Skip to content

Update dependency vite to v6 [SECURITY] - autoclosed#27354

Closed
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-vite-vulnerability
Closed

Update dependency vite to v6 [SECURITY] - autoclosed#27354
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-vite-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Apr 12, 2026

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
vite (source) 5.4.216.4.2 age confidence

Vite Vulnerable to Path Traversal in Optimized Deps .map Handling

CVE-2026-39365 / GHSA-4w7w-66w2-5vf9

More information

Details

Summary

Any files ending with .map even out side the project can be returned to the browser.

Impact

Only apps that match the following conditions are affected:

  • explicitly exposes the Vite dev server to the network (using --host or server.host config option)
  • have a sensitive content in files ending with .map and the path is predictable
Details

In Vite v7.3.1, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON.

PoC
  1. Create a minimal PoC sourcemap outside the project root
    cat > /tmp/poc.map <<'EOF'
    {"version":3,"file":"x.js","sources":[],"names":[],"mappings":""}
    EOF
  2. Start the Vite dev server (example)
    pnpm -C playground/fs-serve dev --host 127.0.0.1 --port 18080
  3. Confirm that direct /@&#8203;fs access is blocked by strict (returns 403)
    image
  4. Inject ../ segments under the optimized deps .map URL prefix to reach /tmp/poc.map
    image

Severity

  • CVSS Score: 6.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).


Release Notes

vitejs/vite (vite)

v6.4.2

Compare Source

Please refer to CHANGELOG.md for details.

v6.4.1

Compare Source

Please refer to CHANGELOG.md for details.

v6.4.0

Compare Source

Please refer to CHANGELOG.md for details.

v6.3.7

Compare Source

Please refer to CHANGELOG.md for details.

v6.3.6

Compare Source

Please refer to CHANGELOG.md for details.

v6.3.5

Compare Source

Vite 7 is out!

Today, we're excited to announce the release of the next Vite major:

⚠ BREAKING CHANGES
  • ssr: don't access Object variable in ssr transformed code (#​19996)
  • remove experimental.skipSsrTransform option (#​20038)
  • remove HotBroadcaster (#​19988)
  • css: always use sass compiler API (#​19978)
  • bump build.target and name it baseline-widely-available (#​20007)
  • bump required node version to 20.19+, 22.12+ and remove cjs build (#​20032)
  • css: remove sass legacy API support (#​19977)
  • remove deprecated HotBroadcaster related types (#​19987)
  • remove deprecated no-op type only properties (#​19985)
  • remove node 18 support (#​19972)
  • remove deprecated hook-level enforce/transform from transformIndexHtml hook (#​19349)
  • remove deprecated splitVendorChunkPlugin (#​19255)
Features
Bug Fixes
Performance Improvements
Documentation
Miscellaneous Chores
Code Refactoring
Tests
Continuous Integration
Beta Changelogs
7.0.0-beta.2 (2025-06-17)

See 7.0.0-beta.2 changelog

7.0.0-beta.1 (2025-06-10)

See 7.0.0-beta.1 changelog

7.0.0-beta.0 (2025-06-02)

See 7.0.0-beta.0 changelog

v6.3.4

Compare Source

Bug Fixes
  • check static serve file inside sirv (#​19965) (c22c43d)
  • optimizer: return plain object when using require to import externals in optimized dependencies (#​19940) (efc5eab)
Code Refactoring

v6.3.3

Compare Source

Bug Fixes
  • assets: ensure ?no-inline is not included in the asset url in the production environment (#​19496) (16a73c0)
  • css: resolve relative imports in sass properly on Windows (#​19920) (ffab442)
  • deps: update all non-major dependencies (#​19899) (a4b500e)
  • ignore malformed uris in tranform middleware (#​19853) (e4d5201)
  • ssr: fix execution order of re-export (#​19841) (ed29dee)
  • ssr: fix live binding of default export declaration and hoist exports getter (#​19842) (80a91ff)
Performance Improvements
  • skip sourcemap generation for renderChunk hook of import-analysis-build plugin (#​19921) (55cfd04)
Tests
  • ssr: test ssrTransform re-export deps and test stacktrace with first line (#​19629) (9399cda)

v6.3.2

Compare Source

Features
Bug Fixes

v6.3.1

Compare Source

Bug Fixes

v6.3.0

Compare Source

Bug Fixes

v6.2.7

Compare Source

Please refer to CHANGELOG.md for details.

v6.2.6

Compare Source

Please refer to CHANGELOG.md for details.

v6.2.5

Compare Source

Please refer to CHANGELOG.md for details.

v6.2.4

Compare Source

Please refer to CHANGELOG.md for details.

v6.2.3

Compare Source

Please refer to CHANGELOG.md for details.

v6.2.2

Compare Source

Features
Bug Fixes
Miscellaneous Chores
  • extend commit hash correctly when ambigious with a non-commit object (#​19600) (89a6287)

v6.2.1

Compare Source

Features
  • add *?url&no-inline type and warning for .json?inline / .json?no-inline (#​19566) (c0d3667)
Bug Fixes
  • css: stabilize css module hashes with lightningcss in dev mode (#​19481) (92125b4)
  • deps: update all non-major dependencies (#​19555) (f612e0f)
  • reporter: fix incorrect bundle size calculation with non-ASCII characters (#​19561) (437c0ed)
  • sourcemap: combine sourcemaps with multiple sources without matched source (#​18971) (e3f6ae1)
  • ssr: named export should overwrite export all (#​19534) (2fd2fc1)
Performance Improvements
Miscellaneous Chores
Code Refactoring
Tests

v6.2.0

Compare Source

Bug Fixes
Miscellaneous Chores

v6.1.6

Compare Source

Please refer to CHANGELOG.md for details.

v6.1.5

Compare Source

Please refer to CHANGELOG.md for details.

v6.1.4

Compare Source

Please refer to CHANGELOG.md for details.

v6.1.3

Compare Source

Please refer to CHANGELOG.md for details.

v6.1.2

Compare Source

Please refer to CHANGELOG.md for details.

v6.1.1

Compare Source

Features
Bug Fixes
Miscellaneous Chores
Code Refactoring

v6.1.0

Compare Source

Features
Bug Fixes
Miscellaneous Chores
Code Refactoring

v6.0.15

Compare Source

Please refer to CHANGELOG.md for details.

v6.0.14

Compare Source

Please refer to CHANGELOG.md for details.

v6.0.13

Compare Source

Please refer to CHANGELOG.md for details.

v6.0.12

Compare Source

Please refer to CHANGELOG.md for details.

v6.0.11

Compare Source

Features
Bug Fixes
  • avoid builtStart during vite optimize (#​19356) (fdb36e0)
  • build: fix stale build manifest on watch rebuild (#​19361) (fcd5785)
  • allow expanding env vars in reverse order (#​19352) (3f5f2bd)
  • avoid packageJson without name in resolveLibCssFilename (#​19324) (f183bdf)
  • html: fix css disorder when building multiple entry html (#​19143) (e7b4ba3)
  • css: less [@plugin](https://redirect.github.com/plugin) imports of JS files treated as CSS and rebased (fix #​19268) (#​19269) (602b373)
  • deps: update all non-major dependencies (#​19296) (2bea7ce)
  • don't call buildStart hooks for vite optimize (#​19347) (19ffad0)
  • don't call next middleware if user sent response in proxy.bypass (#​19318) (7e6364d)
  • resolve: preserve hash/search of file url (#​19300) (d1e1b24)
  • resolve: warn if node-like builtin was imported when resolve.builtin is empty (#​19312) (b7aba0b)
  • respect top-level server.preTransformRequests (#​19272) (12aaa58)
  • ssr: fix transform error due to export all id scope ([#​19331](https

Note

PR body was truncated to here.


Configuration

📅 Schedule: (in timezone Etc/UTC)

  • Branch creation
    • ""
  • Automerge
    • Only on Sunday and Saturday (* * * * 0,6)
    • Between 12:00 AM and 12:59 PM, only on Monday (* 0-12 * * 1)
    • Between 10:00 PM and 11:59 PM, Monday through Friday (* 22-23 * * 1-5)
    • Between 12:00 AM and 04:59 AM, Tuesday through Saturday (* 0-4 * * 2-6)

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions github-actions Bot added the dependencies Pull requests that update a dependency file label Apr 12, 2026
@renovate renovate Bot force-pushed the renovate/npm-vite-vulnerability branch 10 times, most recently from 8e80c42 to 4d91357 Compare April 16, 2026 04:57
@renovate renovate Bot changed the title Update dependency vite [SECURITY] Update dependency vite to v7.3.2 [SECURITY] Apr 16, 2026
@renovate renovate Bot force-pushed the renovate/npm-vite-vulnerability branch 18 times, most recently from eb753ff to cbce799 Compare April 18, 2026 03:15
@github-actions
Copy link
Copy Markdown
Contributor

E2E Tests Failed

To view the Playwright test report locally, run:

REPORT_DIR=$(mktemp -d) && gh run download 25666106016 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR"

@github-actions
Copy link
Copy Markdown
Contributor

E2E Tests Failed

To view the Playwright test report locally, run:

REPORT_DIR=$(mktemp -d) && gh run download 25672889271 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR"

@github-actions
Copy link
Copy Markdown
Contributor

E2E Tests Failed

To view the Playwright test report locally, run:

REPORT_DIR=$(mktemp -d) && gh run download 25676618342 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR"

@github-actions
Copy link
Copy Markdown
Contributor

E2E Tests Failed

To view the Playwright test report locally, run:

REPORT_DIR=$(mktemp -d) && gh run download 25678799478 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR"

@github-actions
Copy link
Copy Markdown
Contributor

E2E Tests Failed

To view the Playwright test report locally, run:

REPORT_DIR=$(mktemp -d) && gh run download 25688724967 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR"

@github-actions
Copy link
Copy Markdown
Contributor

E2E Tests Failed

To view the Playwright test report locally, run:

REPORT_DIR=$(mktemp -d) && gh run download 25694425104 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR"

@github-actions
Copy link
Copy Markdown
Contributor

E2E Tests Failed

To view the Playwright test report locally, run:

REPORT_DIR=$(mktemp -d) && gh run download 25698528654 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR"

@github-actions
Copy link
Copy Markdown
Contributor

E2E Tests Failed

To view the Playwright test report locally, run:

REPORT_DIR=$(mktemp -d) && gh run download 25722792834 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR"

@github-actions
Copy link
Copy Markdown
Contributor

E2E Tests Failed

To view the Playwright test report locally, run:

REPORT_DIR=$(mktemp -d) && gh run download 25727710718 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR"

@github-actions
Copy link
Copy Markdown
Contributor

E2E Tests Failed

To view the Playwright test report locally, run:

REPORT_DIR=$(mktemp -d) && gh run download 25731278664 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR"

@github-actions
Copy link
Copy Markdown
Contributor

E2E Tests Failed

To view the Playwright test report locally, run:

REPORT_DIR=$(mktemp -d) && gh run download 25734484990 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR"

@github-actions
Copy link
Copy Markdown
Contributor

E2E Tests Failed

To view the Playwright test report locally, run:

REPORT_DIR=$(mktemp -d) && gh run download 25736725724 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR"

@github-actions
Copy link
Copy Markdown
Contributor

E2E Tests Failed

To view the Playwright test report locally, run:

REPORT_DIR=$(mktemp -d) && gh run download 25739259202 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR"

@github-actions
Copy link
Copy Markdown
Contributor

E2E Tests Failed

To view the Playwright test report locally, run:

REPORT_DIR=$(mktemp -d) && gh run download 25741869041 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR"

@github-actions
Copy link
Copy Markdown
Contributor

E2E Tests Failed

To view the Playwright test report locally, run:

REPORT_DIR=$(mktemp -d) && gh run download 25745048862 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR"

@github-actions
Copy link
Copy Markdown
Contributor

E2E Tests Failed

To view the Playwright test report locally, run:

REPORT_DIR=$(mktemp -d) && gh run download 25746447693 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR"

@github-actions
Copy link
Copy Markdown
Contributor

E2E Tests Failed

To view the Playwright test report locally, run:

REPORT_DIR=$(mktemp -d) && gh run download 25751946711 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR"

@github-actions
Copy link
Copy Markdown
Contributor

E2E Tests Failed

To view the Playwright test report locally, run:

REPORT_DIR=$(mktemp -d) && gh run download 25756204487 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR"

@github-actions
Copy link
Copy Markdown
Contributor

E2E Tests Failed

To view the Playwright test report locally, run:

REPORT_DIR=$(mktemp -d) && gh run download 25758438636 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR"

@github-actions
Copy link
Copy Markdown
Contributor

E2E Tests Failed

To view the Playwright test report locally, run:

REPORT_DIR=$(mktemp -d) && gh run download 25764995661 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR"

@github-actions
Copy link
Copy Markdown
Contributor

E2E Tests Failed

To view the Playwright test report locally, run:

REPORT_DIR=$(mktemp -d) && gh run download 25768420802 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR"

@github-actions
Copy link
Copy Markdown
Contributor

E2E Tests Failed

To view the Playwright test report locally, run:

REPORT_DIR=$(mktemp -d) && gh run download 25780973052 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR"

@github-actions
Copy link
Copy Markdown
Contributor

E2E Tests Failed

To view the Playwright test report locally, run:

REPORT_DIR=$(mktemp -d) && gh run download 25786963910 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR"

@github-actions
Copy link
Copy Markdown
Contributor

E2E Tests Failed

To view the Playwright test report locally, run:

REPORT_DIR=$(mktemp -d) && gh run download 25791995050 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR"

@github-actions
Copy link
Copy Markdown
Contributor

E2E Tests Failed

To view the Playwright test report locally, run:

REPORT_DIR=$(mktemp -d) && gh run download 25802046337 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR"

@github-actions
Copy link
Copy Markdown
Contributor

E2E Tests Failed

To view the Playwright test report locally, run:

REPORT_DIR=$(mktemp -d) && gh run download 25810101953 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR"

@github-actions
Copy link
Copy Markdown
Contributor

E2E Tests Failed

To view the Playwright test report locally, run:

REPORT_DIR=$(mktemp -d) && gh run download 25812690227 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR"

@github-actions
Copy link
Copy Markdown
Contributor

E2E Tests Failed

To view the Playwright test report locally, run:

REPORT_DIR=$(mktemp -d) && gh run download 25815910477 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants