Update dependency vite to v6 [SECURITY] - autoclosed#27354
Update dependency vite to v6 [SECURITY] - autoclosed#27354renovate[bot] wants to merge 1 commit into
Conversation
8e80c42 to
4d91357
Compare
eb753ff to
cbce799
Compare
E2E Tests FailedTo view the Playwright test report locally, run: REPORT_DIR=$(mktemp -d) && gh run download 25666106016 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR" |
E2E Tests FailedTo view the Playwright test report locally, run: REPORT_DIR=$(mktemp -d) && gh run download 25672889271 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR" |
E2E Tests FailedTo view the Playwright test report locally, run: REPORT_DIR=$(mktemp -d) && gh run download 25676618342 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR" |
E2E Tests FailedTo view the Playwright test report locally, run: REPORT_DIR=$(mktemp -d) && gh run download 25678799478 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR" |
E2E Tests FailedTo view the Playwright test report locally, run: REPORT_DIR=$(mktemp -d) && gh run download 25688724967 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR" |
E2E Tests FailedTo view the Playwright test report locally, run: REPORT_DIR=$(mktemp -d) && gh run download 25694425104 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR" |
E2E Tests FailedTo view the Playwright test report locally, run: REPORT_DIR=$(mktemp -d) && gh run download 25698528654 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR" |
E2E Tests FailedTo view the Playwright test report locally, run: REPORT_DIR=$(mktemp -d) && gh run download 25722792834 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR" |
E2E Tests FailedTo view the Playwright test report locally, run: REPORT_DIR=$(mktemp -d) && gh run download 25727710718 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR" |
E2E Tests FailedTo view the Playwright test report locally, run: REPORT_DIR=$(mktemp -d) && gh run download 25731278664 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR" |
E2E Tests FailedTo view the Playwright test report locally, run: REPORT_DIR=$(mktemp -d) && gh run download 25734484990 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR" |
E2E Tests FailedTo view the Playwright test report locally, run: REPORT_DIR=$(mktemp -d) && gh run download 25736725724 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR" |
E2E Tests FailedTo view the Playwright test report locally, run: REPORT_DIR=$(mktemp -d) && gh run download 25739259202 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR" |
E2E Tests FailedTo view the Playwright test report locally, run: REPORT_DIR=$(mktemp -d) && gh run download 25741869041 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR" |
E2E Tests FailedTo view the Playwright test report locally, run: REPORT_DIR=$(mktemp -d) && gh run download 25745048862 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR" |
E2E Tests FailedTo view the Playwright test report locally, run: REPORT_DIR=$(mktemp -d) && gh run download 25746447693 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR" |
E2E Tests FailedTo view the Playwright test report locally, run: REPORT_DIR=$(mktemp -d) && gh run download 25751946711 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR" |
E2E Tests FailedTo view the Playwright test report locally, run: REPORT_DIR=$(mktemp -d) && gh run download 25756204487 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR" |
E2E Tests FailedTo view the Playwright test report locally, run: REPORT_DIR=$(mktemp -d) && gh run download 25758438636 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR" |
E2E Tests FailedTo view the Playwright test report locally, run: REPORT_DIR=$(mktemp -d) && gh run download 25764995661 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR" |
E2E Tests FailedTo view the Playwright test report locally, run: REPORT_DIR=$(mktemp -d) && gh run download 25768420802 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR" |
E2E Tests FailedTo view the Playwright test report locally, run: REPORT_DIR=$(mktemp -d) && gh run download 25780973052 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR" |
E2E Tests FailedTo view the Playwright test report locally, run: REPORT_DIR=$(mktemp -d) && gh run download 25786963910 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR" |
E2E Tests FailedTo view the Playwright test report locally, run: REPORT_DIR=$(mktemp -d) && gh run download 25791995050 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR" |
E2E Tests FailedTo view the Playwright test report locally, run: REPORT_DIR=$(mktemp -d) && gh run download 25802046337 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR" |
E2E Tests FailedTo view the Playwright test report locally, run: REPORT_DIR=$(mktemp -d) && gh run download 25810101953 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR" |
E2E Tests FailedTo view the Playwright test report locally, run: REPORT_DIR=$(mktemp -d) && gh run download 25812690227 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR" |
E2E Tests FailedTo view the Playwright test report locally, run: REPORT_DIR=$(mktemp -d) && gh run download 25815910477 -n playwright-report -D "$REPORT_DIR" && npx playwright show-report "$REPORT_DIR" |
This PR contains the following updates:
5.4.21→6.4.2Vite Vulnerable to Path Traversal in Optimized Deps
.mapHandlingCVE-2026-39365 / GHSA-4w7w-66w2-5vf9
More information
Details
Summary
Any files ending with
.mapeven out side the project can be returned to the browser.Impact
Only apps that match the following conditions are affected:
--hostorserver.hostconfig option).mapand the path is predictableDetails
In Vite v7.3.1, the dev server’s handling of
.maprequests for optimized dependencies resolves file paths and callsreadFilewithout restricting../segments in the URL. As a result, it is possible to bypass theserver.fs.strictallow list and retrieve.mapfiles located outside the project root, provided they can be parsed as valid source map JSON.PoC
/@​fsaccess is blocked bystrict(returns 403)../segments under the optimized deps.mapURL prefix to reach/tmp/poc.mapSeverity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
vitejs/vite (vite)
v6.4.2Compare Source
Please refer to CHANGELOG.md for details.
v6.4.1Compare Source
Please refer to CHANGELOG.md for details.
v6.4.0Compare Source
Please refer to CHANGELOG.md for details.
v6.3.7Compare Source
Please refer to CHANGELOG.md for details.
v6.3.6Compare Source
Please refer to CHANGELOG.md for details.
v6.3.5Compare Source
Today, we're excited to announce the release of the next Vite major:
⚠ BREAKING CHANGES
Objectvariable in ssr transformed code (#19996)experimental.skipSsrTransformoption (#20038)HotBroadcaster(#19988)build.targetand name itbaseline-widely-available(#20007)HotBroadcasterrelated types (#19987)enforce/transformfromtransformIndexHtmlhook (#19349)Features
configurePreviewServerhook (#20224) (b989c42)configureServerhook (#20222) (f5cc4c0)this.meta.viteVersion(#20088) (f55bf41)createServer(#19894) (c1ae9bd)build.targetand name itbaseline-widely-available(#20007) (4a8aa82)css.preprocessorMaxWorkersand default totrue(#19992) (70aee13)optimizeDeps.noDiscovery(#19984) (6d2dcb4)Bug Fixes
import.meta.urlin bundled Vite (#20235) (3bf3a8a)ssrExportNameKey(#20266) (ac302a7)normalizeModuleId(#20277) (9b98dcb).then(m => m.a)(#20117) (7b7410a)build.rollupOptions.inputresolution with rollup (#20080) (9759c29)Objectvariable in ssr transformed code (#19996) (fceff60)preprocessorOptions.sass(fix #20150) (#20166) (7db56be)cleanGlobalCLIOptions()clean--force(#19999) (d4a171a)environments.*.resolve.noExternalproperly (#20077) (daf4a25)server.allowedHosts: truecorrectly (#20138) (2ade756)computeEntriesfailed (#20079) (b742b46)optimizeDeps.entriesvalues as globs (#20045) (1422395)Performance Improvements
numberToPos(#20244) (3f46901)Documentation
Miscellaneous Chores
ResolvedConfig.createResolverand recommendcreateIdResolver(#20031) (d101d64)devEnvironmentOptions.moduleRunnerTransform(#20035) (338081d)patch-typesplugin for bundling vite (#20089) (c127955)Code Refactoring
src/node/publicUtils.tstosrc/node/index.ts(#20086) (999a1ed)experimental.skipSsrTransformoption (#20038) (6c3dd8e)HotBroadcaster(#19988) (cda8c94)options?.ssrsupport in clientInjectionsPlugin (#19589) (88e0076)HotBroadcasterrelated types (#19987) (86b5e00)enforce/transformfromtransformIndexHtmlhook (#19349) (6198b9d)legacy.proxySsrExternalModules(#20013) (a37ac83)hostValidationMiddleware(#20019) (83bf90e)mergeWithDefaultsfor experimental option (#20012) (98c5741)Tests
useDefineForClassFieldstest (#20143) (d90796e)Continuous Integration
Beta Changelogs
7.0.0-beta.2 (2025-06-17)
See 7.0.0-beta.2 changelog
7.0.0-beta.1 (2025-06-10)
See 7.0.0-beta.1 changelog
7.0.0-beta.0 (2025-06-02)
See 7.0.0-beta.0 changelog
v6.3.4Compare Source
Bug Fixes
requireto import externals in optimized dependencies (#19940) (efc5eab)Code Refactoring
v6.3.3Compare Source
Bug Fixes
Performance Improvements
Tests
ssrTransformre-export deps and test stacktrace with first line (#19629) (9399cda)v6.3.2Compare Source
Features
Bug Fixes
css.lightningcssoption in css minification process (#19879) (b5055e0)v6.3.1Compare Source
Bug Fixes
Promise.allSettledin preload function (#19805) (35c7f35)transformcalls (#19878) (a152b7c)v6.3.0Compare Source
Bug Fixes
hot.invalidatein circular deps (#19870) (d4ee5e8)v6.2.7Compare Source
Please refer to CHANGELOG.md for details.
v6.2.6Compare Source
Please refer to CHANGELOG.md for details.
v6.2.5Compare Source
Please refer to CHANGELOG.md for details.
v6.2.4Compare Source
Please refer to CHANGELOG.md for details.
v6.2.3Compare Source
Please refer to CHANGELOG.md for details.
v6.2.2Compare Source
Features
base(#19616) (2476391)Bug Fixes
ssrRewriteStacktrace(#19612) (4309755)Miscellaneous Chores
v6.2.1Compare Source
Features
*?url&no-inlinetype and warning for.json?inline/.json?no-inline(#19566) (c0d3667)Bug Fixes
Performance Improvements
Miscellaneous Chores
Code Refactoring
isBuildcheck from preAliasPlugin (#19587) (c9e086d)applyToEnvironmentin internal plugins (#19588) (f678442)Tests
v6.2.0Compare Source
Bug Fixes
Miscellaneous Chores
v6.1.6Compare Source
Please refer to CHANGELOG.md for details.
v6.1.5Compare Source
Please refer to CHANGELOG.md for details.
v6.1.4Compare Source
Please refer to CHANGELOG.md for details.
v6.1.3Compare Source
Please refer to CHANGELOG.md for details.
v6.1.2Compare Source
Please refer to CHANGELOG.md for details.
v6.1.1Compare Source
Features
Bug Fixes
.[cm]?[tj]sx?static assets are JS mime (#19453) (e7ba55e)*.ipv4address in cert (#19416) (973283b)Miscellaneous Chores
Code Refactoring
v6.1.0Compare Source
Features
Bug Fixes
.[cm]?[tj]sx?static assets are JS mime (#19453) (e7ba55e)*.ipv4address in cert (#19416) (973283b)Miscellaneous Chores
Code Refactoring
v6.0.15Compare Source
Please refer to CHANGELOG.md for details.
v6.0.14Compare Source
Please refer to CHANGELOG.md for details.
v6.0.13Compare Source
Please refer to CHANGELOG.md for details.
v6.0.12Compare Source
Please refer to CHANGELOG.md for details.
v6.0.11Compare Source
Features
portin the logged error message after failed WS connection withEADDRINUSE(#19212) (14027b0).jxl(#18855) (57b397c)builtinsenvironmentresolve(#18584) (2c2d521)defaultAllowedOriginsfor user-land config and 3rd party plugins (#19259) (dc8946b)wasmto the compressible assets regex (#19085) (ce84142)Bug Fixes
resolveLibCssFilename(#19324) (f183bdf)[@plugin](https://redirect.github.com/plugin)imports of JS files treated as CSS and rebased (fix #19268) (#19269) (602b373)vite optimize(#19347) (19ffad0)resolve.builtinis empty (#19312) (b7aba0b)server.preTransformRequests(#19272) (12aaa58)Configuration
📅 Schedule: (in timezone Etc/UTC)
* * * * 0,6)* 0-12 * * 1)* 22-23 * * 1-5)* 0-4 * * 2-6)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.