chore(deps): update dependency vite to v7.3.2 [security]#303
chore(deps): update dependency vite to v7.3.2 [security]#303renovate[bot] wants to merge 1 commit intomainfrom
Conversation
|
View your CI Pipeline Execution ↗ for commit bad056c
☁️ Nx Cloud last updated this comment at |
🚀 Changeset Version PreviewNo changeset entries found. Merging this PR will not cause a version bump for any packages. |
@tanstack/angular-store
@tanstack/preact-store
@tanstack/react-store
@tanstack/solid-store
@tanstack/store
@tanstack/svelte-store
@tanstack/vue-store
commit: |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (5)
✅ Files skipped from review due to trivial changes (5)
📝 WalkthroughWalkthroughThe PR updates the Vite devDependency from Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 1 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (1 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@examples/vue/simple/package.json`:
- Line 19: Update package.json dependencies so Vite and the Vue plugin are
compatible and include the security fix: change the "vite" version to at least
"^7.0.8" (to pull the patched 7.x release) and upgrade "@vitejs/plugin-vue" to a
6.x release (e.g., "^6.0.0") so its peer dependency supports Vite 7; modify the
"vite" and "@vitejs/plugin-vue" entries in package.json accordingly and run a
fresh install to verify peer compatibility.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 7aafcfed-8f44-4deb-a1c1-0539d46ec4a1
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (5)
examples/preact/simple/package.jsonexamples/react/simple/package.jsonexamples/solid/simple/package.jsonexamples/svelte/simple/package.jsonexamples/vue/simple/package.json
| "@vitejs/plugin-vue": "^5.2.4", | ||
| "typescript": "5.6.3", | ||
| "vite": "^6.3.6", | ||
| "vite": "^7.0.0", |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check `@vitejs/plugin-vue` peer dependency requirements for Vite compatibility
curl -s https://registry.npmjs.org/@vitejs/plugin-vue/5.2.4 | jq '.peerDependencies'Repository: TanStack/store
Length of output: 2060
🌐 Web query:
Vite 7.0.0 security vulnerabilities server.fs.deny bypass
💡 Result:
Vite 7.0.0 is affected by at least these server.fs.deny / server.fs bypass issues:
- CVE-2025-62522 (GHSA-93m4-6634-74q7) — On Windows, files matched by
server.fs.denycan be served if the request URL ends with a backslash (\) (only when the Vite dev server is exposed to the network via--host/server.host). Affected:>= 7.0.0, <= 7.0.7. Fix: upgrade to 7.0.8+. [1][2] - CVE-2025-58752 (GHSA-jqfw-vq24-v9c3) —
server.fsallow/deny rules were not applied to HTML files, allowing reading HTML files outside the intended root/deny rules (requires the dev server be exposed to the network; also impacts the preview server). Affected:>= 7.0.0, <= 7.0.6. Fix: upgrade to 7.0.7+. [3]
Recommended remediation for Vite 7.0.0: upgrade to Vite 7.0.8 or later (covers both). [1][3]
Sources
[1] (github.com)
[2] (nvd.nist.gov)
[3] (github.com)
Citations:
- 1: GHSA-93m4-6634-74q7
- 2: https://nvd.nist.gov/vuln/detail/CVE-2025-62522?utm_source=openai
- 3: GHSA-jqfw-vq24-v9c3
🌐 Web query:
@vitejs/plugin-vue 5.2.4 compatible Vite 7.x peer dependency
💡 Result:
@vitejs/plugin-vue@5.2.4 declares a Vite peer dependency of:
vite: "^5.0.0 || ^6.0.0"(so not compatible with Vite 7.x without ignoring peer-dep checks). [1]
If you need Vite 7.x, you’ll need to upgrade to @vitejs/plugin-vue 6.x (which is used with Vite 7 in the wild). [2]
Sources:
[1] @vitejs/plugin-vue@5.2.4 dependency metadata (shows viteVersion: ^5.0.0 || ^6.0.0) [1]
[2] Example lockfile showing @vitejs/plugin-vue@6.0.1 used with vite@7.2.2 [2]
Critical blocker: @vitejs/plugin-vue 5.x incompatible with Vite 7.x
While the security update to Vite 7 addresses real CVEs (server.fs.deny/allow bypasses on Windows and HTML file disclosure), @vitejs/plugin-vue@^5.2.4 declares peer dependency vite: "^5.0.0 || ^6.0.0" and is incompatible with Vite 7.x. Upgrade @vitejs/plugin-vue to 6.x to proceed with Vite 7.
Note: ^7.0.0 initially resolves to versions 7.0.0–7.0.7 which contain the vulnerabilities. Upgrade to ^7.0.8 to immediately get fixed versions.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@examples/vue/simple/package.json` at line 19, Update package.json
dependencies so Vite and the Vue plugin are compatible and include the security
fix: change the "vite" version to at least "^7.0.8" (to pull the patched 7.x
release) and upgrade "@vitejs/plugin-vue" to a 6.x release (e.g., "^6.0.0") so
its peer dependency supports Vite 7; modify the "vite" and "@vitejs/plugin-vue"
entries in package.json accordingly and run a fresh install to verify peer
compatibility.
renovate
bot
force-pushed
the
renovate/npm-vite-vulnerability
branch
from
d6c0548 to
bad056c
Compare
This PR contains the following updates:
7.3.1→7.3.2^6.3.6→^7.0.0GitHub Vulnerability Alerts
CVE-2026-39364
Summary
The contents of files that are specified by
server.fs.denycan be returned to the browser.Impact
Only apps that match the following conditions are affected:
--hostorserver.hostconfig option)server.fs.allowserver.fs.denyDetails
On the Vite dev server, files that should be blocked by
server.fs.deny(e.g.,.env,*.crt) can be retrieved with HTTP 200 responses when query parameters such as?raw,?import&raw, or?import&url&inlineare appended.PoC
pnpm exec vite root --host 127.0.0.1 --port 5175 --strictPortserver.fs.denyis enforced (expect 403):curl -i http://127.0.0.1:5175/src/.env | head -n 20CVE-2026-39365
Summary
Any files ending with
.mapeven out side the project can be returned to the browser.Impact
Only apps that match the following conditions are affected:
--hostorserver.hostconfig option).mapand the path is predictableDetails
In Vite v7.3.1, the dev server’s handling of
.maprequests for optimized dependencies resolves file paths and callsreadFilewithout restricting../segments in the URL. As a result, it is possible to bypass theserver.fs.strictallow list and retrieve.mapfiles located outside the project root, provided they can be parsed as valid source map JSON.PoC
/@​fsaccess is blocked bystrict(returns 403)../segments under the optimized deps.mapURL prefix to reach/tmp/poc.mapCVE-2026-39363
Summary
server.fscheck was not enforced to thefetchModulemethod that is exposed in Vite dev server's WebSocket.Impact
Only apps that match the following conditions are affected:
--hostorserver.hostconfig option)server.ws: falseArbitrary files on the server (development machine, CI environment, container, etc.) can be exposed.
Details
If it is possible to connect to the Vite dev server’s WebSocket without an
Originheader, an attacker can invokefetchModulevia the custom WebSocket eventvite:invokeand combinefile://...with?raw(or?inline) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g.,export default "...").The access control enforced in the HTTP request path (such as
server.fs.allow) is not applied to this WebSocket-based execution path.PoC
Start the dev server on the target
Example (used during validation with this repository):
pnpm -C playground/alias exec vite --host 0.0.0.0 --port 5173Confirm that access is blocked via the HTTP path (example: arbitrary file)
curl -i 'http://localhost:5173/@​fs/etc/passwd?raw'Result:
403 Restricted(outside the allow list)Confirm that the same file can be retrieved via the WebSocket path
By connecting to the HMR WebSocket without an
Originheader and sending avite:invokerequest that callsfetchModulewith afile://...URL and?raw, the file contents are returned as a JavaScript module.Release Notes
vitejs/vite (vite)
v7.3.2Compare Source
Please refer to CHANGELOG.md for details.
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.
Summary by CodeRabbit