Update dependency vite to v6.1.6 [SECURITY] #20
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
force-pushed
the
renovate/npm-vite-vulnerability
branch
from
cf04bd0 to
e7ac76d
Compare
renovate
bot
force-pushed
the
renovate/npm-vite-vulnerability
branch
from
e7ac76d to
4a81f3e
Compare
renovate
bot
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
6.0.13->6.1.6GitHub Vulnerability Alerts
CVE-2025-31486
Summary
The contents of arbitrary files can be returned to the browser.
Impact
Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
Details
.svgRequests ending with
.svgare loaded at this line.https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290
By adding
?.svgwith?.wasm?initor withsec-fetch-dest: scriptheader, the restriction was able to bypass.This bypass is only possible if the file is smaller than
build.assetsInlineLimit(default: 4kB) and when using Vite 6.0+.relative paths
The check was applied before the id normalization. This allowed requests to bypass with relative paths (e.g.
../../).PoC
npm create vite@latest cd vite-project/ npm install npm run devsend request to read
etc/passwdcurl 'http://127.0.0.1:5173/etc/passwd?.svg?.wasm?init'curl 'http://127.0.0.1:5173/@​fs/x/x/x/vite-project/?/../../../../../etc/passwd?import&?raw'CVE-2025-46565
Summary
The contents of files in the project
rootthat are denied by a file matching pattern can be returned to the browser.Impact
Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
Only files that are under project
rootand are denied by a file matching pattern can be bypassed..env,.env.*,*.{crt,pem},**/.env**/.git/**,.git/**,.git/**/*Details
server.fs.denycan contain patterns matching against files (by default it includes.env,.env.*,*.{crt,pem}as such patterns).These patterns were able to bypass for files under
rootby using a combination of slash and dot (/.).PoC
Release Notes
vitejs/vite (vite)
v6.1.6Compare Source
Please refer to CHANGELOG.md for details.
v6.1.5Compare Source
Please refer to CHANGELOG.md for details.
v6.1.4Compare Source
Please refer to CHANGELOG.md for details.
v6.1.3Compare Source
Please refer to CHANGELOG.md for details.
v6.1.2Compare Source
Please refer to CHANGELOG.md for details.
v6.1.1Compare Source
.[cm]?[tj]sx?static assets are JS mime (#19453) (e7ba55e), closes #19453*.ipv4address in cert (#19416) (973283b), closes #19416v6.1.0Compare Source
Features
portin the logged error message after failed WS connection withEADDRINUSE(#19212) (14027b0), closes #19212.jxl(#18855) (57b397c), closes #18855builtinsenvironmentresolve(#18584) (2c2d521), closes #18584defaultAllowedOriginsfor user-land config and 3rd party plugins (#19259) (dc8946b), closes #19259wasmto the compressible assets regex (#19085) (ce84142), closes #19085Fixes
resolveLibCssFilename(#19324) (f183bdf), closes #19324vite optimize(#19347) (19ffad0), closes #19347server.preTransformRequests(#19272) (12aaa58), closes #19272nodeLikeBuiltinsforssr.target: 'webworker'withoutnoExternal: true(#19313) (9fc31b6), closes #19313@pluginimports of JS files treated as CSS and rebased (fix #19268) (#19269) (602b373), closes #19268 #19269resolve.builtinis empty (#19312) (b7aba0b), closes #19312ssrLoadModule(#19290) (353c467), closes #19290--forcework for all environments (#18901) (51a42c6), closes #18901RegExpvalues withnew RegExpinstead ofstructuredClone(fix #19245, fix #1 (56ad2be), closes #19245 #18875 #19247Chore
vite optimizecommand (#19348) (6e0e3c0), closes #19348build.manifestjsdocs (#19332) (4583781), closes #19332scanImportsnot being used in ssr (#19285) (fbbc6da), closes #19285Beta Changelogs
6.1.0-beta.2 (2025-02-04)
See 6.1.0-beta.2 changelog
6.1.0-beta.1 (2025-02-04)
See 6.1.0-beta.1 changelog
6.1.0-beta.0 (2025-01-24)
See 6.1.0-beta.0 changelog
v6.0.15Compare Source
Please refer to CHANGELOG.md for details.
v6.0.14Compare Source
Please refer to CHANGELOG.md for details.
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.