate token. token is injected in ui/tester/orchestrator html, which is cross origin proteced.
+  try {
+    const token = url.searchParams.get('token')
+    if (token && crypto.timingSafeEqual(
+      Buffer.from(token),
+      Buffer.from(config.api.token),
+    )) {
+      return true
+    }
+  }
+  // an error is thrown when the length is incorrect
+  catch {}
+
+  return false
+}
diff --git a/packages/vitest/src/api/setup.ts b/packages/vitest/src/api/setup.ts
index addd52af2791..903dcfad653b 100644
--- a/packages/vitest/src/api/setup.ts
+++ b/packages/vitest/src/api/setup.ts
@@ -1,5 +1,6 @@
 import type { File, TaskResultPack } from '@vitest/runner'
 
+import type { IncomingMessage } from 'node:http'
 import type { ViteDevServer } from 'vite'
 import type { WebSocket } from 'ws'
 import type { Vitest } from '../node/core'
@@ -21,6 +22,7 @@ import { API_PATH } from '../constants'
 import { getModuleGraph } from '../utils/graph'
 import { stringifyReplace } from '../utils/serialization'
 import { parseErrorStacktrace } from '../utils/source-map'
+import { isValidApiRequest } from './check'
 
 export function setup(ctx: Vitest, _server?: ViteDevServer) {
   const wss = new WebSocketServer({ noServer: true })
@@ -29,7 +31,7 @@ export function setup(ctx: Vitest, _server?: ViteDevServer) {
 
   const server = _server || ctx.server
 
-  server.httpServer?.on('upgrade', (request, socket, head) => {
+  server.httpServer?.on('upgrade', (request: IncomingMessage, socket, head) => {
     if (!request.url) {
       return
     }
@@ -39,6 +41,11 @@ export function setup(ctx: Vitest, _server?: ViteDevServer) {
       return
     }
 
+    if (!isValidApiRequest(ctx.config, request)) {
+      socket.destroy()
+      return
+    }
+
     wss.handleUpgrade(request, socket, head, (ws) => {
       wss.emit('connection', ws, request)
       setupClient(ws)
diff --git a/packages/vitest/src/node/config/resolveConfig.ts b/packages/vitest/src/node/config/resolveConfig.ts
index a72f44261dc6..7b904342f32c 100644
--- a/packages/vitest/src/node/config/resolveConfig.ts
+++ b/packages/vitest/src/node/config/resolveConfig.ts
@@ -9,6 +9,7 @@ import type {
 } from '../types/config'
 import type { BaseCoverageOptions, CoverageReporterWithOptions } from '../types/coverage'
 import type { BuiltinPool, ForksOptions, PoolOptions, ThreadsOptions } from '../types/pool-options'
+import crypto from 'node:crypto'
 import { toArray } from '@vitest/utils'
 import { resolveModule } from 'local-pkg'
 import { normalize, relative, resolve } from 'pathe'
@@ -629,7 +630,8 @@ export function resolveConfig(
   }
 
   // the server has been created, we don't need to override vite.server options
-  resolved.api = resolveApiServerConfig(options, defaultPort)
+  const api = resolveApiServerConfig(options, defaultPort)
+  resolved.api = { ...api, token: crypto.randomUUID() }
 
   if (options.related) {
     resolved.related = toArray(options.related).map(file =>
diff --git a/packages/vitest/src/node/types/config.ts b/packages/vitest/src/node/types/config.ts
index 0f556b99fce2..5db3cee7c295 100644
--- a/packages/vitest/src/node/types/config.ts
+++ b/packages/vitest/src/node/types/config.ts
@@ -1013,7 +1013,7 @@ export interface ResolvedConfig
 
   defines: Record<string, any>
 
-  api?: ApiConfig
+  api: ApiConfig & { token: string }
   cliExclude?: string[]
 
   benchmark?: Required<
diff --git a/packages/vitest/src/public/node.ts b/packages/vitest/src/public/node.ts
index a0031b64801d..416128d66aaf 100644
--- a/packages/vitest/src/public/node.ts
+++ b/packages/vitest/src/public/node.ts
@@ -5,6 +5,7 @@ import { TestModule as _TestFile } from '../node/reporters/reported-tasks'
 
 export const version = Vitest.version
 
+export { isValidApiRequest } from '../api/check'
 export { parseCLI } from '../node/cli/cac'
 export type { CliParseOptions } from '../node/cli/cac'
 export { startVitest } from '../node/cli/cli-api'
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 213419c68faf..fdce081cae53 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -10,7 +10,7 @@ overrides:
   acorn: 8.11.3
   mlly: ^1.7.4
   rollup: ^4.30.1
-  vite: ^5.4.0
+  vite: ^5.4.14
   vitest: workspace:*
 
 patchedDependencies:
@@ -116,8 +116,8 @@ importers:
         specifier: ^5.7.3
         version: 5.7.3
       vite:
-        specifier: ^5.4.0
-        version: 5.4.0(@types/node@22.10.7)(terser@5.36.0)
+        specifier: ^5.4.14
+        version: 5.4.14(@types/node@22.10.7)(terser@5.36.0)
       vitest:
         specifier: workspace:*
         version: link:packages/vitest
@@ -154,10 +154,10 @@ importers:
         version: 0.2.6
       '@vite-pwa/vitepress':
         specifier: ^0.5.3
-        version: 0.5.3(@vite-pwa/assets-generator@0.2.6)(vite-plugin-pwa@0.21.1(@vite-pwa/assets-generator@0.2.6)(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))(workbox-build@7.1.0(@types/babel__core@7.20.5))(workbox-window@7.3.0))
+        version: 0.5.3(@vite-pwa/assets-generator@0.2.6)(vite-plugin-pwa@0.21.1(@vite-pwa/assets-generator@0.2.6)(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))(workbox-build@7.1.0(@types/babel__core@7.20.5))(workbox-window@7.3.0))
       '@vitejs/plugin-vue':
         specifier: ^5.2.1
-        version: 5.2.1(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))(vue@3.5.12(typescript@5.7.3))
+        version: 5.2.1(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))(vue@3.5.12(typescript@5.7.3))
       https-localhost:
         specifier: ^4.7.1
         version: 4.7.1
@@ -166,16 +166,16 @@ importers:
         version: 0.2.10
       unocss:
         specifier: ^0.65.4
-        version: 0.65.4(postcss@8.4.49)(rollup@4.30.1)(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))(vue@3.5.12(typescript@5.7.3))
+        version: 0.65.4(postcss@8.4.49)(rollup@4.30.1)(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))(vue@3.5.12(typescript@5.7.3))
       unplugin-vue-components:
         specifier: ^0.28.0
         version: 0.28.0(@babel/parser@7.26.2)(rollup@4.30.1)(vue@3.5.12(typescript@5.7.3))
       vite:
-        specifier: ^5.4.0
-        version: 5.4.0(@types/node@22.10.7)(terser@5.36.0)
+        specifier: ^5.4.14
+        version: 5.4.14(@types/node@22.10.7)(terser@5.36.0)
       vite-plugin-pwa:
         specifier: ^0.21.1
-        version: 0.21.1(@vite-pwa/assets-generator@0.2.6)(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))(workbox-build@7.1.0(@types/babel__core@7.20.5))(workbox-window@7.3.0)
+        version: 0.21.1(@vite-pwa/assets-generator@0.2.6)(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))(workbox-build@7.1.0(@types/babel__core@7.20.5))(workbox-window@7.3.0)
       vitepress:
         specifier: ^1.5.0
         version: 1.5.0(@algolia/client-search@4.20.0)(@types/node@22.10.7)(@types/react@18.2.79)(postcss@8.4.49)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(search-insights@2.9.0)(terser@5.36.0)(typescript@5.7.3)
@@ -195,8 +195,8 @@ importers:
         specifier: workspace:*
         version: link:../../packages/ui
       vite:
-        specifier: ^5.4.0
-        version: 5.4.0(@types/node@22.10.7)(terser@5.36.0)
+        specifier: ^5.4.14
+        version: 5.4.14(@types/node@22.10.7)(terser@5.36.0)
       vitest:
         specifier: workspace:*
         version: link:../../packages/vitest
@@ -216,8 +216,8 @@ importers:
         specifier: ^4.7.2
         version: 4.7.2
       vite:
-        specifier: ^5.4.0
-        version: 5.4.0(@types/node@22.10.7)(terser@5.36.0)
+        specifier: ^5.4.14
+        version: 5.4.14(@types/node@22.10.7)(terser@5.36.0)
       vitest:
         specifier: workspace:*
         version: link:../../packages/vitest
@@ -247,8 +247,8 @@ importers:
         specifier: ^1.49.0
         version: 1.49.0
       vite:
-        specifier: ^5.4.0
-        version: 5.4.0(@types/node@22.10.7)(terser@5.36.0)
+        specifier: ^5.4.14
+        version: 5.4.14(@types/node@22.10.7)(terser@5.36.0)
       vitest:
         specifier: workspace:*
         version: link:../../packages/vitest
@@ -256,8 +256,8 @@ importers:
   examples/profiling:
     devDependencies:
       vite:
-        specifier: ^5.4.0
-        version: 5.4.0(@types/node@22.10.7)(terser@5.36.0)
+        specifier: ^5.4.14
+        version: 5.4.14(@types/node@22.10.7)(terser@5.36.0)
       vitest:
         specifier: workspace:*
         version: link:../../packages/vitest
@@ -266,10 +266,10 @@ importers:
     devDependencies:
       '@sveltejs/adapter-auto':
         specifier: ^2.1.0
-        version: 2.1.0(@sveltejs/kit@1.20.2(svelte@3.59.1)(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0)))
+        version: 2.1.0(@sveltejs/kit@1.20.2(svelte@3.59.1)(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0)))
       '@sveltejs/kit':
         specifier: ^1.20.2
-        version: 1.20.2(svelte@3.59.1)(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))
+        version: 1.20.2(svelte@3.59.1)(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))
       svelte:
         specifier: ^3.59.1
         version: 3.59.1
@@ -283,8 +283,8 @@ importers:
         specifier: ^5.2.2
         version: 5.2.2
       vite:
-        specifier: ^5.4.0
-        version: 5.4.0(@types/node@22.10.7)(terser@5.36.0)
+        specifier: ^5.4.14
+        version: 5.4.14(@types/node@22.10.7)(terser@5.36.0)
       vitest:
         specifier: workspace:*
         version: link:../../packages/vitest
@@ -301,8 +301,8 @@ importers:
         specifier: ^5.2.2
         version: 5.2.2
       vite:
-        specifier: ^5.4.0
-        version: 5.4.0(@types/node@20.11.5)(terser@5.36.0)
+        specifier: ^5.4.14
+        version: 5.4.14(@types/node@20.11.5)(terser@5.36.0)
       vitest:
         specifier: workspace:*
         version: link:../../packages/vitest
@@ -323,7 +323,7 @@ importers:
         version: 18.2.79
       '@vitejs/plugin-react':
         specifier: ^4.2.1
-        version: 4.2.1(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))
+        version: 4.2.1(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))
       '@vitest/ui':
         specifier: workspace:*
         version: link:../../packages/ui
@@ -343,8 +343,8 @@ importers:
         specifier: ^4.7.2
         version: 4.7.2
       vite:
-        specifier: ^5.4.0
-        version: 5.4.0(@types/node@22.10.7)(terser@5.36.0)
+        specifier: ^5.4.14
+        version: 5.4.14(@types/node@22.10.7)(terser@5.36.0)
       vitest:
         specifier: workspace:*
         version: link:../../packages/vitest
@@ -618,8 +618,8 @@ importers:
         specifier: ^2.0.1
         version: 2.0.1
       vite:
-        specifier: ^5.4.0
-        version: 5.4.0(@types/node@22.10.7)(terser@5.36.0)
+        specifier: ^5.4.14
+        version: 5.4.14(@types/node@22.10.7)(terser@5.36.0)
 
   packages/pretty-format:
     dependencies:
@@ -730,7 +730,7 @@ importers:
         version: 0.65.4
       '@vitejs/plugin-vue':
         specifier: ^5.2.1
-        version: 5.2.1(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))(vue@3.5.12(typescript@5.7.3))
+        version: 5.2.1(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))(vue@3.5.12(typescript@5.7.3))
       '@vitest/runner':
         specifier: workspace:*
         version: link:../runner
@@ -769,7 +769,7 @@ importers:
         version: 3.1.8(vue@3.5.12(typescript@5.7.3))
       unocss:
         specifier: ^0.65.4
-        version: 0.65.4(postcss@8.4.49)(rollup@4.30.1)(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))(vue@3.5.12(typescript@5.7.3))
+        version: 0.65.4(postcss@8.4.49)(rollup@4.30.1)(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))(vue@3.5.12(typescript@5.7.3))
       unplugin-auto-import:
         specifier: ^0.19.0
         version: 0.19.0(@vueuse/core@12.4.0(typescript@5.7.3))(rollup@4.30.1)
@@ -777,11 +777,11 @@ importers:
         specifier: ^0.28.0
         version: 0.28.0(@babel/parser@7.26.2)(rollup@4.30.1)(vue@3.5.12(typescript@5.7.3))
       vite:
-        specifier: ^5.4.0
-        version: 5.4.0(@types/node@22.10.7)(terser@5.36.0)
+        specifier: ^5.4.14
+        version: 5.4.14(@types/node@22.10.7)(terser@5.36.0)
       vite-plugin-pages:
         specifier: ^0.32.4
-        version: 0.32.4(@vue/compiler-sfc@3.5.13)(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))(vue-router@4.5.0(vue@3.5.12(typescript@5.7.3)))
+        version: 0.32.4(@vue/compiler-sfc@3.5.13)(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))(vue-router@4.5.0(vue@3.5.12(typescript@5.7.3)))
       vue:
         specifier: ^3.5.12
         version: 3.5.12(typescript@5.7.3)
@@ -832,8 +832,8 @@ importers:
         specifier: ^2.0.1
         version: 2.0.1
       vite:
-        specifier: ^5.4.0
-        version: 5.4.0(@types/node@22.10.7)(terser@5.36.0)
+        specifier: ^5.4.14
+        version: 5.4.14(@types/node@22.10.7)(terser@5.36.0)
     devDependencies:
       '@jridgewell/trace-mapping':
         specifier: ^0.3.25
@@ -905,8 +905,8 @@ importers:
         specifier: ^2.0.0
         version: 2.0.0
       vite:
-        specifier: ^5.4.0
-        version: 5.4.0(@types/node@22.10.7)(terser@5.36.0)
+        specifier: ^5.4.14
+        version: 5.4.14(@types/node@22.10.7)(terser@5.36.0)
       vite-node:
         specifier: workspace:*
         version: link:../vite-node
@@ -1053,7 +1053,7 @@ importers:
         version: 18.2.79
       '@vitejs/plugin-basic-ssl':
         specifier: ^1.0.2
-        version: 1.0.2(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))
+        version: 1.0.2(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))
       '@vitest/browser':
         specifier: workspace:*
         version: link:../../packages/browser
@@ -1098,7 +1098,7 @@ importers:
         version: 8.5.9
       '@vitejs/plugin-basic-ssl':
         specifier: ^1.0.2
-        version: 1.0.2(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))
+        version: 1.0.2(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))
       '@vitest/runner':
         specifier: workspace:^
         version: link:../../packages/runner
@@ -1112,8 +1112,8 @@ importers:
         specifier: ^1.4.4
         version: 1.4.4(@swc/core@1.4.1)(rollup@4.30.1)
       vite:
-        specifier: ^5.4.0
-        version: 5.4.0(@types/node@22.10.7)(terser@5.36.0)
+        specifier: ^5.4.14
+        version: 5.4.14(@types/node@22.10.7)(terser@5.36.0)
       vitest:
         specifier: workspace:*
         version: link:../../packages/vitest
@@ -1127,8 +1127,8 @@ importers:
         specifier: ^0.3.2
         version: 0.3.2
       vite:
-        specifier: ^5.4.0
-        version: 5.4.0(@types/node@22.10.7)(terser@5.36.0)
+        specifier: ^5.4.14
+        version: 5.4.14(@types/node@22.10.7)(terser@5.36.0)
       vitest:
         specifier: workspace:*
         version: link:../../packages/vitest
@@ -1230,7 +1230,7 @@ importers:
         version: 3.0.3
       '@vitejs/plugin-vue':
         specifier: latest
-        version: 5.2.1(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))(vue@3.5.12(typescript@5.7.3))
+        version: 5.2.1(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))(vue@3.5.12(typescript@5.7.3))
       '@vitest/browser':
         specifier: workspace:*
         version: link:../../packages/browser
@@ -1262,8 +1262,8 @@ importers:
         specifier: ^1.4.4
         version: 1.4.4(@swc/core@1.4.1)(rollup@4.30.1)
       vite:
-        specifier: ^5.4.0
-        version: 5.4.0(@types/node@22.10.7)(terser@5.36.0)
+        specifier: ^5.4.14
+        version: 5.4.14(@types/node@22.10.7)(terser@5.36.0)
       vitest:
         specifier: workspace:*
         version: link:../../packages/vitest
@@ -1358,8 +1358,8 @@ importers:
         specifier: ^2.0.0
         version: 2.0.0
       vite:
-        specifier: ^5.4.0
-        version: 5.4.0(@types/node@22.10.7)(terser@5.36.0)
+        specifier: ^5.4.14
+        version: 5.4.14(@types/node@22.10.7)(terser@5.36.0)
       vite-node:
         specifier: workspace:*
         version: link:../../packages/vite-node
@@ -1416,8 +1416,8 @@ importers:
         specifier: workspace:*
         version: link:../../packages/browser
       vite:
-        specifier: ^5.4.0
-        version: 5.4.0(@types/node@22.10.7)(terser@5.36.0)
+        specifier: ^5.4.14
+        version: 5.4.14(@types/node@22.10.7)(terser@5.36.0)
       vitest:
         specifier: workspace:*
         version: link:../../packages/vitest
@@ -3508,7 +3508,7 @@ packages:
     hasBin: true
     peerDependencies:
       svelte: ^3.54.0 || ^4.0.0-next.0
-      vite: ^5.4.0
+      vite: ^5.4.14
 
   '@sveltejs/vite-plugin-svelte-inspector@1.0.4':
     resolution: {integrity: sha512-zjiuZ3yydBtwpF3bj0kQNV0YXe+iKE545QGZVTaylW3eAzFr+pJ/cwK8lZEaRp4JtaJXhD5DyWAV4AxLh6DgaQ==}
@@ -3516,14 +3516,14 @@ packages:
     peerDependencies:
       '@sveltejs/vite-plugin-svelte': ^2.2.0
       svelte: ^3.54.0 || ^4.0.0
-      vite: ^5.4.0
+      vite: ^5.4.14
 
   '@sveltejs/vite-plugin-svelte@2.4.6':
     resolution: {integrity: sha512-zO79p0+DZnXPnF0ltIigWDx/ux7Ni+HRaFOw720Qeivc1azFUrJxTl0OryXVibYNx1hCboGia1NRV3x8RNv4cA==}
     engines: {node: ^14.18.0 || >= 16}
     peerDependencies:
       svelte: ^3.54.0 || ^4.0.0
-      vite: ^5.4.0
+      vite: ^5.4.14
 
   '@swc/core-darwin-arm64@1.4.1':
     resolution: {integrity: sha512-ePyfx0348UbR4DOAW24TedeJbafnzha8liXFGuQ4bdXtEVXhLfPngprrxKrAddCuv42F9aTxydlF6+adD3FBhA==}
@@ -3993,7 +3993,7 @@ packages:
   '@unocss/astro@0.65.4':
     resolution: {integrity: sha512-ex1CJOQ6yeftBEPcbA9/W47/YoV+mhQnrAoc8MA1VVrvvFKDitICFU62+nSt3NWRe53XL/fXnQbcbCb8AAgKlA==}
     peerDependencies:
-      vite: ^5.4.0
+      vite: ^5.4.14
     peerDependenciesMeta:
       vite:
         optional: true
@@ -4068,7 +4068,7 @@ packages:
   '@unocss/vite@0.65.4':
     resolution: {integrity: sha512-02pRcVLfb5UUxMJwudnjS/0ZQdSlskjuXVHdpZpLBZCA8hhoru2uEOsPbUOBRNNMjDj6ld00pmgk/+im07M35Q==}
     peerDependencies:
-      vite: ^5.4.0
+      vite: ^5.4.14
 
   '@vite-pwa/assets-generator@0.2.6':
     resolution: {integrity: sha512-kK44dXltvoubEo5B+6tCGjUrOWOE1+dA4DForbFpO1rKy2wSkAVGrs8tyfN6DzTig89/QKyV8XYodgmaKyrYng==}
@@ -4088,19 +4088,19 @@ packages:
     resolution: {integrity: sha512-DKHKVtpI+eA5fvObVgQ3QtTGU70CcCnedalzqmGSR050AzKZMdUzgC8KmlOneHWH8dF2hJ3wkC9+8FDVAaDRCw==}
     engines: {node: '>=14.6.0'}
     peerDependencies:
-      vite: ^5.4.0
+      vite: ^5.4.14
 
   '@vitejs/plugin-react@4.2.1':
     resolution: {integrity: sha512-oojO9IDc4nCUUi8qIR11KoQm0XFFLIwsRBwHRR4d/88IWghn1y6ckz/bJ8GHDCsYEJee8mDzqtJxh15/cisJNQ==}
     engines: {node: ^14.18.0 || >=16.0.0}
     peerDependencies:
-      vite: ^5.4.0
+      vite: ^5.4.14
 
   '@vitejs/plugin-vue@5.2.1':
     resolution: {integrity: sha512-cxh314tzaWwOLqVes2gnnCtvBDcM1UMdn+iFR+UjAn411dPT3tOmqrJjbMd7koZpMAmBM/GqeV4n9ge7JSiJJQ==}
     engines: {node: ^18.0.0 || >=20.0.0}
     peerDependencies:
-      vite: ^5.4.0
+      vite: ^5.4.14
       vue: ^3.2.25
 
   '@vitest/eslint-plugin@1.1.14':
@@ -7884,10 +7884,6 @@ packages:
     resolution: {integrity: sha512-A0RVJrX+IUkVZbW3ClroRWurercFhieevHB38sr2+l9eUClMqome3LmEmnhlNy+5Mr2EYN6B2Kaw9wYdd+VHiw==}
     engines: {node: '>=4'}
 
-  postcss@8.4.40:
-    resolution: {integrity: sha512-YF2kKIUzAofPMpfH6hOi2cGnv/HrUlfucspc7pDyvv7kGdqXrfj8SCl/t8owkEgKEuu8ZcRjSOxFxVLqwChZ2Q==}
-    engines: {node: ^10 || ^12 || >=14}
-
   postcss@8.4.47:
     resolution: {integrity: sha512-56rxCq7G/XfB4EkXq9Egn5GCqugWvDFjafDOThIdMBsI15iqPqR5r15TfSr1YPYeEI19YeaXMCbY6u88Y76GLQ==}
     engines: {node: ^10 || ^12 || >=14}
@@ -9170,7 +9166,7 @@ packages:
     engines: {node: '>=14'}
     peerDependencies:
       '@unocss/webpack': 0.65.4
-      vite: ^5.4.0
+      vite: ^5.4.14
     peerDependenciesMeta:
       '@unocss/webpack':
         optional: true
@@ -9309,7 +9305,7 @@ packages:
       '@solidjs/router': '*'
       '@vue/compiler-sfc': ^2.7.0 || ^3.0.0
       react-router: '*'
-      vite: ^5.4.0
+      vite: ^5.4.14
       vue-router: '*'
     peerDependenciesMeta:
       '@solidjs/router':
@@ -9326,15 +9322,15 @@ packages:
     engines: {node: '>=16.0.0'}
     peerDependencies:
       '@vite-pwa/assets-generator': ^0.2.6
-      vite: ^5.4.0
+      vite: ^5.4.14
       workbox-build: ^7.3.0
       workbox-window: ^7.3.0
     peerDependenciesMeta:
       '@vite-pwa/assets-generator':
         optional: true
 
-  vite@5.4.0:
-    resolution: {integrity: sha512-5xokfMX0PIiwCMCMb9ZJcMyh5wbBun0zUzKib+L65vAZ8GY9ePZMXxFrHbr/Kyll2+LSCY7xtERPpxkBDKngwg==}
+  vite@5.4.14:
+    resolution: {integrity: sha512-EK5cY7Q1D8JNhSaPKVK4pwBFvaTmZxEnoKXLG/U9gmdDcihQGNzFlgIvaxezFR4glP1LsuiedwMBqCXH3wZccA==}
     engines: {node: ^18.0.0 || >=20.0.0}
     hasBin: true
     peerDependencies:
@@ -9367,7 +9363,7 @@ packages:
   vitefu@0.2.5:
     resolution: {integrity: sha512-SgHtMLoqaeeGnd2evZ849ZbACbnwQCIwRH57t18FxcXoZop0uQu0uzlIhJBlF/eWVzuce0sHeqPcDo+evVcg8Q==}
     peerDependencies:
-      vite: ^5.4.0
+      vite: ^5.4.14
     peerDependenciesMeta:
       vite:
         optional: true
@@ -11993,14 +11989,14 @@ snapshots:
       magic-string: 0.25.9
       string.prototype.matchall: 4.0.11
 
-  '@sveltejs/adapter-auto@2.1.0(@sveltejs/kit@1.20.2(svelte@3.59.1)(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0)))':
+  '@sveltejs/adapter-auto@2.1.0(@sveltejs/kit@1.20.2(svelte@3.59.1)(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0)))':
     dependencies:
-      '@sveltejs/kit': 1.20.2(svelte@3.59.1)(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))
+      '@sveltejs/kit': 1.20.2(svelte@3.59.1)(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))
       import-meta-resolve: 3.0.0
 
-  '@sveltejs/kit@1.20.2(svelte@3.59.1)(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))':
+  '@sveltejs/kit@1.20.2(svelte@3.59.1)(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))':
     dependencies:
-      '@sveltejs/vite-plugin-svelte': 2.4.6(svelte@3.59.1)(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))
+      '@sveltejs/vite-plugin-svelte': 2.4.6(svelte@3.59.1)(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))
       '@types/cookie': 0.5.1
       cookie: 0.5.0
       devalue: 4.3.2
@@ -12014,30 +12010,30 @@ snapshots:
       svelte: 3.59.1
       tiny-glob: 0.2.9
       undici: 5.22.1
-      vite: 5.4.0(@types/node@22.10.7)(terser@5.36.0)
+      vite: 5.4.14(@types/node@22.10.7)(terser@5.36.0)
     transitivePeerDependencies:
       - supports-color
 
-  '@sveltejs/vite-plugin-svelte-inspector@1.0.4(@sveltejs/vite-plugin-svelte@2.4.6(svelte@3.59.1)(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0)))(svelte@3.59.1)(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))':
+  '@sveltejs/vite-plugin-svelte-inspector@1.0.4(@sveltejs/vite-plugin-svelte@2.4.6(svelte@3.59.1)(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0)))(svelte@3.59.1)(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))':
     dependencies:
-      '@sveltejs/vite-plugin-svelte': 2.4.6(svelte@3.59.1)(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))
+      '@sveltejs/vite-plugin-svelte': 2.4.6(svelte@3.59.1)(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))
       debug: 4.4.0
       svelte: 3.59.1
-      vite: 5.4.0(@types/node@22.10.7)(terser@5.36.0)
+      vite: 5.4.14(@types/node@22.10.7)(terser@5.36.0)
     transitivePeerDependencies:
       - supports-color
 
-  '@sveltejs/vite-plugin-svelte@2.4.6(svelte@3.59.1)(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))':
+  '@sveltejs/vite-plugin-svelte@2.4.6(svelte@3.59.1)(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))':
     dependencies:
-      '@sveltejs/vite-plugin-svelte-inspector': 1.0.4(@sveltejs/vite-plugin-svelte@2.4.6(svelte@3.59.1)(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0)))(svelte@3.59.1)(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))
+      '@sveltejs/vite-plugin-svelte-inspector': 1.0.4(@sveltejs/vite-plugin-svelte@2.4.6(svelte@3.59.1)(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0)))(svelte@3.59.1)(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))
       debug: 4.4.0
       deepmerge: 4.3.1
       kleur: 4.1.5
       magic-string: 0.30.17
       svelte: 3.59.1
       svelte-hmr: 0.15.3(svelte@3.59.1)
-      vite: 5.4.0(@types/node@22.10.7)(terser@5.36.0)
-      vitefu: 0.2.5(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))
+      vite: 5.4.14(@types/node@22.10.7)(terser@5.36.0)
+      vitefu: 0.2.5(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))
     transitivePeerDependencies:
       - supports-color
 
@@ -12567,13 +12563,13 @@ snapshots:
 
   '@ungap/structured-clone@1.2.1': {}
 
-  '@unocss/astro@0.65.4(rollup@4.30.1)(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))(vue@3.5.12(typescript@5.7.3))':
+  '@unocss/astro@0.65.4(rollup@4.30.1)(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))(vue@3.5.12(typescript@5.7.3))':
     dependencies:
       '@unocss/core': 0.65.4
       '@unocss/reset': 0.65.4
-      '@unocss/vite': 0.65.4(rollup@4.30.1)(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))(vue@3.5.12(typescript@5.7.3))
+      '@unocss/vite': 0.65.4(rollup@4.30.1)(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))(vue@3.5.12(typescript@5.7.3))
     optionalDependencies:
-      vite: 5.4.0(@types/node@22.10.7)(terser@5.36.0)
+      vite: 5.4.14(@types/node@22.10.7)(terser@5.36.0)
     transitivePeerDependencies:
       - rollup
       - supports-color
@@ -12703,7 +12699,7 @@ snapshots:
     dependencies:
       '@unocss/core': 0.65.4
 
-  '@unocss/vite@0.65.4(rollup@4.30.1)(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))(vue@3.5.12(typescript@5.7.3))':
+  '@unocss/vite@0.65.4(rollup@4.30.1)(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))(vue@3.5.12(typescript@5.7.3))':
     dependencies:
       '@ampproject/remapping': 2.3.0
       '@rollup/pluginutils': 5.1.4(rollup@4.30.1)
@@ -12713,7 +12709,7 @@ snapshots:
       chokidar: 3.6.0
       magic-string: 0.30.17
       tinyglobby: 0.2.10
-      vite: 5.4.0(@types/node@22.10.7)(terser@5.36.0)
+      vite: 5.4.14(@types/node@22.10.7)(terser@5.36.0)
     transitivePeerDependencies:
       - rollup
       - supports-color
@@ -12728,30 +12724,30 @@ snapshots:
       sharp-ico: 0.1.5
       unconfig: 0.3.11
 
-  '@vite-pwa/vitepress@0.5.3(@vite-pwa/assets-generator@0.2.6)(vite-plugin-pwa@0.21.1(@vite-pwa/assets-generator@0.2.6)(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))(workbox-build@7.1.0(@types/babel__core@7.20.5))(workbox-window@7.3.0))':
+  '@vite-pwa/vitepress@0.5.3(@vite-pwa/assets-generator@0.2.6)(vite-plugin-pwa@0.21.1(@vite-pwa/assets-generator@0.2.6)(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))(workbox-build@7.1.0(@types/babel__core@7.20.5))(workbox-window@7.3.0))':
     dependencies:
-      vite-plugin-pwa: 0.21.1(@vite-pwa/assets-generator@0.2.6)(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))(workbox-build@7.1.0(@types/babel__core@7.20.5))(workbox-window@7.3.0)
+      vite-plugin-pwa: 0.21.1(@vite-pwa/assets-generator@0.2.6)(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))(workbox-build@7.1.0(@types/babel__core@7.20.5))(workbox-window@7.3.0)
     optionalDependencies:
       '@vite-pwa/assets-generator': 0.2.6
 
-  '@vitejs/plugin-basic-ssl@1.0.2(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))':
+  '@vitejs/plugin-basic-ssl@1.0.2(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))':
     dependencies:
-      vite: 5.4.0(@types/node@22.10.7)(terser@5.36.0)
+      vite: 5.4.14(@types/node@22.10.7)(terser@5.36.0)
 
-  '@vitejs/plugin-react@4.2.1(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))':
+  '@vitejs/plugin-react@4.2.1(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))':
     dependencies:
       '@babel/core': 7.24.4
       '@babel/plugin-transform-react-jsx-self': 7.23.3(@babel/core@7.24.4)
       '@babel/plugin-transform-react-jsx-source': 7.23.3(@babel/core@7.24.4)
       '@types/babel__core': 7.20.5
       react-refresh: 0.14.0
-      vite: 5.4.0(@types/node@22.10.7)(terser@5.36.0)
+      vite: 5.4.14(@types/node@22.10.7)(terser@5.36.0)
     transitivePeerDependencies:
       - supports-color
 
-  '@vitejs/plugin-vue@5.2.1(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))(vue@3.5.12(typescript@5.7.3))':
+  '@vitejs/plugin-vue@5.2.1(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))(vue@3.5.12(typescript@5.7.3))':
     dependencies:
-      vite: 5.4.0(@types/node@22.10.7)(terser@5.36.0)
+      vite: 5.4.14(@types/node@22.10.7)(terser@5.36.0)
       vue: 3.5.12(typescript@5.7.3)
 
   '@vitest/eslint-plugin@1.1.14(@typescript-eslint/utils@8.17.0(eslint@9.16.0(jiti@2.4.1))(typescript@5.7.3))(eslint@9.16.0(jiti@2.4.1))(typescript@5.7.3)(vitest@packages+vitest)':
@@ -17369,12 +17365,6 @@ snapshots:
       cssesc: 3.0.0
       util-deprecate: 1.0.2
 
-  postcss@8.4.40:
-    dependencies:
-      nanoid: 3.3.7
-      picocolors: 1.0.1
-      source-map-js: 1.2.0
-
   postcss@8.4.47:
     dependencies:
       nanoid: 3.3.7
@@ -18830,9 +18820,9 @@ snapshots:
 
   universalify@2.0.1: {}
 
-  unocss@0.65.4(postcss@8.4.49)(rollup@4.30.1)(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))(vue@3.5.12(typescript@5.7.3)):
+  unocss@0.65.4(postcss@8.4.49)(rollup@4.30.1)(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))(vue@3.5.12(typescript@5.7.3)):
     dependencies:
-      '@unocss/astro': 0.65.4(rollup@4.30.1)(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))(vue@3.5.12(typescript@5.7.3))
+      '@unocss/astro': 0.65.4(rollup@4.30.1)(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))(vue@3.5.12(typescript@5.7.3))
       '@unocss/cli': 0.65.4(rollup@4.30.1)
       '@unocss/core': 0.65.4
       '@unocss/postcss': 0.65.4(postcss@8.4.49)
@@ -18848,9 +18838,9 @@ snapshots:
       '@unocss/transformer-compile-class': 0.65.4
       '@unocss/transformer-directives': 0.65.4
       '@unocss/transformer-variant-group': 0.65.4
-      '@unocss/vite': 0.65.4(rollup@4.30.1)(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))(vue@3.5.12(typescript@5.7.3))
+      '@unocss/vite': 0.65.4(rollup@4.30.1)(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))(vue@3.5.12(typescript@5.7.3))
     optionalDependencies:
-      vite: 5.4.0(@types/node@22.10.7)(terser@5.36.0)
+      vite: 5.4.14(@types/node@22.10.7)(terser@5.36.0)
     transitivePeerDependencies:
       - postcss
       - rollup
@@ -19014,7 +19004,7 @@ snapshots:
       unist-util-stringify-position: 4.0.0
       vfile-message: 4.0.2
 
-  vite-plugin-pages@0.32.4(@vue/compiler-sfc@3.5.13)(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))(vue-router@4.5.0(vue@3.5.12(typescript@5.7.3))):
+  vite-plugin-pages@0.32.4(@vue/compiler-sfc@3.5.13)(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))(vue-router@4.5.0(vue@3.5.12(typescript@5.7.3))):
     dependencies:
       '@types/debug': 4.1.12
       debug: 4.4.0
@@ -19024,7 +19014,7 @@ snapshots:
       json5: 2.2.3
       local-pkg: 0.5.1
       picocolors: 1.1.1
-      vite: 5.4.0(@types/node@22.10.7)(terser@5.36.0)
+      vite: 5.4.14(@types/node@22.10.7)(terser@5.36.0)
       yaml: 2.6.1
     optionalDependencies:
       '@vue/compiler-sfc': 3.5.13
@@ -19032,12 +19022,12 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  vite-plugin-pwa@0.21.1(@vite-pwa/assets-generator@0.2.6)(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))(workbox-build@7.1.0(@types/babel__core@7.20.5))(workbox-window@7.3.0):
+  vite-plugin-pwa@0.21.1(@vite-pwa/assets-generator@0.2.6)(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))(workbox-build@7.1.0(@types/babel__core@7.20.5))(workbox-window@7.3.0):
     dependencies:
       debug: 4.3.7
       pretty-bytes: 6.1.1
       tinyglobby: 0.2.10
-      vite: 5.4.0(@types/node@22.10.7)(terser@5.36.0)
+      vite: 5.4.14(@types/node@22.10.7)(terser@5.36.0)
       workbox-build: 7.1.0(@types/babel__core@7.20.5)
       workbox-window: 7.3.0
     optionalDependencies:
@@ -19045,29 +19035,29 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  vite@5.4.0(@types/node@20.11.5)(terser@5.36.0):
+  vite@5.4.14(@types/node@20.11.5)(terser@5.36.0):
     dependencies:
       esbuild: 0.21.5
-      postcss: 8.4.40
+      postcss: 8.4.49
       rollup: 4.30.1
     optionalDependencies:
       '@types/node': 20.11.5
       fsevents: 2.3.3
       terser: 5.36.0
 
-  vite@5.4.0(@types/node@22.10.7)(terser@5.36.0):
+  vite@5.4.14(@types/node@22.10.7)(terser@5.36.0):
     dependencies:
       esbuild: 0.21.5
-      postcss: 8.4.40
+      postcss: 8.4.49
       rollup: 4.30.1
     optionalDependencies:
       '@types/node': 22.10.7
       fsevents: 2.3.3
       terser: 5.36.0
 
-  vitefu@0.2.5(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0)):
+  vitefu@0.2.5(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0)):
     optionalDependencies:
-      vite: 5.4.0(@types/node@22.10.7)(terser@5.36.0)
+      vite: 5.4.14(@types/node@22.10.7)(terser@5.36.0)
 
   vitepress-plugin-group-icons@1.3.4:
     dependencies:
@@ -19091,7 +19081,7 @@ snapshots:
       '@shikijs/transformers': 1.27.2
       '@shikijs/types': 1.22.2
       '@types/markdown-it': 14.1.2
-      '@vitejs/plugin-vue': 5.2.1(vite@5.4.0(@types/node@22.10.7)(terser@5.36.0))(vue@3.5.12(typescript@5.7.3))
+      '@vitejs/plugin-vue': 5.2.1(vite@5.4.14(@types/node@22.10.7)(terser@5.36.0))(vue@3.5.12(typescript@5.7.3))
       '@vue/devtools-api': 7.6.2
       '@vue/shared': 3.5.12
       '@vueuse/core': 11.2.0(vue@3.5.12(typescript@5.7.3))
@@ -19100,7 +19090,7 @@ snapshots:
       mark.js: 8.11.1
       minisearch: 7.1.0
       shiki: 1.22.2
-      vite: 5.4.0(@types/node@22.10.7)(terser@5.36.0)
+      vite: 5.4.14(@types/node@22.10.7)(terser@5.36.0)
       vue: 3.5.12(typescript@5.7.3)
     optionalDependencies:
       postcss: 8.4.49
diff --git a/test/config/test/override.test.ts b/test/config/test/override.test.ts
index 0b6dc673657e..ceb4158aaaa5 100644
--- a/test/config/test/override.test.ts
+++ b/test/config/test/override.test.ts
@@ -249,6 +249,7 @@ describe('correctly defines api flag', () => {
     expect(c.server.config.server.middlewareMode).toBe(true)
     expect(c.config.api).toEqual({
       middlewareMode: true,
+      token: expect.any(String),
     })
   })
 
@@ -262,6 +263,7 @@ describe('correctly defines api flag', () => {
     expect(c.server.config.server.port).toBe(4321)
     expect(c.config.api).toEqual({
       port: 4321,
+      token: expect.any(String),
     })
   })
 })
diff --git a/test/ui/test/ui.spec.ts b/test/ui/test/ui.spec.ts
index 92267f1d90f6..9cd0036a3ff7 100644
--- a/test/ui/test/ui.spec.ts
+++ b/test/ui/test/ui.spec.ts
@@ -30,6 +30,36 @@ test.describe('ui', () => {
     await vitest?.close()
   })
 
+  test('security', async ({ page }) => {
+    await page.goto('https://example.com/')
+
+    // request html
+    const htmlResult = await page.evaluate(async (pageUrl) => {
+      try {
+        const res = await fetch(pageUrl)
+        return res.status
+      }
+      catch (e) {
+        return e instanceof Error ? e.message : e
+      }
+    }, pageUrl)
+    expect(htmlResult).toBe('Failed to fetch')
+
+    // request websocket
+    const wsResult = await page.evaluate(async (pageUrl) => {
+      const ws = new WebSocket(new URL('/__vitest_api__', pageUrl))
+      return new Promise((resolve) => {
+        ws.addEventListener('open', () => {
+          resolve('open')
+        })
+        ws.addEventListener('error', () => {
+          resolve('error')
+        })
+      })
+    }, pageUrl)
+    expect(wsResult).toBe('error')
+  })
+
   test('basic', async ({ page }) => {
     const pageErrors: unknown[] = []
     page.on('pageerror', error => pageErrors.push(error))
diff --git a/test/ui/tsconfig.json b/test/ui/tsconfig.json
index accaf3ba63ee..21c54a461ab5 100644
--- a/test/ui/tsconfig.json
+++ b/test/ui/tsconfig.json
@@ -1,6 +1,7 @@
 {
   "extends": "../../tsconfig.base.json",
   "compilerOptions": {
+    "lib": ["ESNext", "DOM"],
     "baseUrl": "../..",
     "paths": {
       "vitest/node": [