chore(deps): update dependency vite-5 to v5.4.20 [security] #32458

renovate · 2025-09-10T01:45:28Z

Coming soon: The Renovate bot (GitHub App) will be renamed to Mend. PRs from Renovate will soon appear from 'Mend'. Learn more here.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
vite-5 (source)	`^5.4.19` -> `^7.1.5`

GitHub Vulnerability Alerts

CVE-2025-58752

Summary

Any HTML files on the machine were served regardless of the server.fs settings.

Impact

Only apps that match the following conditions are affected:

explicitly exposes the Vite dev server to the network (using --host or server.host config option)
appType: 'spa' (default) or appType: 'mpa' is used

This vulnerability also affects the preview server. The preview server allowed HTML files not under the output directory to be served.

Details

The serveStaticMiddleware function is in charge of serving static files from the server. It returns the viteServeStaticMiddleware function which runs the needed tests and serves the page. The viteServeStaticMiddleware function checks if the extension of the requested file is ".html". If so, it doesn't serve the page. Instead, the server will go on to the next middlewares, in this case htmlFallbackMiddleware, and then to indexHtmlMiddleware. These middlewares don't perform any test against allow or deny rules, and they don't make sure that the accessed file is in the root directory of the server. They just find the file and send back its contents to the client.

PoC

Execute the following shell commands:

npm  create  vite@latest
cd vite-project/
echo  "secret" > /tmp/secret.html
npm install
npm run dev

Then, in a different shell, run the following command:

curl -v --path-as-is 'http://localhost:5173/../../../../../../../../../../../tmp/secret.html'

The contents of /tmp/secret.html will be returned.

This will also work for HTML files that are in the root directory of the project, but are in the deny list (or not in the allow list). Test that by stopping the running server (CTRL+C), and running the following commands in the server's shell:

echo  'import path from "node:path"; import { defineConfig } from "vite"; export default defineConfig({server: {fs: {deny: [path.resolve(__dirname, "secret_files/*")]}}})'  >  [vite.config.js](http://vite.config.js)
mkdir secret_files
echo "secret txt" > secret_files/secret.txt
echo "secret html" > secret_files/secret.html
npm run dev

Then, in a different shell, run the following command:

curl -v --path-as-is 'http://localhost:5173/secret_files/secret.txt'

You will receive a 403 HTTP Response, because everything in the secret_files directory is denied.

Now in the same shell run the following command:

curl -v --path-as-is 'http://localhost:5173/secret_files/secret.html'

You will receive the contents of secret_files/secret.html.

CVE-2025-58751

Summary

Files starting with the same name with the public directory were served bypassing the server.fs settings.

Impact

Only apps that match the following conditions are affected:

explicitly exposes the Vite dev server to the network (using --host or server.host config option)
uses the public directory feature (enabled by default)
a symlink exists in the public directory

Details

The servePublicMiddleware function is in charge of serving public files from the server. It returns the viteServePublicMiddleware function which runs the needed tests and serves the page. The viteServePublicMiddleware function checks if the publicFiles variable is defined, and then uses it to determine if the requested page is public. In the case that the publicFiles is undefined, the code will treat the requested page as a public page, and go on with the serving function. publicFiles may be undefined if there is a symbolic link anywhere inside the public directory. In that case, every requested page will be passed to the public serving function. The serving function is based on the sirv library. Vite patches the library to add the possibility to test loading access to pages, but when the public page middleware disables this functionality since public pages are meant to be available always, regardless of whether they are in the allow or deny list.

In the case of public pages, the serving function is provided with the path to the public directory as a root directory. The code of the sirv library uses the join function to get the full path to the requested file. For example, if the public directory is "/www/public", and the requested file is "myfile", the code will join them to the string "/www/public/myfile". The code will then pass this string to the normalize function. Afterwards, the code will use the string's startsWith function to determine whether the created path is within the given directory or not. Only if it is, it will be served.

Since sirv trims the trailing slash of the public directory, the string's startsWith function may return true even if the created path is not within the public directory. For example, if the server's root is at "/www", and the public directory is at "/www/p", if the created path will be "/www/private.txt", the startsWith function will still return true, because the string "/www/private.txt" starts with "/www/p". To achieve this, the attacker will use ".." to ask for the file "../private.txt". The code will then join it to the "/www/p" string, and will receive "/www/p/../private.txt". Then, the normalize function will return "/www/private.txt", which will then be passed to the startsWith function, which will return true, and the processing of the page will continue without checking the deny list (since this is the public directory middleware which doesn't check that).

PoC

Execute the following shell commands:

npm  create  vite@latest
cd vite-project/
mkdir p
cd p
ln -s a b
cd ..
echo  'import path from "node:path"; import { defineConfig } from "vite"; export default defineConfig({publicDir: path.resolve(__dirname, "p/"), server: {fs: {deny: [path.resolve(__dirname, "private.txt")]}}})' > vite.config.js
echo  "secret" > private.txt
npm install
npm run dev

Then, in a different shell, run the following command:

curl -v --path-as-is 'http://localhost:5173/private.txt'

You will receive a 403 HTTP Response, because private.txt is denied.

Now in the same shell run the following command:

curl -v --path-as-is 'http://localhost:5173/../private.txt'

You will receive the contents of private.txt.

Release Notes

vitejs/vite (vite-5)

`v7.1.5`

Compare Source

Bug Fixes

apply fs.strict check to HTML files (#20736) (14015d7)
deps: update all non-major dependencies (#20732) (122bfba)
upgrade sirv to 3.0.2 (#20735) (09f2b52)

`v7.1.4`

Compare Source

Bug Fixes

add missing awaits (#20697) (79d10ed)
deps: update all non-major dependencies (#20676) (5a274b2)
deps: update all non-major dependencies (#20709) (0401feb)
pass rollup watch options when building in watch mode (#20674) (f367453)

Miscellaneous Chores

remove unused constants entry from rolldown.config.ts (#20710) (537fcf9)

Code Refactoring

remove unnecessary minify parameter from finalizeCss (#20701) (8099582)

`v7.1.3`

Compare Source

Features

cli: add Node.js version warning for unsupported versions (#20638) (a1be1bf)
generate code frame for parse errors thrown by terser (#20642) (a9ba017)
support long lines in generateCodeFrame (#20640) (1559577)

Bug Fixes

deps: update all non-major dependencies (#20634) (4851cab)
optimizer: incorrect incompatible error (#20439) (446fe83)
support multiline new URL(..., import.meta.url) expressions (#20644) (9ccf142)

Performance Improvements

cli: dynamically import resolveConfig (#20646) (f691f57)

Miscellaneous Chores

deps: update rolldown-related dependencies (#20633) (98b92e8)

Code Refactoring

replace startsWith with strict equality (#20603) (42816de)
use import in worker threads (#20641) (530687a)

Tests

remove checkNodeVersion test (#20647) (731d3e6)

`v7.1.2`

Compare Source

Bug Fixes

client: add [vite] prefixes to debug logs (#20595) (7cdef61)
config: make debugger work with bundle loader (#20573) (c583927)
deps: update all non-major dependencies (#20587) (20d4817)
don't consider ids with npm: prefix as a built-in module (#20558) (ab33803)
hmr: watch non-inlined assets referenced by CSS (#20581) (b7d494b)
module-runner: prevent crash when sourceMappingURL pattern appears in string literals (#20554) (2770478)

Miscellaneous Chores

deps: migrate to @jridgewell/remapping from @ampproject/remapping (#20577) (0a6048a)
deps: update rolldown-related dependencies (#20586) (77632c5)

`v7.1.1`

Compare Source

Bug Fixes

deps: update launch-editor-middleware (#20569) (826b394)

Miscellaneous Chores

fix changelog beta links (#20561) (2e0c21a)
update 7.1 changelog (#20560) (d8869b8)

`v7.1.0`

Compare Source

Features

support files with more than 1000 lines by generateCodeFrame (#20508) (e7d0b2a)

Bug Fixes

css: avoid warnings for image-set containing __VITE_ASSET__ (#20520) (f1a2635)
css: empty CSS entry points should generate CSS files, not JS files (#20518) (bac9f3e)
dev: denied request stalled when requested concurrently (#20503) (64a52e7)
manifest: initialize entryCssAssetFileNames as an empty Set (#20542) (6a46cda)
skip prepareOutDirPlugin in workers (#20556) (97d5111)

Tests

detect ts support via process.features (#20544) (856d3f0)
fix unimportant errors in test-unit (#20545) (1f23554)

`v7.0.7`

Compare Source

Please refer to CHANGELOG.md for details.

`v7.0.6`

Compare Source

Bug Fixes

deps: update all non-major dependencies (#20442) (e49f505)
dev: incorrect sourcemap when optimized CJS is imported (#20458) (ead2dec)
module-runner: normalize file:// on windows (#20449) (1c9cb49)
respond with correct headers and status code for HEAD requests (#20421) (23d04fc)

Miscellaneous Chores

deps: update rolldown-related dependencies (#20441) (f689d61)
remove some files from prettier ignore (#20459) (8403f69)

Code Refactoring

use environment transform request (#20430) (24e6a0c)

`v7.0.5`

Compare Source

Bug Fixes

deps: update all non-major dependencies (#20406) (1a1cc8a)
remove special handling for Accept: text/html (#20376) (c9614b9)
watch assets referenced by new URL(, import.meta.url) (#20382) (6bc8bf6)

Miscellaneous Chores

deps: update dependency rolldown to ^1.0.0-beta.27 (#20405) (1165667)

Code Refactoring

use foo.endsWith("bar") instead of /bar$/.test(foo) (#20413) (862e192)

`v7.0.4`

Compare Source

Bug Fixes

allow resolving bare specifiers to relative paths for entries (#20379) (324669c)

Build System

remove @oxc-project/runtime devDep (#20389) (5e29602)

`v7.0.3`

Compare Source

Bug Fixes

client: protect against window being defined but addEv undefined (#20359) (31d1467)
define: replace optional values (#20338) (9465ae1)
deps: update all non-major dependencies (#20366) (43ac73d)

Miscellaneous Chores

deps: update dependency dotenv to v17 (#20325) (45040d4)
deps: update dependency rolldown to ^1.0.0-beta.24 (#20365) (5ab25e7)
use n/prefer-node-protocol rule (#20368) (38bb268)

Code Refactoring

minor changes to reduce diff between normal Vite and rolldown-vite (#20354) (2e8050e)

`v7.0.2`

Compare Source

Bug Fixes

css: resolve relative paths in sass, revert #20300 (#20349) (db8bd41)

`v7.0.1`

Compare Source

Bug Fixes

css: skip resolving resolved paths in sass (#20300) (ac528a4)
deps: update all non-major dependencies (#20324) (3e81af3)
types: add a global interface for Worker (#20243) (37bdfc1)

Miscellaneous Chores

deps: update rolldown-related dependencies (#20323) (30d2f1b)
fix typos and grammatical errors across documentation and comments (#20337) (c1c951d)
group commits by category in changelog (#20310) (41e83f6)
rearrange 7.0 changelog (#20280) (eafd28a)

`v7.0.0`

Compare Source

fix: keep import.meta.url in bundled Vite (#20235) (3bf3a8a), closes #20235
fix(deps): update all non-major dependencies (#20271) (6b64d63), closes #20271
fix(module-runner): export ssrExportNameKey (#20266) (ac302a7), closes #20266
fix(module-runner): expose normalizeModuleId (#20277) (9b98dcb), closes #20277
feat(types): use terser types from terser package (#20274) (a5799fa), closes #20274
chore: "indentity" → "identity" in test description (#20225) (ea9aed7), closes #20225
chore: typos in comments (#20259) (b135918), closes #20259
chore(deps): update rolldown-related dependencies (#20270) (f7377c3), closes #20270
perf(utils): improve performance of numberToPos (#20244) (3f46901), closes #20244

`v6.3.6`

Compare Source

Please refer to CHANGELOG.md for details.

`v6.3.5`

Compare Source

fix(ssr): handle uninitialized export access as undefined (#19959) (fd38d07), closes #19959

`v6.3.4`

Compare Source

Bug Fixes

check static serve file inside sirv (#19965) (c22c43d)
optimizer: return plain object when using require to import externals in optimized dependencies (#19940) (efc5eab)

Code Refactoring

remove duplicate plugin context type (#19935) (d6d01c2)

`v6.3.3`

Compare Source

fix: ignore malformed uris in tranform middleware (#19853) (e4d5201), closes #19853
fix(assets): ensure ?no-inline is not included in the asset url in the production environment (#1949 (16a73c0), closes #19496
fix(css): resolve relative imports in sass properly on Windows (#19920) (ffab442), closes #19920
fix(deps): update all non-major dependencies (#19899) (a4b500e), closes #19899
fix(ssr): fix execution order of re-export (#19841) (ed29dee), closes #19841
fix(ssr): fix live binding of default export declaration and hoist exports getter (#19842) (80a91ff), closes #19842
perf: skip sourcemap generation for renderChunk hook of import-analysis-build plugin (#19921) (55cfd04), closes #19921
test(ssr): test ssrTransform re-export deps and test stacktrace with first line (#19629) (9399cda), closes #19629

`v6.3.2`

Compare Source

Features

css: improve lightningcss messages (#19880) (c713f79)

Bug Fixes

css: respect css.lightningcss option in css minification process (#19879) (b5055e0)
deps: update all non-major dependencies (#19698) (bab4cb9)
match default asserts case insensitive (#19852) (cbdab1d)
open first url if host does not match any urls (#19886) (6abbdce)

`v6.3.1`

Compare Source

Bug Fixes

avoid using Promise.allSettled in preload function (#19805) (35c7f35)
backward compat for internal plugin transform calls (#19878) (a152b7c)

`v6.3.0`

Compare Source

fix(hmr): avoid infinite loop happening with hot.invalidate in circular deps (#19870) (d4ee5e8), closes #19870
fix(preview): use host url to open browser (#19836) (5003434), closes #19836

`v6.2.7`

Compare Source

Please refer to CHANGELOG.md for details.

`v6.2.6`

Compare Source

Please refer to CHANGELOG.md for details.

`v6.2.5`

Compare Source

Please refer to CHANGELOG.md for details.

`v6.2.4`

Compare Source

Please refer to CHANGELOG.md for details.

`v6.2.3`

Compare Source

Please refer to CHANGELOG.md for details.

`v6.2.2`

Compare Source

fix: await client buildStart on top level buildStart (#19624) (b31faab), closes #19624
fix(css): inline css correctly for double quote use strict (#19590) (d0aa833), closes #19590
fix(deps): update all non-major dependencies (#19613) (363d691), closes #19613
fix(indexHtml): ensure correct URL when querying module graph (#19601) (dc5395a), closes #19601
fix(preview): use preview https config, not server (#19633) (98b3160), closes #19633
fix(ssr): use optional chaining to prevent "undefined is not an object" happening in `ssrRewriteStac (4309755), closes #19612
feat: show friendly error for malformed base (#19616) (2476391), closes #19616
feat(worker): show asset filename conflict warning (#19591) (367d968), closes #19591
chore: extend commit hash correctly when ambigious with a non-commit object (#19600) (89a6287), closes #19600

`v6.2.1`

Compare Source

Features

add *?url&no-inline type and warning for .json?inline / .json?no-inline (#19566) (c0d3667)

Bug Fixes

css: stabilize css module hashes with lightningcss in dev mode (#19481) (92125b4)
deps: update all non-major dependencies (#19555) (f612e0f)
reporter: fix incorrect bundle size calculation with non-ASCII characters (#19561) (437c0ed)
sourcemap: combine sourcemaps with multiple sources without matched source (#18971) (e3f6ae1)
ssr: named export should overwrite export all (#19534) (2fd2fc1)

Performance Improvements

flush compile cache after 10s (#19537) (6c8a5a2)

Miscellaneous Chores

css: move environment destructuring after condition check (#19492) (c9eda23)
html: remove unnecessary value check (#19491) (797959f)

Code Refactoring

remove isBuild check from preAliasPlugin (#19587) (c9e086d)
restore endsWith usage (#19554) (6113a96)
use applyToEnvironment in internal plugins (#19588) (f678442)

Tests

add glob import test case (#19516) (aa1d807)
convert config playground to unit tests (#19568) (c0e68da)
convert resolve-config playground to unit tests (#19567) (db5fb48)

`v6.2.0`

Compare Source

Bug Fixes

deps: update all non-major dependencies (#19501) (c94c9e0)
worker: string interpolation in dynamic worker options (#19476) (07091a1)

Miscellaneous Chores

use unicode cross icon instead of x (#19497) (5c70296)

`v6.1.6`

Compare Source

Please refer to CHANGELOG.md for details.

`v6.1.5`

Compare Source

Please refer to CHANGELOG.md for details.

`v6.1.4`

Compare Source

Please refer to CHANGELOG.md for details.

`v6.1.3`

Compare Source

Please refer to CHANGELOG.md for details.

`v6.1.2`

Compare Source

Please refer to CHANGELOG.md for details.

`v6.1.1`

Compare Source

Features

add support for injecting debug IDs (#18763) (0ff556a)

Bug Fixes

css: run rewrite plugin if postcss plugin exists (#19371) (bcdb51a)
deps: bump tsconfck (#19375) (746a583)
deps: update all non-major dependencies (#19392) (60456a5)
deps: update all non-major dependencies (#19440) (ccac73d)
ensure .[cm]?[tj]sx? static assets are JS mime (#19453) (e7ba55e)
html: ignore malformed src attrs (#19397) (aff7812)
ignore *.ipv4 address in cert (#19416) (973283b)
worker: fix web worker type detection (#19462) (edc65ea)

Miscellaneous Chores

update 6.1.0 changelog (#19363) (fa7c211)

Code Refactoring

remove custom .jxl mime (#19457) (0c85464)

`v6.1.0`

Compare Source

Features

add support for injecting debug IDs (#18763) (0ff556a)

Bug Fixes

css: run rewrite plugin if postcss plugin exists (#19371) (bcdb51a)
deps: bump tsconfck (#19375) (746a583)
deps: update all non-major dependencies (#19392) (60456a5)
deps: update all non-major dependencies (#19440) (ccac73d)
ensure .[cm]?[tj]sx? static assets are JS mime (#19453) (e7ba55e)
html: ignore malformed src attrs (#19397) (aff7812)
ignore *.ipv4 address in cert (#19416) (973283b)
worker: fix web worker type detection (#19462) (edc65ea)

Miscellaneous Chores

update 6.1.0 changelog (#19363) (fa7c211)

Code Refactoring

remove custom .jxl mime (#19457) (0c85464)

`v6.0.15`

Compare Source

Please refer to CHANGELOG.md for details.

`v6.0.14`

Compare Source

Please refer to CHANGELOG.md for details.

`v6.0.13`

Compare Source

Please refer to CHANGELOG.md for details.

`v6.0.12`

Compare Source

Please refer to CHANGELOG.md for details.

`v6.0.11`

Compare Source

Features

show hosts in cert in CLI (#19317) (a5e306f)
support for env var for defining allowed hosts (#19325) (4d88f6c)
use native runtime to import the config (#19178) (7c2a794)
print port in the logged error message after failed WS connection with EADDRINUSE (#19212) (14027b0)
add support for .jxl (#18855) (57b397c)
add the builtins environment resolve (#18584) (2c2d521)
call Logger for plugin logs in build ([#13757](https://redirect.github.

Configuration

📅 Schedule: Branch creation - "" in timezone America/New_York, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

cypress-app-bot · 2025-09-10T01:45:51Z

See the guidelines for reviewing dependency updates for info on how to review dependency update PRs.

…m/cypress-io/cypress into renovate/npm-vite-5-vulnerability

npm/vite-dev-server/package.json

renovate · 2025-09-16T17:18:33Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

cypress · 2025-09-16T17:55:33Z

cypress Run #65553

Run Properties: Passed #65553 • d12be0bb2e: Merge branch 'renovate/npm-vite-5-vulnerability' of https://github.com/cypress-i...

Project	`cypress`
Branch Review	`renovate/npm-vite-5-vulnerability`
Run status	`Passed #65553`
Run duration	`19m 12s`
Commit	`d12be0bb2e: Merge branch 'renovate/npm-vite-5-vulnerability' of https://github.com/cypress-i...`
Committer	`Jennifer Shehane`
View all properties for this run ↗︎

Test results
Failures	`0`
Flaky	`10`
Pending	`1102`
Skipped	`0`
Passing	`26662`
View all changes introduced in this branch ↗︎

UI Coverage `45.11%`
Untested elements	`186`
Tested elements	`157`

Accessibility `97.71%`
Failed rules	`4 critical` `8 serious` `2 moderate` `2 minor`
Failed elements	`110`

renovate bot added the type: dependencies label Sep 10, 2025

This comment was marked as outdated.

Sign in to view

renovate bot force-pushed the renovate/npm-vite-5-vulnerability branch from c0bfe1c to 2d90783 Compare September 10, 2025 16:43

renovate bot changed the title ~~chore(deps): update dependency vite-5 to v7 [security]~~ chore(deps): update dependency vite-5 to ^5.4.20 [security] Sep 10, 2025

renovate bot force-pushed the renovate/npm-vite-5-vulnerability branch from 2d90783 to 25be1ec Compare September 10, 2025 17:06

renovate bot changed the title ~~chore(deps): update dependency vite-5 to ^5.4.20 [security]~~ chore(deps): update dependency vite-5 to v7 [security] Sep 10, 2025

renovate bot force-pushed the renovate/npm-vite-5-vulnerability branch from 25be1ec to b324abf Compare September 11, 2025 19:11

renovate bot changed the title ~~chore(deps): update dependency vite-5 to v7 [security]~~ chore(deps): update dependency vite-5 to ^5.4.20 [security] Sep 11, 2025

renovate bot force-pushed the renovate/npm-vite-5-vulnerability branch from b324abf to c24f87b Compare September 11, 2025 20:29

renovate bot changed the title ~~chore(deps): update dependency vite-5 to ^5.4.20 [security]~~ chore(deps): update dependency vite-5 to v7 [security] Sep 11, 2025

renovate bot force-pushed the renovate/npm-vite-5-vulnerability branch from c24f87b to 8b2058b Compare September 12, 2025 18:52

renovate bot changed the title ~~chore(deps): update dependency vite-5 to v7 [security]~~ chore(deps): update dependency vite-5 to ^5.4.20 [security] Sep 12, 2025

renovate bot force-pushed the renovate/npm-vite-5-vulnerability branch 2 times, most recently from 0e66d70 to 57e98ab Compare September 12, 2025 19:51

renovate bot changed the title ~~chore(deps): update dependency vite-5 to ^5.4.20 [security]~~ chore(deps): update dependency vite-5 to v7 [security] Sep 12, 2025

renovate bot force-pushed the renovate/npm-vite-5-vulnerability branch from 57e98ab to 8f8eae2 Compare September 12, 2025 23:47

renovate bot changed the title ~~chore(deps): update dependency vite-5 to v7 [security]~~ chore(deps): update dependency vite-5 to ^5.4.20 [security] Sep 12, 2025

renovate bot force-pushed the renovate/npm-vite-5-vulnerability branch from 8f8eae2 to 21564df Compare September 12, 2025 23:51

renovate bot changed the title ~~chore(deps): update dependency vite-5 to ^5.4.20 [security]~~ chore(deps): update dependency vite-5 to v7 [security] Sep 12, 2025

renovate bot force-pushed the renovate/npm-vite-5-vulnerability branch from 21564df to 27af983 Compare September 15, 2025 14:21

renovate bot changed the title ~~chore(deps): update dependency vite-5 to v7 [security]~~ chore(deps): update dependency vite-5 to ^5.4.20 [security] Sep 15, 2025

renovate bot force-pushed the renovate/npm-vite-5-vulnerability branch from 27af983 to 042c180 Compare September 15, 2025 14:25

renovate bot changed the title ~~chore(deps): update dependency vite-5 to ^5.4.20 [security]~~ chore(deps): update dependency vite-5 to v7 [security] Sep 15, 2025

renovate bot force-pushed the renovate/npm-vite-5-vulnerability branch from 042c180 to 28bdbd9 Compare September 15, 2025 17:03

renovate bot changed the title ~~chore(deps): update dependency vite-5 to v7 [security]~~ chore(deps): update dependency vite-5 to ^5.4.20 [security] Sep 15, 2025

renovate bot force-pushed the renovate/npm-vite-5-vulnerability branch from 28bdbd9 to b50a3a6 Compare September 15, 2025 17:08

renovate bot changed the title ~~chore(deps): update dependency vite-5 to ^5.4.20 [security]~~ chore(deps): update dependency vite-5 to v7 [security] Sep 15, 2025

renovate bot force-pushed the renovate/npm-vite-5-vulnerability branch from b50a3a6 to df3f228 Compare September 15, 2025 18:22

renovate bot changed the title ~~chore(deps): update dependency vite-5 to v7 [security]~~ chore(deps): update dependency vite-5 to ^5.4.20 [security] Sep 15, 2025

renovate bot force-pushed the renovate/npm-vite-5-vulnerability branch from 76ba573 to 437e088 Compare September 15, 2025 19:24

renovate bot changed the title ~~chore(deps): update dependency vite-5 to ^5.4.20 [security]~~ chore(deps): update dependency vite-5 to v7 [security] Sep 15, 2025

renovate bot force-pushed the renovate/npm-vite-5-vulnerability branch from 437e088 to e45b9db Compare September 15, 2025 19:33

renovate bot changed the title ~~chore(deps): update dependency vite-5 to v7 [security]~~ chore(deps): update dependency vite-5 to ^5.4.20 [security] Sep 15, 2025

renovate bot force-pushed the renovate/npm-vite-5-vulnerability branch from e45b9db to ea58f8d Compare September 15, 2025 19:37

renovate bot changed the title ~~chore(deps): update dependency vite-5 to ^5.4.20 [security]~~ chore(deps): update dependency vite-5 to v7 [security] Sep 15, 2025

renovate bot force-pushed the renovate/npm-vite-5-vulnerability branch from ea58f8d to 599fe07 Compare September 16, 2025 14:04

renovate bot changed the title ~~chore(deps): update dependency vite-5 to v7 [security]~~ chore(deps): update dependency vite-5 to ^5.4.20 [security] Sep 16, 2025

chore(deps): update dependency vite-5 to ^5.4.20 [security]

d2617a3

renovate bot force-pushed the renovate/npm-vite-5-vulnerability branch from 599fe07 to d2617a3 Compare September 16, 2025 14:10

chore(deps): update dependency vite-5 to v7 [security]

29edf0b

renovate bot force-pushed the renovate/npm-vite-5-vulnerability branch from d2617a3 to 29edf0b Compare September 16, 2025 15:00

renovate bot changed the title ~~chore(deps): update dependency vite-5 to ^5.4.20 [security]~~ chore(deps): update dependency vite-5 to v7 [security] Sep 16, 2025

renovate bot force-pushed the renovate/npm-vite-5-vulnerability branch from 29edf0b to 505e8a6 Compare September 16, 2025 15:15

renovate bot changed the title ~~chore(deps): update dependency vite-5 to v7 [security]~~ chore(deps): update dependency vite-5 to ^5.4.20 [security] Sep 16, 2025

renovate bot force-pushed the renovate/npm-vite-5-vulnerability branch from 505e8a6 to 0b3e4b1 Compare September 16, 2025 15:28

chore(deps): update dependency vite-5 to v7 [security]

f688a7f

renovate bot force-pushed the renovate/npm-vite-5-vulnerability branch from 0b3e4b1 to f688a7f Compare September 16, 2025 15:34

renovate bot changed the title ~~chore(deps): update dependency vite-5 to ^5.4.20 [security]~~ chore(deps): update dependency vite-5 to v7 [security] Sep 16, 2025

jennifer-shehane added 2 commits September 16, 2025 13:13

fix vite-5 dep

9cdb45d

Merge branch 'renovate/npm-vite-5-vulnerability' of https://github.co…

d12be0b

…m/cypress-io/cypress into renovate/npm-vite-5-vulnerability

cursor bot reviewed Sep 16, 2025

View reviewed changes

npm/vite-dev-server/package.json Show resolved Hide resolved

jennifer-shehane approved these changes Sep 16, 2025

View reviewed changes

jennifer-shehane self-assigned this Sep 16, 2025

jennifer-shehane changed the title ~~chore(deps): update dependency vite-5 to v7 [security]~~ chore(deps): update dependency vite-5 to v5.4.20 [security] Sep 16, 2025

jennifer-shehane merged commit 0d7e4b2 into develop Sep 16, 2025
90 of 92 checks passed

jennifer-shehane deleted the renovate/npm-vite-5-vulnerability branch September 16, 2025 19:29

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update dependency vite-5 to v5.4.20 [security] #32458

chore(deps): update dependency vite-5 to v5.4.20 [security] #32458

Uh oh!

renovate bot commented Sep 10, 2025 •

edited

Loading

Uh oh!

cypress-app-bot commented Sep 10, 2025

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

renovate bot commented Sep 16, 2025

Uh oh!

cypress bot commented Sep 16, 2025

Uh oh!

Uh oh!

Uh oh!

chore(deps): update dependency vite-5 to v5.4.20 [security] #32458

chore(deps): update dependency vite-5 to v5.4.20 [security] #32458

Uh oh!

Conversation

renovate bot commented Sep 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

Summary

Impact

Details

PoC

Summary

Impact

Details

PoC

Related links

Release Notes

Bug Fixes

Bug Fixes

Miscellaneous Chores

Code Refactoring

Features

Bug Fixes

Performance Improvements

Miscellaneous Chores

Code Refactoring

Tests

Bug Fixes

Miscellaneous Chores

Bug Fixes

Miscellaneous Chores

Features

Bug Fixes

Tests

Bug Fixes

Miscellaneous Chores

Code Refactoring

Bug Fixes

Miscellaneous Chores

Code Refactoring

Bug Fixes

Build System

Bug Fixes

Miscellaneous Chores

Code Refactoring

Bug Fixes

Bug Fixes

Miscellaneous Chores

Bug Fixes

Code Refactoring

Features

Bug Fixes

Bug Fixes

Features

Bug Fixes

Performance Improvements

Miscellaneous Chores

Code Refactoring

Tests

Bug Fixes

Miscellaneous Chores

Features

Bug Fixes

Miscellaneous Chores

Code Refactoring

Features

Bug Fixes

Miscellaneous Chores

Code Refactoring

Features

Configuration

Uh oh!

cypress-app-bot commented Sep 10, 2025

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

renovate bot commented Sep 16, 2025

Edited/Blocked Notification

Uh oh!

renovate bot commented Sep 10, 2025 •

edited

Loading