[decofe]

Vite 8.2.2 bundles vulnerable editor-launching code that can allow command execution on Windows or WSL under the conditions described in the upstream advisories. Pin Vite to the patched 8.2.4 release and update its lockfile entry; the installed bundle contains launch-editor 2.14.2, and all Vitest consumers resolve to the same patched Vite copy.

Addresses the three advisories reported by Dependabot alerts 5–10: GHSA-698v-4r3x-3vcv, GHSA-587h-7wmj-h5pm, and GHSA-r825-w8mm-5pxw. Vite is development tooling in this repository. This change does not establish deployment or downstream adoption.

Validation:

• Clean npm ci --ignore-scripts succeeds.
• npm test passes: type checking, JSON formatting, generated manifests, Gemini build, and 48 tests.
• claude plugin validate --strict . and gh skill publish --dry-run pass.
• Live MCP tests with the sandbox HTTP proxy enabled: Tempo Docs passes; Mercator fails because its initialize endpoint returns HTTP 200 while the existing test expects 401. Direct connections time out in this sandbox. Live MCP validation is therefore incomplete.

This keeps the existing Vite 8.2 release line. The broader Vite update is also proposed in PR #66. The separate source-map-js alert is outside this change and has PR #55.

Prompted by: @sds

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vite@​8.2.2 ⏵ 8.2.4		+22	+1	+2

View full report

[claude]

LGTM. This is a simple patch bump of a dev dependency, and the manifest and lockfile match.

What was reviewed:

• package.json and the lockfile's root devDependencies both pin vite at exactly 8.2.4, so the exact-pin style is kept.
• The node_modules/vite entry has the new version, the registry tarball URL and a new integrity hash. Its dependencies and peer dependencies are unchanged.
• The lockfile has only one vite copy, and the vitest-side peer ranges (^6 || ^7 || ^8) still accept 8.2.4. I couldn't check the integrity hash against the registry from here, but npm ci would fail if it were wrong.

Extended reasoning...

The change touches only package.json and package-lock.json, moving the dev-only vite dependency from 8.2.2 to 8.2.4 within the same minor line. It changes no application code and no runtime security surface. The bump pulls in upstream fixes to editor-launching code in the dev server. Approval rests on how small and mechanical the change is: the two files agree, there are no nested vite copies, and dependent peer ranges still fit. There is no CODEOWNERS file, and the timeline shows no other reviewer objections.