Update dependency vite to v6 [SECURITY] #2
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/npm-vite-vulnerability"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
^5.0.8→^6.0.0Vite Vulnerable to Path Traversal in Optimized Deps
.mapHandlingCVE-2026-39365 / GHSA-4w7w-66w2-5vf9
More information
Details
Summary
Any files ending with
.mapeven out side the project can be returned to the browser.Impact
Only apps that match the following conditions are affected:
--hostorserver.hostconfig option).mapand the path is predictableDetails
In Vite v7.3.1, the dev server’s handling of
.maprequests for optimized dependencies resolves file paths and callsreadFilewithout restricting../segments in the URL. As a result, it is possible to bypass theserver.fs.strictallow list and retrieve.mapfiles located outside the project root, provided they can be parsed as valid source map JSON.PoC
/@​fsaccess is blocked bystrict(returns 403)../segments under the optimized deps.mapURL prefix to reach/tmp/poc.mapSeverity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
vitejs/vite (vite)
v6.4.2Compare Source
Please refer to CHANGELOG.md for details.
v6.4.1Compare Source
Please refer to CHANGELOG.md for details.
v6.4.0Compare Source
Please refer to CHANGELOG.md for details.
v6.3.7Compare Source
Please refer to CHANGELOG.md for details.
v6.3.6Compare Source
Please refer to CHANGELOG.md for details.
v6.3.5Compare Source
Today, we're excited to announce the release of the next Vite major:
⚠ BREAKING CHANGES
Objectvariable in ssr transformed code (#19996) (fceff60)experimental.skipSsrTransformoption (#20038) (6c3dd8e)HotBroadcaster(#19988) (cda8c94)build.targetand name itbaseline-widely-available(#20007) (4a8aa82)HotBroadcasterrelated types (#19987) (86b5e00)enforce/transformfromtransformIndexHtmlhook (#19349) (6198b9d)Features
configurePreviewServerhook (#20224) (b989c42)configureServerhook (#20222) (f5cc4c0)this.meta.viteVersion(#20088) (f55bf41)createServer(#19894) (c1ae9bd)build.targetand name itbaseline-widely-available(#20007) (4a8aa82)css.preprocessorMaxWorkersand default totrue(#19992) (70aee13)optimizeDeps.noDiscovery(#19984) (6d2dcb4)Bug Fixes
import.meta.urlin bundled Vite (#20235) (3bf3a8a)ssrExportNameKey(#20266) (ac302a7)normalizeModuleId(#20277) (9b98dcb).then(m => m.a)(#20117) (7b7410a)build.rollupOptions.inputresolution with rollup (#20080) (9759c29)Objectvariable in ssr transformed code (#19996) (fceff60)preprocessorOptions.sass(fix #20150) (#20166) (7db56be)cleanGlobalCLIOptions()clean--force(#19999) (d4a171a)environments.*.resolve.noExternalproperly (#20077) (daf4a25)server.allowedHosts: truecorrectly (#20138) (2ade756)computeEntriesfailed (#20079) (b742b46)optimizeDeps.entriesvalues as globs (#20045) (1422395)Performance Improvements
numberToPos(#20244) (3f46901)Documentation
Miscellaneous Chores
ResolvedConfig.createResolverand recommendcreateIdResolver(#20031) (d101d64)devEnvironmentOptions.moduleRunnerTransform(#20035) (338081d)patch-typesplugin for bundling vite (#20089) (c127955)Code Refactoring
src/node/publicUtils.tstosrc/node/index.ts(#20086) (999a1ed)experimental.skipSsrTransformoption (#20038) (6c3dd8e)HotBroadcaster(#19988) (cda8c94)options?.ssrsupport in clientInjectionsPlugin (#19589) (88e0076)HotBroadcasterrelated types (#19987) (86b5e00)enforce/transformfromtransformIndexHtmlhook (#19349) (6198b9d)legacy.proxySsrExternalModules(#20013) (a37ac83)hostValidationMiddleware(#20019) (83bf90e)mergeWithDefaultsfor experimental option (#20012) (98c5741)Tests
useDefineForClassFieldstest (#20143) (d90796e)Continuous Integration
Beta Changelogs
7.0.0-beta.2 (2025-06-17)
See 7.0.0-beta.2 changelog
7.0.0-beta.1 (2025-06-10)
See 7.0.0-beta.1 changelog
7.0.0-beta.0 (2025-06-02)
See 7.0.0-beta.0 changelog
v6.3.4Compare Source
Bug Fixes
requireto import externals in optimized dependencies (#19940) (efc5eab)Code Refactoring
v6.3.3Compare Source
Bug Fixes
Performance Improvements
Tests
ssrTransformre-export deps and test stacktrace with first line (#19629) (9399cda)v6.3.2Compare Source
Features
Bug Fixes
css.lightningcssoption in css minification process (#19879) (b5055e0)v6.3.1Compare Source
Bug Fixes
Promise.allSettledin preload function (#19805) (35c7f35)transformcalls (#19878) (a152b7c)v6.3.0Compare Source
Features
CustomPluginOptionsVitetype (#19557) (15abc01)define['process.env']containspathkey with a value (#19517) (832b2c4)Bug Fixes
hot.invalidatein circular deps (#19870) (d4ee5e8)#in request-target (#19830) (175a839)keepProcessEnvfrom theDefaultEnvironmentOptionstype (#19796) (36935b5)fdirto fixcommonjsOptions.dynamicRequireTargets(#19791) (71227be).mtsto defaultresolve.extensions(#19701) (ae91bd0)Performance Improvements
renderedModules(#19775) (59d0b35)debug(#19715) (e435aae)Documentation
transformIndexHtmlhook (#19799) (a0e1a04)Miscellaneous Chores
Code Refactoring
[hookName].handlerin plugins (#19586) (9827df2)Tests
Beta Changelogs
6.3.0-beta.2 (2025-04-11)
See 6.3.0-beta.2 changelog
6.3.0-beta.1 (2025-04-03)
See 6.3.0-beta.1 changelog
6.3.0-beta.0 (2025-03-26)
See 6.3.0-beta.0 changelog
v6.2.7Compare Source
Please refer to CHANGELOG.md for details.
v6.2.6Compare Source
Please refer to CHANGELOG.md for details.
v6.2.5Compare Source
Please refer to CHANGELOG.md for details.
v6.2.4Compare Source
Please refer to CHANGELOG.md for details.
v6.2.3Compare Source
Please refer to CHANGELOG.md for details.
v6.2.2Compare Source
Features
CustomPluginOptionsVitetype (#19557) (15abc01)define['process.env']containspathkey with a value (#19517) (832b2c4)Bug Fixes
hot.invalidatein circular deps (#19870) (d4ee5e8)#in request-target (#19830) (175a839)keepProcessEnvfrom theDefaultEnvironmentOptionstype (#19796) (36935b5)fdirto fixcommonjsOptions.dynamicRequireTargets(#19791) (71227be).mtsto defaultresolve.extensions(#19701) (ae91bd0)Performance Improvements
renderedModules(#19775) (59d0b35)debug(#19715) (e435aae)Documentation
transformIndexHtmlhook (#19799) (a0e1a04)Miscellaneous Chores
Code Refactoring
[hookName].handlerin plugins (#19586) (9827df2)Tests
Beta Changelogs
6.3.0-beta.2 (2025-04-11)
See 6.3.0-beta.2 changelog
6.3.0-beta.1 (2025-04-03)
See 6.3.0-beta.1 changelog
6.3.0-beta.0 (2025-03-26)
See 6.3.0-beta.0 changelog
v6.2.1Compare Source
Features
*?url&no-inlinetype and warning for.json?inline/.json?no-inline(#19566) (c0d3667)Bug Fixes
Performance Improvements
Miscellaneous Chores
Code Refactoring
isBuildcheck from preAliasPlugin (#19587) (c9e086d)applyToEnvironmentin internal plugins (#19588) (f678442)Tests
v6.2.0Compare Source
Features
modeon server start and add env debugger (#18808) (c575b82)Bug Fixes
?.afterthis.getModuleInfoinvite:css-post(#19478) (12b0b8a)Miscellaneous Chores
Beta Changelogs
6.2.0-beta.1 (2025-02-21)
See 6.2.0-beta.1 changelog
6.2.0-beta.0 (2025-02-21)
See 6.2.0-beta.0 changelog
v6.1.6Compare Source
Please refer to CHANGELOG.md for details.
v6.1.5Compare Source
Please refer to CHANGELOG.md for details.
v6.1.4Compare Source
Please refer to CHANGELOG.md for details.
v6.1.3Compare Source
Please refer to CHANGELOG.md for details.
v6.1.2Compare Source
Please refer to CHANGELOG.md for details.
v6.1.1Compare Source
Features
modeon server start and add env debugger (#18808) (c575b82)Bug Fixes
?.afterthis.getModuleInfoinvite:css-post(#19478) (12b0b8a)Miscellaneous Chores
Beta Changelogs
6.2.0-beta.1 (2025-02-21)
See 6.2.0-beta.1 changelog
6.2.0-beta.0 (2025-02-21)
See 6.2.0-beta.0 changelog
v6.1.0Compare Source
Features
Bug Fixes
.[cm]?[tj]sx?static assets are JS mime (#19453) (e7ba55e)*.ipv4address in cert (#19416) (973283b)Miscellaneous Chores
Code Refactoring
v6.0.15Compare Source
Please refer to CHANGELOG.md for details.
v6.0.14Compare Source
Please refer to CHANGELOG.md for details.
v6.0.13Compare Source
Please refer to CHANGELOG.md for details.
v6.0.12Compare Source
Please refer to CHANGELOG.md for details.
v6.0.11Compare Source
Features
portin the logged error message after failed WS connection withEADDRINUSE(#19212) (14027b0).jxl(#18855) (57b397c)builtinsenvironmentresolve(#18584) (2c2d521)defaultAllowedOriginsfor user-land config and 3rd party plugins (#19259) (dc8946b)wasmto the compressible assets regex (#19085) (ce84142)Bug Fixes
resolveLibCssFilename(#19324) (f183bdf)[@plugin](https://github.com/plugin)imports of JS files treated as CSS and rebased (fix #19268) (#19269) (602b373)vite optimize(#19347) (19ffad0)resolve.builtinis empty (#19312) (b7aba0b)server.preTransformRequests(#19272) (12aaa58)ssrLoadModule(#19290) (353c467)nodeLikeBuiltinsforssr.target: 'webworker'withoutnoExternal: true(#19313) (9fc31b6)--forcework for all environments (#18901) (51a42c6)RegExpvalues withnew RegExpinstead ofstructuredClone(fix #19245, fix #18875) (#19247) (56ad2be)Performance Improvements
Documentation
build.manifestjsdocs (#19332) (4583781)Code Refactoring
vite optimizecommand (#19348) (6e0e3c0)Miscellaneous Chores
scanImportsnot being used in ssr (#19285) (fbbc6da)Beta Changelogs
6.1.0-beta.2 (2025-02-04)
See 6.1.0-beta.2 changelog
6.1.0-beta.1 (2025-02-04)
See 6.1.0-beta.1 changelog
6.1.0-beta.0 (2025-01-24)
See 6.1.0-beta.0 changelog
v6.0.10Compare Source
Bug Fixes
server.originURL (#19241) (2495022)v6.0.9Compare Source
⚠ BREAKING CHANGES
server.allowedHosts(bd896fb)server.cors: falseto disallow fetching from untrusted origins (b09572a)Bug Fixes
server.allowedHosts(bd896fb)server.cors: falseto disallow fetching from untrusted origins (b09572a)v6.0.8Compare Source
Bug Fixes
server.close()only called once (#19204) (db81c2d)defaultServerConditions(#19174) (ad75c56)ESBuildOptions.include / excludetype to allowreadonly (string | RegExp)[](#19146) (ea53e70)Miscellaneous Chores
v6.0.7Compare Source
Features
Bug Fixes
minifywhenbuilder.sharedPlugins: true(#19025) (f7b1964)vite-ignoreattribute for inline script (#19062) (a492253)Performance Improvements
v6.0.6Compare Source
Bug Fixes
fetchModule-side resolve (#18361) (9f10261)Reverts
Miscellaneous Chores
build.target(#19047) (0e9e81f)Tests
v6.0.5Compare Source
Bug Fixes
v6.0.4Compare Source
Bug Fixes
this.resolveskipSelf should not skip for differentidorimport(#18903) (4727320)url()when lightningcss is used (#18997) (3734f80)pluginContainer.getModuleInfo(#18895) (258cdd6)true(#18899) (8a6bb4e)Miscellaneous Chores
Code Refactoring
handleInvoke(#18902) (27f691b)Tests
ModuleRunnerTransportinvokeAPI (#18865) (e5f5301)v6.0.3Compare Source
Bug Fixes
ModuleRunnerTransport[#invoke](https://github.com/vitejs/vite/issues/invoke)more explicit (#18851) (a75fc31)environments.ssr.resolvewith rootssrconfig (#18857) (3104331)Miscellaneous Chores
Code Refactoring
v6.0.2Compare Source
Features
Bug Fixes
node_modulesif deno (#18823) (a20267b)style.cssas a key for the style file forcssCodesplit: false(#18820) (ec51115)externalby default (#18821) (2250ffa)ssr.target: 'webworker'defaults as fallback (#18827) (b39e696)Miscellaneous Chores
Code Refactoring
v6.0.1Compare Source
Features
portin the logged error message after failed WS connection withEADDRINUSE(#19212) (14027b0).jxl(#18855) (57b397c)builtinsenvironmentresolve(#18584) (2c2d521)defaultAllowedOriginsfor user-land config and 3rd party plugins (#19259) (dc8946b)wasmto the compressible assets regex (#19085) (ce84142)Bug Fixes
resolveLibCssFilename(#19324) (f183bdf)[@plugin](https://github.com/plugin)imports of JS files treated as CSS and rebased (fix #19268) (#19269) (602b373)vite optimize(#19347) (19ffad0)resolve.builtinis empty (#19312) (b7aba0b)server.preTransformRequests(#19272) (12aaa58)ssrLoadModule(#19290) (353c467)nodeLikeBuiltinsforssr.target: 'webworker'withoutnoExternal: true(#19313) (9fc31b6)--forcework for all environments (#18901) (51a42c6)RegExpvalues withnew RegExpinstead ofstructuredClone(fix #19245, fix #18875) (#19247) (56ad2be)Performance Improvements
Documentation
build.manifestjsdocs (#19332) (4583781)Code Refactoring
vite optimizecommand (#19348) (6e0e3c0)Miscellaneous Chores
scanImportsnot being used in ssr (#19285) (fbbc6da)Beta Changelogs
6.1.0-beta.2 (2025-02-04)
See 6.1.0-beta.2 changelog
6.1.0-beta.1 (2025-02-04)
See 6.1.0-beta.1 changelog
6.1.0-beta.0 (2025-01-24)
See 6.1.0-beta.0 changelog
v6.0.0Compare Source
Features
portin the logged error message after failed WS connection withEADDRINUSE(#19212) (14027b0).jxl(#18855) (57b397c)builtinsenvironmentresolve(#18584) (2c2d521)defaultAllowedOriginsfor user-land config and 3rd party plugins (#19259) (dc8946b)wasmto the compressible assets regex (#19085) (ce84142)Bug Fixes
resolveLibCssFilename(#19324) (f183bdf)[@plugin](https://github.com/plugin)imports of JS files treated as CSS and rebased (fix #19268) (#19269) (602b373)vite optimize(#19347) (19ffad0)resolve.builtinis empty (#19312) (b7aba0b)server.preTransformRequests(#19272) (12aaa58)ssrLoadModule(#19290) (353c467)nodeLikeBuiltinsforssr.target: 'webworker'withoutnoExternal: true(#19313) (9fc31b6)--forcework for all environments (#18901) (51a42c6)RegExpvalues withnew RegExpinstead ofstructuredClone(fix #19245, fix #18875) (#19247) (56ad2be)Performance Improvements
Documentation
build.manifestjsdocs (#19332) (4583781)Code Refactoring
vite optimizecommand (#19348) (6e0e3c0)Miscellaneous Chores
scanImportsnot being used in ssr (#19285) (fbbc6da)Beta Changelogs
6.1.0-beta.2 (2025-02-04)
See 6.1.0-beta.2 changelog
6.1.0-beta.1 (2025-02-04)
See 6.1.0-beta.1 changelog
6.1.0-beta.0 (2025-01-24)
See 6.1.0-beta.0 changelog
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.
2005796e76tofd0b5b44fb