From c0ed29a44e94b734d09c9c15447962451ca7e51d Mon Sep 17 00:00:00 2001 From: Mish Ushakov <10400064+mishushakov@users.noreply.github.com> Date: Thu, 23 Jul 2026 17:04:43 +0200 Subject: [PATCH] fix: bump vite to 7.3.5 to resolve GHSA-fx2h-pf6j-xcff Resolves Dependabot alert #185 (CVE-2026-53571), a server.fs.deny bypass in the vite dev server on Windows. Lockfile-only change; vite is a transitive dev dependency via vitest. Co-Authored-By: Claude Fable 5 --- pnpm-lock.yaml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index c0f33283..936025ff 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -71,7 +71,7 @@ importers: version: 5.7.3 vitest: specifier: ^4.1.0 - version: 4.1.10(@types/node@20.19.43)(vite@7.3.2(@types/node@20.19.43)(jiti@2.7.0)(yaml@2.9.0)) + version: 4.1.10(@types/node@20.19.43)(vite@7.3.5(@types/node@20.19.43)(jiti@2.7.0)(yaml@2.9.0)) python: {} @@ -1957,8 +1957,8 @@ packages: uri-js@4.4.1: resolution: {integrity: sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==} - vite@7.3.2: - resolution: {integrity: sha512-Bby3NOsna2jsjfLVOHKes8sGwgl4TT0E6vvpYgnAYDIF/tie7MRaFthmKuHx1NSXjiTueXH3do80FMQgvEktRg==} + vite@7.3.5: + resolution: {integrity: sha512-KuOaNhcnGFN2zIPGA7wRmzF+lJA1sea7rHq17aiJ++9lzY1WWG6Jpwqwe1KNbRVPIqHmr8GLYx7jbrQcN/7/ww==} engines: {node: ^20.19.0 || >=22.12.0} hasBin: true peerDependencies: @@ -2825,13 +2825,13 @@ snapshots: chai: 6.2.2 tinyrainbow: 3.1.0 - '@vitest/mocker@4.1.10(vite@7.3.2(@types/node@20.19.43)(jiti@2.7.0)(yaml@2.9.0))': + '@vitest/mocker@4.1.10(vite@7.3.5(@types/node@20.19.43)(jiti@2.7.0)(yaml@2.9.0))': dependencies: '@vitest/spy': 4.1.10 estree-walker: 3.0.3 magic-string: 0.30.21 optionalDependencies: - vite: 7.3.2(@types/node@20.19.43)(jiti@2.7.0)(yaml@2.9.0) + vite: 7.3.5(@types/node@20.19.43)(jiti@2.7.0)(yaml@2.9.0) '@vitest/pretty-format@4.1.10': dependencies: @@ -3823,7 +3823,7 @@ snapshots: dependencies: punycode: 2.3.1 - vite@7.3.2(@types/node@20.19.43)(jiti@2.7.0)(yaml@2.9.0): + vite@7.3.5(@types/node@20.19.43)(jiti@2.7.0)(yaml@2.9.0): dependencies: esbuild: 0.27.7 fdir: 6.5.0(picomatch@4.0.5) @@ -3837,10 +3837,10 @@ snapshots: jiti: 2.7.0 yaml: 2.9.0 - vitest@4.1.10(@types/node@20.19.43)(vite@7.3.2(@types/node@20.19.43)(jiti@2.7.0)(yaml@2.9.0)): + vitest@4.1.10(@types/node@20.19.43)(vite@7.3.5(@types/node@20.19.43)(jiti@2.7.0)(yaml@2.9.0)): dependencies: '@vitest/expect': 4.1.10 - '@vitest/mocker': 4.1.10(vite@7.3.2(@types/node@20.19.43)(jiti@2.7.0)(yaml@2.9.0)) + '@vitest/mocker': 4.1.10(vite@7.3.5(@types/node@20.19.43)(jiti@2.7.0)(yaml@2.9.0)) '@vitest/pretty-format': 4.1.10 '@vitest/runner': 4.1.10 '@vitest/snapshot': 4.1.10 @@ -3857,7 +3857,7 @@ snapshots: tinyexec: 1.2.4 tinyglobby: 0.2.17 tinyrainbow: 3.1.0 - vite: 7.3.2(@types/node@20.19.43)(jiti@2.7.0)(yaml@2.9.0) + vite: 7.3.5(@types/node@20.19.43)(jiti@2.7.0)(yaml@2.9.0) why-is-node-running: 2.3.0 optionalDependencies: '@types/node': 20.19.43