Repository navigation
Update Vite to 8.3.2 to fix audit advisories - #32
Closed
JesseScott wants to merge 1 commit into
Closed
JesseScott wants to merge 1 commit into
JesseScott wants to merge 1 commit into
Conversation
npm audit fix: Vite 8.0.10 -> 8.3.2 (server.fs.deny bypass and launch-editor NTLM hash disclosure on Windows), plus the nanoid and postcss advisories. Raise the Vite floor in package.json. The remaining uuid advisory comes from @owlbear-rodeo/sdk and has no fix available. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015XHHXZx9cHHvJDDBfEfqka
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
npm auditreported 5 vulnerabilities, including high-severity ones in Vite 8.0.10: aserver.fs.denybypass on Windows alternate paths and alaunch-editorNTLMv2 hash disclosure via UNC paths on Windows. Both affect the local dev server (npm run dev), not the deployed site.nanoidandpostcssalso had advisories.Changes
npm audit fix(no--force): Vite 8.0.10 -> 8.3.2, plus thenanoidandpostcssfixes. The lockfile churn is large (about 390 lines) mostly because Vite's bundler (Rolldown) moved from a release candidate to the stable 1.2.12.package.json: raise the Vite floor to^8.3.2so a fresh install can't resolve a vulnerable version.Left alone
2 moderate advisories remain:
uuid(v3/v5/v6 missing buffer bounds check when a buffer is provided), pulled in by@owlbear-rodeo/sdk. No fix is available, and it only matters whenuuidis called with a caller-supplied buffer, which this app doesn't do. Dependabot should flag it when the SDK updates.Test plan
npm ci,vite build: output still uses the stableassets/app.js/assets/index.cssnames; withSITE_URLset the manifest still gets absolute icon/popover URLsnpm test(11/11) and Playwright UI tests (10/10)Access-Control-Allow-Origin: https://www.owlbear.rodeo🤖 Generated with Claude Code
https://claude.ai/code/session_015XHHXZx9cHHvJDDBfEfqka
Generated by Claude Code