Repository navigation
chore: bump vite from 8.2.2 to 8.3.5 - #66
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 8.2.2 to 8.3.5. - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.3.5/packages/vite) --- updated-dependencies: - dependency-name: vite dependency-version: 8.3.5 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Caution Review the following alerts detected in dependencies. According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM. This is a routine Dependabot bump of the vite dev dependency from 8.2.2 to 8.3.5.
What was reviewed:
- The exact-pinned vite version in package.json, and the lockfile entries for vite, rolldown, the 15
@ rolldown/binding-*packages and@ oxc-project/types. Every newresolvedURL points to registry.npmjs.org. - vite's new requirements are met: picomatch is 4.0.7 and rolldown is 1.2.15.
@ vitejs/devtoolsis an optional peer and isn't installed, so its new range doesn't matter here. - postcss stays at 8.5.25, below vite's new
^8.5.30. That's expected: theoverridesentry in package.json pins postcss to 8.5.25, and that pin was already below what vite 8.2.2 asked for (^8.5.26). This isn't a new inconsistency, and npm honors overrides.
Extended reasoning...
The change only touches package.json (one devDependency version line) and package-lock.json (vite and the transitive packages it pulls in). No source code changes, and no security-sensitive code is involved. All resolved tarballs come from the public npm registry. The lockfile's postcss version looked like a mismatch, but it comes from the existing postcss override, so the lockfile is consistent. There are no CODEOWNERS files, no prior review comments, and the bug hunt ran to completion (dry_streak) with no findings.
Vite 8.2.2 bundles vulnerable editor-launching code that can allow command execution on Windows or WSL under the conditions described in the upstream advisories. Pin Vite to the patched 8.2.4 release and update its lockfile entry; the installed bundle contains launch-editor 2.14.2, and all Vitest consumers resolve to the same patched Vite copy. Addresses the three advisories reported by [Dependabot alerts 5–10](https://github.com/tempoxyz/plugins/security/dependabot): [GHSA-698v-4r3x-3vcv](GHSA-698v-4r3x-3vcv), [GHSA-587h-7wmj-h5pm](GHSA-587h-7wmj-h5pm), and [GHSA-r825-w8mm-5pxw](GHSA-r825-w8mm-5pxw). Vite is development tooling in this repository. This change does not establish deployment or downstream adoption. Validation: - Clean `npm ci --ignore-scripts` succeeds. - `npm test` passes: type checking, JSON formatting, generated manifests, Gemini build, and 48 tests. - `claude plugin validate --strict .` and `gh skill publish --dry-run` pass. - Live MCP tests with the sandbox HTTP proxy enabled: Tempo Docs passes; Mercator fails because its initialize endpoint returns HTTP 200 while the existing test expects 401. Direct connections time out in this sandbox. Live MCP validation is therefore incomplete. This keeps the existing Vite 8.2 release line. The broader Vite update is also proposed in [PR #66](#66). The separate source-map-js alert is outside this change and has [PR #55](#55). Prompted by: @sds Co-authored-by: Shane da Silva <shane@tempo.xyz>
|
Looks like vite is up-to-date now, so this is no longer needed. |
Bumps vite from 8.2.2 to 8.3.5.
Release notes
Sourced from vite's releases.
... (truncated)
Changelog
Sourced from vite's changelog.
... (truncated)
Commits
981f07frelease: v8.3.5 (#23856)0d86b34fix(resolve): support subpath imports with multiple#(#23631)6a02780perf(ssr): extract inline source maps without a regexp (#23775)8e890e1fix(optimizer): skip patches dir check for yarn.lock fallback (#23725)197daf6fix(bundled-dev): declare utf-8 charset in fallback page (#23846)4d16e7cfix(build): include preload dependencies to chunk import map hashing (#23793)df7b40erefactor(dev): consolidate moduleURL to file path utilities (#23828)a162990refactor(dev): use ModuleURLs throughout HTML transforms (#23815)6116689refactor(dev): separate import resolution from URL conversion (#23791)446954crefactor(dev): share ModuleURL and BrowserURL conversions (#23790)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.