New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(deps): update dependency vite to v5.1.7 [security] #43

Open

renovate wants to merge 1 commit into main from renovate/npm-vite-vulnerability

Contributor

renovate bot commented Apr 3, 2024 •

edited

Loading

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
vite (source)	`^2.0.0 \|\| ^3.0.0 \|\| ^4.0.0 \|\| ^5.0.0` -> `^5.1.7 ^5.1.7 ^5.1.7 ^5.1.7`
vite (source)	`5.1.6` -> `5.1.7`

GitHub Vulnerability Alerts

CVE-2024-31207

Summary

Vite dev server option server.fs.deny did not deny requests for patterns with directories. An example of such a pattern is /foo/**/*.

Impact

Only apps setting a custom server.fs.deny that includes a pattern with directories, and explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Patches

Fixed in vite@5.2.6, vite@5.1.7, vite@5.0.13, vite@4.5.3, vite@3.2.10, vite@2.9.18

Details

server.fs.deny uses picomatch with the config of { matchBase: true }. matchBase only matches the basename of the file, not the path due to a bug (https://github.com/micromatch/picomatch/issues/89). The vite config docs read like you should be able to set fs.deny to glob with picomatch. Vite also does not set { dot: true } and that causes dotfiles not to be denied unless they are explicitly defined.

Reproduction

Set fs.deny to ['**/.git/**'] and then curl for /.git/config.

with matchBase: true, you can get any file under .git/ (config, HEAD, etc).
with matchBase: false, you cannot get any file under .git/ (config, HEAD, etc).

Release Notes

vitejs/vite (vite)

`v5.1.7`

Please refer to CHANGELOG.md for details.

`v5.1.6`

chore(deps): update all non-major dependencies (#16131) (a862ecb), closes #16131
fix: check for publicDir before checking if it is a parent directory (#16046) (b6fb323), closes #16046
fix: escape single quote when relative base is used (#16060) (8f74ce4), closes #16060
fix: handle function property extension in namespace import (#16113) (f699194), closes #16113
fix: server middleware mode resolve (#16122) (8403546), closes #16122
fix(esbuild): update tsconfck to fix bug that could cause a deadlock (#16124) (fd9de04), closes #16124
fix(worker): hide "The emitted file overwrites" warning if the content is same (#16094) (60dfa9e), closes #16094
fix(worker): throw error when circular worker import is detected and support self referencing worker (eef9da1), closes #16103
style(utils): remove null check (#16112) (0d2df52), closes #16112
refactor(runtime): share more code between runtime and main bundle (#16063) (93be84e), closes #16063

`v5.1.5`

fix: __vite__mapDeps code injection (#15732) (aff54e1), closes #15732
fix: analysing build chunk without dependencies (#15469) (bd52283), closes #15469
fix: import with query with imports field (#16085) (ab823ab), closes #16085
fix: normalize literal-only entry pattern (#16010) (1dccc37), closes #16010
fix: optimizeDeps.entries with literal-only pattern(s) (#15853) (49300b3), closes #15853
fix: output correct error for empty import specifier (#16055) (a9112eb), closes #16055
fix: upgrade esbuild to 0.20.x (#16062) (899d9b1), closes #16062
fix(runtime): runtime HMR affects only imported files (#15898) (57463fc), closes #15898
fix(scanner): respect experimentalDecorators: true (#15206) (4144781), closes #15206
revert: "fix: upgrade esbuild to 0.20.x" (#16072) (11cceea), closes #16072
refactor: share code with vite runtime (#15907) (b20d542), closes #15907
refactor(runtime): use functions from pathe (#16061) (aac2ef7), closes #16061
chore(deps): update all non-major dependencies (#16028) (7cfe80d), closes #16028

`v5.1.4`

perf: remove unnecessary regex s modifier (#15766) (8dc1b73), closes #15766
fix: fs cached checks disabled by default for yarn pnp (#15920) (8b11fea), closes #15920
fix: resolve directory correctly when fs.cachedChecks: true (#15983) (4fe971f), closes #15983
fix: srcSet with optional descriptor (#15905) (81b3bd0), closes #15905
fix(deps): update all non-major dependencies (#15959) (571a3fd), closes #15959
fix(watch): build watch fails when outDir is empty string (#15979) (1d263d3), closes #15979

`v5.1.3`

fix: cachedTransformMiddleware for direct css requests (#15919) (5099028), closes #15919
refactor(runtime): minor tweaks (#15904) (63a39c2), closes #15904
refactor(runtime): seal ES module namespace object instead of feezing (#15914) (4172f02), closes #15914

`v5.1.2`

fix: normalize import file path info (#15772) (306df44), closes #15772
fix(build): do not output build time when build fails (#15711) (added3e), closes #15711
fix(runtime): pass path instead of fileURL to isFilePathESM (#15908) (7b15607), closes #15908
fix(worker): support UTF-8 encoding in inline workers (fixes #12117) (#15866) (570e0f1), closes #12117 #15866
chore: update license file (#15885) (d9adf18), closes #15885
chore(deps): update all non-major dependencies (#15874) (d16ce5d), closes #15874
chore(deps): update dependency dotenv-expand to v11 (#15875) (642d528), closes #15875

`v5.1.1`

fix: empty CSS file was output when only .css?url is used (#15846) (b2873ac), closes #15846
fix: skip not only .js but also .mjs manifest entries (#15841) (3d860e7), closes #15841
chore: post 5.1 release edits (#15840) (9da6502), closes #15840

`v5.1.0`

chore: revert #15746 (#15839) (ed875f8), closes #15746 #15839
fix: pass customLogger to loadConfigFromFile (fix #15824) (#15831) (55a3427), closes #15824 #15831
fix(deps): update all non-major dependencies (#15803) (e0a6ef2), closes #15803
refactor: remove vite build --force (#15837) (f1a4242), closes #15837

`v5.0.13`

Please refer to CHANGELOG.md for details.

`v5.0.12`

Please refer to CHANGELOG.md for details.

`v5.0.11`

fix: don't pretransform classic script links (#15361) (19e3c9a), closes #15361
fix: inject __vite__mapDeps code before sourcemap file comment (#15483) (d2aa096), closes #15483
fix(assets): avoid splitting , inside base64 value of srcset attribute (#15422) (8de7bd2), closes #15422
fix(html): handle offset magic-string slice error (#15435) (5ea9edb), closes #15435
chore(deps): update dependency strip-literal to v2 (#15475) (49d21fe), closes #15475
chore(deps): update tj-actions/changed-files action to v41 (#15476) (2a540ee), closes #15476

`v5.0.10`

fix: omit protocol does not require pre-transform (#15355) (d9ae1b2), closes #15355
fix(build): use base64 for inline SVG if it contains both single and double quotes (#15271) (1bbff16), closes #15271

`v5.0.9`

fix: htmlFallbackMiddleware for favicon (#15301) (c902545), closes #15301
fix: more stable hash calculation for depsOptimize (#15337) (2b39fe6), closes #15337
fix(scanner): catch all external files for glob imports (#15286) (129d0d0), closes #15286
fix(server): avoid chokidar throttling on startup (#15347) (56a5740), closes #15347
fix(worker): replace import.meta correctly for IIFE worker (#15321) (08d093c), closes #15321
feat: log re-optimization reasons (#15339) (b1a6c84), closes #15339
chore: temporary typo (#15329) (7b71854), closes #15329
perf: avoid computing paths on each request (#15318) (0506812), closes #15318
perf: temporary hack to avoid fs checks for /@react-refresh (#15299) (b1d6211), closes #15299

`v5.0.8`

perf: cached fs utils (#15279) (c9b61c4), closes #15279
fix: missing warmupRequest in transformIndexHtml (#15303) (103820f), closes #15303
fix: public files map will be updated on add/unlink in windows (#15317) (921ca41), closes #15317
fix(build): decode urls in CSS files (fix #15109) (#15246) (ea6a7a6), closes #15109 #15246
fix(deps): update all non-major dependencies (#15304) (bb07f60), closes #15304
fix(ssr): check esm file with normal file path (#15307) (1597170), closes #15307

`v5.0.7`

fix: suppress terser warning if minify disabled (#15275) (3e42611), closes #15275
fix: symbolic links in public dir (#15264) (ef2a024), closes #15264
fix(html): skip inlining icon and manifest links (#14958) (8ad81b4), closes #14958
chore: remove unneeded condition in getRealPath (#15267) (8e4655c), closes #15267
perf: cache empty optimizer result (#15245) (8409b66), closes #15245

`v5.0.6`

perf: in-memory public files check (#15195) (0f9e1bf), closes #15195
chore: remove unneccessary eslint-disable-next-line regexp/no-unused-capturing-group (#15247) (35a5bcf), closes #15247

`v5.0.5`

fix: emit vite:preloadError for chunks without deps (#15203) (d8001c5), closes #15203
fix: esbuild glob import resolve error (#15140) (676804d), closes #15140
fix: json error with position (#15225) (14be75f), closes #15225
fix: proxy html path should be encoded (#15223) (5b85040), closes #15223
fix(deps): update all non-major dependencies (#15233) (ad3adda), closes #15233
fix(hmr): don't consider CSS dep as a circular dep (#15229) (5f2cdec), closes #15229
feat: add '*.mov' to client.d.ts (#15189) (d93a211), closes #15189
feat(server): allow disabling built-in shortcuts (#15218) (7fd7c6c), closes #15218
chore: replace 'some' with 'includes' in resolveEnvPrefix (#15220) (ee12f30), closes #15220
chore: update the website url for homepage in package.json (#15181) (282bd8f), closes #15181
chore: update vitest to 1.0.0-beta.6 (#15194) (2fce647), closes #15194
refactor: make HMR agnostic to environment (#15179) (0571b7c), closes #15179
refactor: use dedicated regex methods (#15228) (0348137), closes #15228
perf: remove debug only prettifyUrl call (#15204) (73e971f), closes #15204
perf: skip computing sourceRoot in injectSourcesContent (#15207) (1df1fd1), closes #15207

`v5.0.4`

fix: bindCLIShortcuts to proper server (#15162) (67ac572), closes #15162
fix: revert "fix: js fallback sourcemap content should be using original content (#15135)" (#15178) (d2a2493), closes #15135 #15178
fix(define): allow define process.env (#15173) (ec401da), closes #15173
fix(resolve): respect order of browser in mainFields when resolving (#15137) (4a111aa), closes #15137
feat: preserve vite.middlewares connect instance after restarts (#15166) (9474c4b), closes #15166
refactor: align with Promise.withResolvers() (#15171) (642f9bc), closes #15171

`v5.0.3`

fix: generateCodeFrame infinite loop (#15093) (6619de7), closes #15093
fix: js fallback sourcemap content should be using original content (#15135) (227d56d), closes #15135
fix(css): render correct asset url when CSS chunk name is nested (#15154) (ef403c0), closes #15154
fix(css): use non-nested chunk name if facadeModule is not CSS file (#15155) (811e392), closes #15155
fix(dev): bind plugin context functions (#14569) (cb3243c), closes #14569
chore(deps): update all non-major dependencies (#15145) (7ff2c0a), closes #15145
build: handle latest json-stable-stringify replacement (#15049) (bcc4a61), closes #15049

`v5.0.2`

fix: make htmlFallback more permissive (#15059) (6fcceeb), closes #15059

`v5.0.1`

test: avoid read check when running as root (#14884) (1d9516c), closes #14884
perf(hmr): skip traversed modules when checking circular imports (#15034) (41e437f), closes #15034
fix: run htmlFallbackMiddleware for no accept header requests (#15025) (b93dfe3), closes #15025
fix: update type CSSModulesOptions interface (#14987) (d0b2153), closes #14987
fix(legacy): error in build with --watch and manifest enabled (#14450) (b9ee620), closes #14450
chore: add comment about crossorigin attribute for script module (#15040) (03c371e), closes #15040
chore: cleanup v5 beta changelog (#14694) (531d3cb), closes #14694

`v5.0.0`

`v4.5.3`

`v4.5.2`

Please refer to CHANGELOG.md for details.

`v4.5.1`

Please refer to CHANGELOG.md for details.

`v4.5.0`

Please refer to CHANGELOG.md for details.

`v4.4.12`

Please refer to CHANGELOG.md for details.

`v4.4.11`

Please refer to CHANGELOG.md for details.

`v4.4.10`

Please refer to CHANGELOG.md for details.

`v4.4.9`

chore: fix eslint warnings (#14031) (4021a0e), closes #14031
chore(deps): update all non-major dependencies (#13938) (a1b519e), closes #13938
fix: dynamic import vars ignored warning (#14006) (4479431), closes #14006
fix(build): silence warn dynamic import module when inlineDynamicImports true (#13970) (7a77aaf), closes #13970
perf: improve build times and memory utilization (#14016) (9d7d45e), closes #14016
perf: replace startsWith with === (#14005) (f5c1224), closes #14005

`v4.4.8`

fix: modulePreload false (#13973) (488085d), closes #13973
fix: multiple entries with shared css and no JS (#13962) (89a3db0), closes #13962
fix: use file extensions on type imports so they work with moduleResolution: 'node16' (#13947) (aeef670), closes #13947
fix(css): enhance error message for missing preprocessor dependency (#11485) (65e5c22), closes #11485
fix(esbuild): fix static properties transpile when useDefineForClassFields false (#13992) (4ca7c13), closes #13992
fix(importAnalysis): strip url base before passing as safeModulePaths (#13712) (1ab06a8), closes #13712
fix(importMetaGlob): avoid unnecessary hmr of negative glob (#13646) (844451c), closes #13646
fix(optimizer): avoid double-commit of optimized deps when discovery is disabled (#13865) (df77991), closes #13865
fix(optimizer): enable experimentalDecorators by default (#13981) (f8a5ffc), closes #13981
perf: replace startsWith with === (#13989) (3aab14e), closes #13989
perf: single slash does not need to be replaced (#13980) (66f522c), closes #13980
perf: use Intl.DateTimeFormatter instead of toLocaleTimeString (#13951) (af53a1d), closes #13951
perf: use Intl.NumberFormat instead of toLocaleString (#13949) (a48bf88), closes #13949
perf: use magic-string hires boundary for sourcemaps (#13971) (b9a8d65), closes #13971
chore(reporter): remove unnecessary map (#13972) (dd9d4c1), closes #13972
refactor: add new overload to the type of defineConfig (#13958) (24c12fe), closes #13958

`v4.4.7`

fix: optimizeDeps.include not working with paths inside packages (#13922) (06e4f57), closes #13922
fix: lightningcss fails with html-proxy (#13776) (6b56094), closes #13776
fix: prepend config.base to vite/env path (#13941) (8e6cee8), closes #13941
fix(html): support import.meta.env define replacement without quotes (#13425) (883089c), closes #13425
fix(proxy): handle error when proxy itself errors (#13929) (4848e41), closes #13929
chore(eslint): allow type annotations (#13920) (d1264fd), closes #13920

`v4.4.6`

fix: constrain inject helpers for iife (#13909) (c89f677), closes #13909
fix: display manualChunks warning only when a function is not used (#13797) (#13798) (51c271f), closes #13797 #13798
fix: do not append browserHash on optimized deps during build (#13906) (0fb2340), closes #13906
fix: use Bun's implementation of ws instead of the bundled one (#13901) (049404c), closes #13901
feat(client): add guide to press Esc for closing the overlay (#13896) (da389cc), closes #13896

`v4.4.5`

fix: "EISDIR: illegal operation on a directory, realpath" error on RA… (#13655) (6bd5434), closes #13655
fix: transform error message add file info (#13687) (6dca41c), closes #13687
fix: warn when publicDir and outDir are nested (#13742) (4eb3154), closes #13742
fix(build): remove warning about ineffective dynamic import from node_modules (#13884) (33002dd), closes #13884
fix(build): style insert order for UMD builds (fix #13668) (#13669) (49a1b99), closes #13668 #13669
fix(deps): update all non-major dependencies (#13872) (975a631), closes #13872
fix(types): narrow down the return type of defineConfig (#13792) (c971f26), closes #13792
chore: fix typos (#13862) (f54e8da), closes #13862
chore: replace any with string (#13850) (4606fd8), closes #13850
chore(deps): update dependency prettier to v3 (#13759) (5a56941), closes #13759
docs: fix build.cssMinify link (#13840) (8a2a3e1), closes #13840

`v4.4.4`

chore: warning about ssr cjs format removal (#13827) (4646e9f), closes #13827
fix(esbuild): enable experimentalDecorators by default (#13805) (e8880f0), closes #13805
fix(scan): skip tsconfigRaw fallback if tsconfig is set (#13823) (b6155a1), closes #13823
feat(client): close vite-error-overlay with Escape key (#13795) (85bdcda), closes #13795

`v4.4.3`

fix: avoid early error when server is closed in ssr (#13787) (89d01eb), closes #13787
fix(deps): update all non-major dependencies (#13758) (8ead116), closes #13758
fix(server): remove restart guard on restart (#13789) (2a38ef7), closes #13789

`v4.4.2`

fix(css): use single postcss instance (#13738) (c02fac4), closes #13738

`v4.4.1`

fix: revert #13073, use consistent virtual module ID in module graph (#13734) (f589ac0), closes #13073 #13734
fix: revert import config module as data (#13731) (b0bfa01), closes #13731
chore: changelog notes and clean for 4.4 (#13728) (3f4e36e), closes #13728

`v4.4.0`

Experimental support for Lightning CSS

Starting from Vite 4.4, there is experimental support for Lightning CSS. You can opt into it by adding css.transformer: 'lightningcss' to your config file and install the optional lightningcss dev dependency. If enabled, CSS files will be processed by Lightning CSS instead of PostCSS.

Lightning CSS can also be used as the CSS minifier with build.cssMinify: 'lightningcss'.

See beta docs at the Lighting CSS guide.

esbuild 0.18 update

esbuild 0.18 contains backwards-incompatible changes to esbuild's handling of tsconfig.json files. We think they shouldn't affect Vite users, you can review #13525 for more information.

Templates for Solid and Qwik in create-vite

New starter templates have been added to create-vite for Solid and Qwik. Try them online at vite.new/solid-ts and vite.new/qwik-ts.

Korean Translation

Vite's docs are now translated to Korean, available at ko.vitejs.dev.

Features

feat: preview mode add keyboard shortcuts (#12968) (126e93e), closes #12968
feat: asset type add apng (#13294) (a11b6f6), closes #13294
feat: emit event to handle chunk load errors (#12084) (2eca54e), closes #12084
feat: import public non-asset URL (#13422) (3a98558), closes #13422
feat: support files for fs.allow (#12863) (4a06e66), closes #12863
feat(build): warn dynamic import module with a static import alongside (#12850) (127c334), closes #12850
feat(client): add debounce on page reload (#13545) (d080b51), closes #13545
feat(client): add WebSocket connections events (#13334) (eb75103), closes #13334
feat(config): friendly ESM file require error (#13283) (b9a6ba0), closes #13283
feat(css): add support for Lightning CSS (#12807) (c6c5d49), closes #12807
feat(css): support at import preprocessed styles (#8400) (2bd6077), closes #8400
feat(html): support image set in inline style (#13473) (2c0faba), closes #13473
feat(importMetaGlob): support sub imports pattern (#12467) (e355c9c), closes [#&#8203

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.


          chore(deps): update dependency vite to v5.1.7 [security]

5d94284

renovate bot force-pushed the renovate/npm-vite-vulnerability branch from 5b81c0d to 5d94284 Compare

August 6, 2024 10:01

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment