Skip to content

chore(deps): update dependency vite to v6.3.4 [security]#5940

Merged
renovate[bot] merged 1 commit into
masterfrom
renovate/npm-vite-vulnerability
Apr 30, 2025
Merged

chore(deps): update dependency vite to v6.3.4 [security]#5940
renovate[bot] merged 1 commit into
masterfrom
renovate/npm-vite-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Apr 30, 2025

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
vite (source) 6.3.3 -> 6.3.4 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2025-46565

Summary

The contents of files in the project root that are denied by a file matching pattern can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
Only files that are under project root and are denied by a file matching pattern can be bypassed.

  • Examples of file matching patterns: .env, .env.*, *.{crt,pem}, **/.env
  • Examples of other patterns: **/.git/**, .git/**, .git/**/*

Details

server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns).
These patterns were able to bypass for files under root by using a combination of slash and dot (/.).

PoC

npm create vite@latest
cd vite-project/
cat "secret" > .env
npm install
npm run dev
curl --request-target /.env/. http://localhost:5173

image
image

Release Notes

vitejs/vite (vite)

v6.3.4

Compare Source

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot enabled auto-merge April 30, 2025 21:59
@vercel

vercel Bot commented Apr 30, 2025 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
rollup ✅ Ready (Inspect) Visit Preview 💬 Add feedback Apr 30, 2025 10:00pm

@github-actions

github-actions Bot commented Apr 30, 2025 •
edited
Loading

Copy link
Copy Markdown

Thank you for your contribution! ❤️

You can try out this pull request locally by installing Rollup via

npm install rollup/rollup#renovate/npm-vite-vulnerability

Notice: Ensure you have installed the latest stable Rust toolchain. If you haven't installed it yet, please see https://www.rust-lang.org/tools/install to learn how to download Rustup and install Rust.

or load it into the REPL:
https://rollup-ht93eg2a2-rollup-js.vercel.app/repl/?pr=5940

@github-actions

github-actions Bot commented Apr 30, 2025

Copy link
Copy Markdown

Performance report

  • BUILD: 7420ms, 745 MB
    • initialize: 0ms, 28.1 MB
    • generate module graph: 2824ms, 560 MB
      • generate ast: 1286ms, 552 MB
    • sort and bind modules: 397ms, 600 MB
    • mark included statements: 4195ms, 745 MB
      • treeshaking pass 1: 2469ms, 744 MB
      • treeshaking pass 2: 484ms, 745 MB
      • treeshaking pass 3: 419ms, 748 MB
      • treeshaking pass 4: 409ms, 747 MB
      • treeshaking pass 5: 402ms, 745 MB
  • GENERATE: 746ms, 985 MB
    • initialize render: 0ms, 882 MB
    • generate chunks: 75ms, 893 MB
      • optimize chunks: 0ms, 890 MB
    • render chunks: 651ms, 964 MB
    • transform chunks: 18ms, 985 MB
    • generate bundle: 0ms, 985 MB

@codecov

codecov Bot commented Apr 30, 2025 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 98.55%. Comparing base (cb8f815) to head (5dd09a4).
Report is 1 commits behind head on master.

Additional details and impacted files 
@@           Coverage Diff           @@
##           master    #5940   +/-   ##
=======================================
  Coverage   98.55%   98.55%           
=======================================
  Files         270      270           
  Lines        8704     8704           
  Branches     1492     1492           
=======================================
  Hits         8578     8578           
  Misses         93       93           
  Partials       33       33

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@renovate renovate Bot added this pull request to the merge queue Apr 30, 2025
Merged via the queue into master with commit 860df3f Apr 30, 2025
@renovate renovate Bot deleted the renovate/npm-vite-vulnerability branch April 30, 2025 22:41
@github-actions

github-actions Bot commented May 6, 2025

Copy link
Copy Markdown

This PR has been released as part of rollup@4.40.2. You can test it via npm install rollup.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@renovate-approve renovate-approve[bot] renovate-approve[bot] approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants