Skip to content

chore(deps): update dependency vite to v7.1.11 [security] #6149

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Oct 24, 2025
Merged

chore(deps): update dependency vite to v7.1.11 [security] #6149

merged 2 commits into from
Oct 24, 2025

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Oct 20, 2025 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
vite (source) 7.1.10 -> 7.1.11 age confidence

GitHub Vulnerability Alerts

CVE-2025-62522

Summary

Files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows.

Impact

Only apps that match the following conditions are affected:

  • explicitly exposes the Vite dev server to the network (using --host or server.host config option)
  • running the dev server on Windows

Details

server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass by using a back slash(\). The root cause is that fs.readFile('/foo.png/') loads /foo.png.

PoC

npm create vite@latest
cd vite-project/
cat "secret" > .env
npm install
npm run dev
curl --request-target /.env\ http://localhost:5173
image

Release Notes

vitejs/vite (vite)

v7.1.11

Compare Source

Bug Fixes
Miscellaneous Chores
Code Refactoring
Build System

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot enabled auto-merge October 20, 2025 21:54
@github-actions
Copy link

github-actions bot commented Oct 20, 2025 •
edited
Loading

Thank you for your contribution! ❤️

You can try out this pull request locally by installing Rollup via

npm install rollup/rollup#renovate/npm-vite-vulnerability

Notice: Ensure you have installed the latest nightly Rust toolchain. If you haven't installed it yet, please see https://www.rust-lang.org/tools/install to learn how to download Rustup and install Rust.

or load it into the REPL:
https://rollup-hrtlimli7-rollup-js.vercel.app/repl/?pr=6149

@github-actions
Copy link

github-actions bot commented Oct 20, 2025 •
edited
Loading

Performance report

  • BUILD: 6530ms, 824 MB
    • initialize: 0ms, 25 MB
    • generate module graph: 2321ms, 631 MB
      • generate ast: 1238ms, 621 MB
    • sort and bind modules: 349ms, 689 MB
    • mark included statements: 3856ms, 824 MB
      • treeshaking pass 1: 2315ms, 821 MB
      • treeshaking pass 2: 443ms, 819 MB (-2%)
      • treeshaking pass 3: 374ms, 826 MB
      • treeshaking pass 4: 360ms, 824 MB (-2%)
      • treeshaking pass 5: 357ms, 824 MB
  • GENERATE: 957ms (+168ms, +21.3%), 922 MB
    • initialize render: 0ms, 905 MB (-3%)
    • generate chunks: 157ms (-40ms, -20.5%), 862 MB (+4%)
      • optimize chunks: 0ms, 885 MB (-3%)
    • render chunks: 583ms, 899 MB
    • transform chunks: 19ms, 922 MB
    • generate bundle: 0ms, 922 MB

@codecov
Copy link

codecov bot commented Oct 20, 2025 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.72%. Comparing base (55a8fd5) to head (80811ea).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files 
@@           Coverage Diff           @@
##           master    #6149   +/-   ##
=======================================
  Coverage   98.72%   98.72%           
=======================================
  Files         271      271           
  Lines       10638    10638           
  Branches     2847     2847           
=======================================
  Hits        10502    10502           
  Misses         91       91           
  Partials       45       45

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@vercel
Copy link

vercel bot commented Oct 24, 2025 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Preview Comments Updated (UTC)
rollup Ready Ready Preview Comment Oct 24, 2025 4:12am

@renovate
Copy link
Contributor Author

renovate bot commented Oct 24, 2025

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@renovate renovate bot added this pull request to the merge queue Oct 24, 2025
Merged via the queue into master with commit 69e869a Oct 24, 2025
46 checks passed
@renovate renovate bot deleted the renovate/npm-vite-vulnerability branch October 24, 2025 04:46
@github-actions
Copy link

github-actions bot commented Nov 7, 2025

This PR has been released as part of [email protected]. You can test it via npm install rollup.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@renovate-approve renovate-approve[bot] renovate-approve[bot] approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant