8000 chore(deps): update dependency vite to v6.3.4 [security] by renovate[bot] · Pull Request #5940 · rollup/rollup · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

chore(deps): update dependency vite to v6.3.4 [security] #5940

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Apr 30, 2025
Merged

chore(deps): update dependency vite to v6.3.4 [security] #5940

merged 1 commit into from
Apr 30, 2025

Conversation

renovate[bot]
Copy link
Contributor
@renovate renovate bot commented Apr 30, 2025

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
vite (source) 6.3.3 -> 6.3.4 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2025-46565

Summary

The contents of files in the project root that are denied by a file matching pattern can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
Only files that are under project root and are denied by a file matching pattern can be bypassed.

  • Examples of file matching patterns: .env, .env.*, *.{crt,pem}, **/.env
  • Examples of other patterns: **/.git/**, .git/**, .git/**/*

Details

server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns).
These patterns were able to bypass for files under root by using a combination of slash and dot (/.).

PoC

npm create vite@latest
cd vite-project/
cat "secret" > .env
npm install
npm run dev
curl --request-target /.env/. http://localhost:5173

image
image

Release Notes

vitejs/vite (vite)

v6.3.4

Compare Source

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot enabled auto-merge April 30, 2025 21:59
@vercel Vercel
Copy link
vercel bot commented Apr 30, 2025 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
rollup ✅ Ready (Inspect) Visit Preview 💬 Add feedback Apr 30, 2025 10:00pm

@github-actions GitHub Actions
Copy link
github-actions bot commented Apr 30, 2025 •
edited
Loading

Thank you for your contribution! ❤️

You can try out this pull request locally by installing Rollup via

npm install rollup/rollup#renovate/npm-vite-vulnerability

Notice: Ensure you have installed the latest stable Rust toolchain. If you haven't installed it yet, please see https://www.rust-lang.org/tools/install to learn how to download Rustup and install Rust.

or load it into the REPL:
https://rollup-ht93eg2a2-rollup-js.vercel.app/repl/?pr=5940

@github-actions GitHub Actions
Copy link

Performance report

  • BUILD: 7420ms, 745 MB
    • initialize: 0ms, 28.1 MB
    • generate module graph: 2824ms, 560 MB
      • generate ast: 1286ms, 552 MB
    • sort and bind modules: 397ms, 600 MB
    • mark included statements: 4195ms, 745 MB
      • treeshaking pass 1: 2469ms, 744 MB
      • treeshaking pass 2: 484ms, 745 MB
      • treeshaking pass 3: 419ms, 748 MB
      • treeshaking pass 4: 409ms, 747 MB
      • treeshaking pass 5: 402ms, 745 MB
  • GENERATE: 746ms, 985 MB
    • initialize render: 0ms, 882 MB
    • generate chunks: 75ms, 893 MB
      • optimize chunks: 0ms, 890 MB
    • render chunks: 651ms, 964 MB
    • transform chunks: 18ms, 985 MB
    • generate bundle: 0ms, 985 MB

@codecov Codecov
Copy link
codecov bot commented Apr 30, 2025 •
edited
Loading

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 98.55%. Comparing base (cb8f815) to head (5dd09a4).
Report is 1 commits behind head on master.

Additional details and impacted files 
@@           Coverage Diff           @@
##           master    #5940   +/-   ##
=======================================
  Coverage   98.55%   98.55%           
=======================================
  Files         270      270           
  Lines        8704     8704           
  Branches     1492     1492           
=======================================
  Hits         8578     8578           
  Misses         93       93           
  Partials       33       33

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@renovate renovate bot added this pull request to the merge queue Apr 30, 2025
Merged via the queue into master with commit 860df3f Apr 30, 2025
42 checks passed
@renovate renovate bot deleted the renovate/npm-vite-vulnerability branch April 30, 2025 22:41
@github-actions GitHub Actions
Copy link
github-actions bot commented May 6, 2025

This PR has been released as part of rollup@4.40.2. You can test it via npm install rollup.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@renovate-approve renovate-approve[bot] renovate-approve[bot] approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants
0