chore(deps): update dependency vite to v6.2.6 [security] (main) (#7225)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [vite](https://vite.dev)
([source](https://redirect.github.com/vitejs/vite/tree/HEAD/packages/vite))
| [`6.2.5` ->
`6.2.6`](https://renovatebot.com/diffs/npm/vite/6.2.5/6.2.6) |
[![age](https://developer.mend.io/api/mc/badges/age/npm/vite/6.2.6?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/vite/6.2.6?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/vite/6.2.5/6.2.6?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vite/6.2.5/6.2.6?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

### GitHub Vulnerability Alerts

####
[CVE-2025-32395](https://redirect.github.com/vitejs/vite/security/advisories/GHSA-356w-63v5-8wf4)

### Summary
The contents of arbitrary files can be returned to the browser if the
dev server is running on Node or Bun.

### Impact
Only apps with the following conditions are affected.

- explicitly exposing the Vite dev server to the network (using --host
or [server.host config
option](https://vitejs.dev/config/server-options.html#server-host))
- running the Vite dev server on runtimes that are not Deno (e.g. Node,
Bun)

### Details

[HTTP 1.1 spec (RFC 9112) does not allow `#` in
`request-target`](https://datatracker.ietf.org/doc/html/rfc9112#section-3.2).
Although an attacker can send such a request. For those requests with an
invalid `request-line` (it includes `request-target`), the spec
[recommends to reject them with 400 or
301](https://datatracker.ietf.org/doc/html/rfc9112#section-3.2-4). The
same can be said for HTTP 2
([ref1](https://datatracker.ietf.org/doc/html/rfc9113#section-8.3.1-2.4.1),
[ref2](https://datatracker.ietf.org/doc/html/rfc9113#section-8.3.1-3),
[ref3](https://datatracker.ietf.org/doc/html/rfc9113#section-8.1.1-3)).

On Node and Bun, those requests are not rejected internally and is
passed to the user land. For those requests, the value of
[`http.IncomingMessage.url`](https://nodejs.org/docs/latest-v22.x/api/http.html#messageurl)
contains `#`. Vite assumed `req.url` won't contain `#` when checking
`server.fs.deny`, allowing those kinds of requests to bypass the check.

On Deno, those requests are not rejected internally and is passed to the
user land as well. But for those requests, the value of
`http.IncomingMessage.url` did not contain `#`.

### PoC
```
npm create vite@latest
cd vite-project/
npm install
npm run dev
```
send request to read `/etc/passwd`
```
curl --request-target /@​fs/Users/doggy/Desktop/vite-project/#/../../../../../etc/passwd http://127.0.0.1:5173
```

---

### Release Notes

<details>
<summary>vitejs/vite (vite)</summary>

###
[`v6.2.6`](https://redirect.github.com/vitejs/vite/releases/tag/v6.2.6)

[Compare
Source](https://redirect.github.com/vitejs/vite/compare/v6.2.5...v6.2.6)

Please refer to
[CHANGELOG.md](https://redirect.github.com/vitejs/vite/blob/v6.2.6/packages/vite/CHANGELOG.md)
for details.

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/SAP/ui5-webcomponents-react).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yMzguMCIsInVwZGF0ZWRJblZlciI6IjM5LjIzOC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Author: renovate[bot]

examples/react-router-ts/package-lock.json

@@ -24460,8 +24460,8 @@ __metadata:
   linkType: hard
 
 "vite@npm:^5.4.8":
-  version: 5.4.17
-  resolution: "vite@npm:5.4.17"
+  version: 5.4.18
+  resolution: "vite@npm:5.4.18"
   dependencies:
     esbuild: "npm:^0.21.3"
     fsevents: "npm:~2.3.3"
@@ -24498,13 +24498,13 @@ __metadata:
       optional: true
   bin:
     vite: bin/vite.js
-  checksum: 10c0/3322bd6d8da30cbc87b1b24cd14fdbca75abb36de81217d1062c8b4c574a1a0d28d11dfe23a3eed08b3d179d2bdc1510e0d7b9f3e1b722a45bd7631c7cec72eb
+  checksum: 10c0/a8cbbec6bdf399e62c386d70b8485e4f2f1b427beb19bc7c5d52b402a0c3750b7ff469fc20a8333755ea13bc1b0af5df3f22c8fd37d1739ee51d709b7a4740b6
   languageName: node
   linkType: hard
 
 "vite@npm:^6.0.0":
-  version: 6.2.5
-  resolution: "vite@npm:6.2.5"
+  version: 6.2.6
+  resolution: "vite@npm:6.2.6"
   dependencies:
     esbuild: "npm:^0.25.0"
     fsevents: "npm:~2.3.3"
@@ -24550,7 +24550,7 @@ __metadata:
       optional: true
   bin:
     vite: bin/vite.js
-  checksum: 10c0/226bb3c1875e1982559007007580e8d083b81f5289f18e28841d622ba030599e1bd9926adccc8264879e319e9f9e4f48a38a0dc52a5dfcdf2a9cb7313bfc1816
+  checksum: 10c0/68a2ed3e61bdd654c59b817b4f3203065241c66d1739faa707499130f3007bc3a666c7a8320a4198e275e62b5e4d34d9b78a6533f69e321d366e76f5093b2071
   languageName: node
   linkType: hard