chore(deps-dev): bump vite from 6.3.5 to 6.4.1 in the npm_and_yarn group across 1 directory#266
Conversation
Bumps the npm_and_yarn group with 1 update in the / directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Updates `vite` from 6.3.5 to 6.4.1 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/create-vite@6.4.1/packages/vite) --- updated-dependencies: - dependency-name: vite dependency-version: 6.4.1 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the Comment |
![semgrep-code-openzeppelin[bot]](https://avatars.githubusercontent.com/u/20820676?s=60&v=4){kind=small}
| engines: {node: '>=18.0.0', npm: '>=8.0.0'} | ||
| hasBin: true | ||
|
|
||
| rollup@4.53.3: |
There was a problem hiding this comment.
High severity vulnerability may affect your project—review required:
Line 3693 lists a dependency (rollup) with a known High severity vulnerability.
ℹ️ Why this matters
Affected versions of rollup are vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Rollup is vulnerable to arbitrary file write via path traversal: chunk/asset names derived from user-controlled inputs (e.g., CLI named inputs, manual chunk aliases, or malicious plugins) are insufficiently sanitized, allowing ../ sequences to survive and be passed into path.resolve when computing output paths. This lets an attacker escape the configured output directory and overwrite arbitrary files on the host filesystem that the build process can write to, potentially leading to persistent RCE by clobbering shell/profile or other executable/config files.
To resolve this comment:
Check if you are running rollup --input.
- If you're affected, upgrade this dependency to at least version 4.59.0 at pnpm-lock.yaml.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/npm_and_yarn-7372c7abf2
branch
1 participant
Bumps the npm_and_yarn group with 1 update in the / directory: vite.
Updates
vitefrom 6.3.5 to 6.4.1Release notes
Sourced from vite's releases.
Changelog
Sourced from vite's changelog.
... (truncated)
Commits
0a0c50arefactor: simplify pluginFilter implementation (#19828)59d0b35perf(css): avoid constructingrenderedModules(#19775)175a839fix: reject requests with#in request-target (#19830)e2e11b1fix(module-runner): allow already resolved id as entry (#19768)7200deefix: correct the behavior when multiple transform filter options are specifie...b125172fix(css): remove empty chunk imports correctly when chunk file name contained...8fe3538test: tweak generateCodeFrame test (#19812)36935b5fix(types): remove thekeepProcessEnvfrom theDefaultEnvironmentOptions...a0e1a04docs(vite): fix description oftransformIndexHtmlhook (#19799)71227befix: unbundlefdirto fixcommonjsOptions.dynamicRequireTargets(#19791)You can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.