Skip to content

chore: Resolve vite vulns #186

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 9 commits into from
Nov 14, 2024
Merged

chore: Resolve vite vulns #186

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
2200fd0
chore: Resolve vite, rollup vulns
suejung-sentry Nov 8, 2024
c0b7035
Merge remote-tracking branch 'origin/main' into sshin/chore/vuln
suejung-sentry Nov 13, 2024
b34ffa1
fix package.json within same major version
suejung-sentry Nov 14, 2024
1de943c
fix type checks
suejung-sentry Nov 14, 2024
70c6468
fix versions
suejung-sentry Nov 14, 2024
4ad5f11
use later version, add changeset
suejung-sentry Nov 14, 2024
1e93a53
fix integration test
suejung-sentry Nov 14, 2024
21d7457
regenerate to get non-vulnerable versions
suejung-sentry Nov 14, 2024
f81dc50
fix integration tests
suejung-sentry Nov 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions .changeset/giant-peas-matter.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
---
"@codecov/nextjs-webpack-plugin": minor
"@codecov/remix-vite-plugin": minor
"@codecov/solidstart-plugin": minor
"@codecov/sveltekit-plugin": minor
"@codecov/bundle-analyzer": minor
"@codecov/webpack-plugin": minor
"@codecov/nuxt-plugin": minor
"@codecov/vite-plugin": minor
"@codecov/bundler-plugin-core": minor
"@codecov/rollup-plugin": minor
---

Bump vite versions
2 changes: 1 addition & 1 deletion examples/oidc/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@
"eslint-plugin-react-refresh": "^0.4.5",
"rollup": "^4.9.6",
"typescript": "^5.3.3",
"vite": "^5.2.10"
"vite": "^5.2.14"
},
"volta": {
"extends": "../../package.json"
Expand Down
2 changes: 1 addition & 1 deletion examples/remix/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@
"postcss": "^8.4.38",
"tailwindcss": "^3.4.4",
"typescript": "^5.1.6",
"vite": "^5.1.0",
"vite": "^5.1.8",
"vite-tsconfig-paths": "^4.2.1"
},
"engines": {
Expand Down
2 changes: 1 addition & 1 deletion examples/sveltekit/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@
"svelte-check": "^3.6.0",
"tslib": "^2.4.1",
"typescript": "^5.0.0",
"vite": "^5.0.3"
"vite": "^5.1.8"
},
"type": "module"
}
2 changes: 1 addition & 1 deletion examples/tokenless/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@
"eslint-plugin-react-refresh": "^0.4.5",
"rollup": "^4.9.6",
"typescript": "^5.3.3",
"vite": "^5.2.10"
"vite": "^5.2.14"
},
"volta": {
"extends": "../../package.json"
Expand Down
2 changes: 1 addition & 1 deletion examples/vite/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@
"eslint-plugin-react-refresh": "^0.4.5",
"rollup": "^4.9.6",
"typescript": "^5.3.3",
"vite": "^5.2.10"
"vite": "^5.2.14"
},
"volta": {
"extends": "../../package.json"
Expand Down
20 changes: 10 additions & 10 deletions ...ration-tests/fixtures/generate-bundle-stats/remix/__snapshots__/remix-plugin.test.ts.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ exports[`Generating remix stats 2 {"format":"amd","expected":"amd"} matches the
"bundleName": StringContaining "test-remix-v2-client-amd",
"bundler": {
"name": "rollup",
"version": "4.16.2",
"version": "4.21.2",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand All @@ -28,7 +28,7 @@ exports[`Generating remix stats 2 {"format":"amd","expected":"amd"} matches the
"bundleName": StringContaining "test-remix-v2-server-esm",
"bundler": {
"name": "rollup",
"version": "4.16.2",
"version": "4.21.2",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand All @@ -49,7 +49,7 @@ exports[`Generating remix stats 2 {"format":"cjs","expected":"cjs"} matches the
"bundleName": StringContaining "test-remix-v2-client-cjs",
"bundler": {
"name": "rollup",
"version": "4.16.2",
"version": "4.21.2",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand All @@ -70,7 +70,7 @@ exports[`Generating remix stats 2 {"format":"cjs","expected":"cjs"} matches the
"bundleName": StringContaining "test-remix-v2-server-esm",
"bundler": {
"name": "rollup",
"version": "4.16.2",
"version": "4.21.2",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand All @@ -91,7 +91,7 @@ exports[`Generating remix stats 2 {"format":"es","expected":"esm"} matches the s
"bundleName": StringContaining "test-remix-v2-client-esm",
"bundler": {
"name": "rollup",
"version": "4.16.2",
"version": "4.21.2",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand All @@ -112,7 +112,7 @@ exports[`Generating remix stats 2 {"format":"es","expected":"esm"} matches the s
"bundleName": StringContaining "test-remix-v2-server-esm",
"bundler": {
"name": "rollup",
"version": "4.16.2",
"version": "4.21.2",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand All @@ -133,7 +133,7 @@ exports[`Generating remix stats 2 {"format":"esm","expected":"esm"} matches the
"bundleName": StringContaining "test-remix-v2-client-esm",
"bundler": {
"name": "rollup",
"version": "4.16.2",
"version": "4.21.2",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand All @@ -154,7 +154,7 @@ exports[`Generating remix stats 2 {"format":"esm","expected":"esm"} matches the
"bundleName": StringContaining "test-remix-v2-server-esm",
"bundler": {
"name": "rollup",
"version": "4.16.2",
"version": "4.21.2",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand All @@ -175,7 +175,7 @@ exports[`Generating remix stats 2 {"format":"module","expected":"esm"} matches t
"bundleName": StringContaining "test-remix-v2-client-esm",
"bundler": {
"name": "rollup",
"version": "4.16.2",
"version": "4.21.2",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand All @@ -196,7 +196,7 @@ exports[`Generating remix stats 2 {"format":"module","expected":"esm"} matches t
"bundleName": StringContaining "test-remix-v2-server-esm",
"bundler": {
"name": "rollup",
"version": "4.16.2",
"version": "4.21.2",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand Down
2 changes: 2 additions & 0 deletions integration-tests/fixtures/generate-bundle-stats/remix/vite-base.config.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,9 @@ export default defineConfig({
v3_throwAbortReason: true,
},
}),
//@ts-expect-error handle conflicting vite version types
tsconfigPaths(),
//@ts-expect-error handle conflicting vite version types
codecovRemixVitePlugin({
enableBundleAnalysis: true,
bundleName: "test-remix-v2",
Expand Down
12 changes: 6 additions & 6 deletions ...ests/fixtures/generate-bundle-stats/sveltekit/__snapshots__/sveltekit-plugin.test.ts.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ exports[`Generating sveltekit stats 2 {"format":"es","expected":"esm"} matches t
"bundleName": StringContaining "test-sveltekit-v2-client-esm",
"bundler": {
"name": "rollup",
"version": "4.16.2",
"version": "4.21.2",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand All @@ -28,7 +28,7 @@ exports[`Generating sveltekit stats 2 {"format":"es","expected":"esm"} matches t
"bundleName": StringContaining "test-sveltekit-v2-server-esm",
"bundler": {
"name": "rollup",
"version": "4.16.2",
"version": "4.21.2",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand All @@ -49,7 +49,7 @@ exports[`Generating sveltekit stats 2 {"format":"esm","expected":"esm"} matches
"bundleName": StringContaining "test-sveltekit-v2-client-esm",
"bundler": {
"name": "rollup",
"version": "4.16.2",
"version": "4.21.2",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand All @@ -70,7 +70,7 @@ exports[`Generating sveltekit stats 2 {"format":"esm","expected":"esm"} matches
"bundleName": StringContaining "test-sveltekit-v2-server-esm",
"bundler": {
"name": "rollup",
"version": "4.16.2",
"version": "4.21.2",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand All @@ -91,7 +91,7 @@ exports[`Generating sveltekit stats 2 {"format":"module","expected":"esm"} match
"bundleName": StringContaining "test-sveltekit-v2-client-esm",
"bundler": {
"name": "rollup",
"version": "4.16.2",
"version": "4.21.2",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand All @@ -112,7 +112,7 @@ exports[`Generating sveltekit stats 2 {"format":"module","expected":"esm"} match
"bundleName": StringContaining "test-sveltekit-v2-server-esm",
"bundler": {
"name": "rollup",
"version": "4.16.2",
"version": "4.21.2",
},
"chunks": ExpectArrayContaining {},
"duration": Any<Number>,
Expand Down
1 change: 1 addition & 0 deletions integration-tests/fixtures/generate-bundle-stats/sveltekit/vite-base.config.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ export default defineConfig({
plugins: [
//@ts-expect-error handle conflicting vite version types
sveltekit(),
//@ts-expect-error handle conflicting vite version types
codecovSvelteKitPlugin({
enableBundleAnalysis: true,
bundleName: "test-sveltekit-v2",
Expand Down
20 changes: 10 additions & 10 deletions integration-tests/fixtures/generate-bundle-stats/vite/__snapshots__/vite-plugin.test.ts.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -924,7 +924,7 @@ exports[`Generating vite stats v5 {"format":"amd","expected":"amd"} matches the
"bundleName": StringContaining "test-vite-v5-amd",
"bundler": {
"name": "rollup",
"version": "4.16.2",
"version": "4.21.2",
},
"chunks": [
{
Expand Down Expand Up @@ -1015,7 +1015,7 @@ exports[`Generating vite stats v5 {"format":"cjs","expected":"cjs"} matches the
"bundleName": StringContaining "test-vite-v5-cjs",
"bundler": {
"name": "rollup",
"version": "4.16.2",
"version": "4.21.2",
},
"chunks": [
{
Expand Down Expand Up @@ -1106,7 +1106,7 @@ exports[`Generating vite stats v5 {"format":"es","expected":"esm"} matches the s
"bundleName": StringContaining "test-vite-v5-esm",
"bundler": {
"name": "rollup",
"version": "4.16.2",
"version": "4.21.2",
},
"chunks": [
{
Expand Down Expand Up @@ -1197,7 +1197,7 @@ exports[`Generating vite stats v5 {"format":"esm","expected":"esm"} matches the
"bundleName": StringContaining "test-vite-v5-esm",
"bundler": {
"name": "rollup",
"version": "4.16.2",
"version": "4.21.2",
},
"chunks": [
{
Expand Down Expand Up @@ -1288,7 +1288,7 @@ exports[`Generating vite stats v5 {"format":"module","expected":"esm"} matches t
"bundleName": StringContaining "test-vite-v5-esm",
"bundler": {
"name": "rollup",
"version": "4.16.2",
"version": "4.21.2",
},
"chunks": [
{
Expand Down Expand Up @@ -1379,7 +1379,7 @@ exports[`Generating vite stats v5 {"format":"iife","expected":"iife"} matches th
"bundleName": StringContaining "test-vite-v5-iife",
"bundler": {
"name": "rollup",
"version": "4.16.2",
"version": "4.21.2",
},
"chunks": [
{
Expand Down Expand Up @@ -1470,7 +1470,7 @@ exports[`Generating vite stats v5 {"format":"umd","expected":"umd"} matches the
"bundleName": StringContaining "test-vite-v5-umd",
"bundler": {
"name": "rollup",
"version": "4.16.2",
"version": "4.21.2",
},
"chunks": [
{
Expand Down Expand Up @@ -1561,7 +1561,7 @@ exports[`Generating vite stats v5 {"format":"system","expected":"system"} matche
"bundleName": StringContaining "test-vite-v5-system",
"bundler": {
"name": "rollup",
"version": "4.16.2",
"version": "4.21.2",
},
"chunks": [
{
Expand Down Expand Up @@ -1652,7 +1652,7 @@ exports[`Generating vite stats v5 {"format":"systemjs","expected":"system"} matc
"bundleName": StringContaining "test-vite-v5-system",
"bundler": {
"name": "rollup",
"version": "4.16.2",
"version": "4.21.2",
},
"chunks": [
{
Expand Down Expand Up @@ -1743,7 +1743,7 @@ exports[`Generating vite stats v5 source maps are enabled does not include any s
"bundleName": StringNotContaining ".map",
"bundler": {
"name": "rollup",
"version": "4.16.2",
"version": "4.21.2",
},
"chunks": [
{
Expand Down
1 change: 1 addition & 0 deletions integration-tests/fixtures/generate-bundle-stats/vite/vite-base.config.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@ export default defineConfig({
},
},
plugins: [
//@ts-expect-error handle conflicting vite version types
codecovVitePlugin({
enableBundleAnalysis: true,
bundleName: "test-vite-v5",
Expand Down
2 changes: 1 addition & 1 deletion integration-tests/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@
"rollupV4": "npm:[email protected]",
"ts-node": "^10.9.2",
"viteV4": "npm:[email protected]",
"viteV5": "npm:[email protected].10",
"viteV5": "npm:[email protected].14",
"vue-routerV4": "npm:[email protected]",
"vueV3": "npm:[email protected]",
"webpackV5": "npm:[email protected]"
Expand Down
2 changes: 1 addition & 1 deletion integration-tests/test-apps/bundle-analyzer/dotenv-vercel/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,6 @@
"@codecov/bundle-analyzer": "workspace:^",
"dotenv": "^16.4.5",
"typescript": "^5.0.2",
"vite": "npm:[email protected]"
"vite": "^5.2.14"
}
}
2 changes: 1 addition & 1 deletion integration-tests/test-apps/remix/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@
"postcss": "^8.4.38",
"tailwindcss": "^3.4.4",
"typescript": "^5.1.6",
"vite": "^5.1.0",
"vite": "^5.1.8",
"vite-tsconfig-paths": "^4.2.1"
},
"engines": {
Expand Down
2 changes: 1 addition & 1 deletion integration-tests/test-apps/sveltekit/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
"@sveltejs/kit": "^2.5.25",
"@sveltejs/vite-plugin-svelte": "^3.0.0",
"svelte": "^4.2.7",
"vite": "^5.0.3"
"vite": "^5.1.8"
},
"type": "module"
}
4 changes: 2 additions & 2 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,8 +45,8 @@
"prettier": "^3.2.4",
"typedoc": "^0.25.12",
"typescript": "^5.3.3",
"vite": "^5.2.10",
"vite-tsconfig-paths": "^4.3.2",
"vite": "^5.4.11",
"vite-tsconfig-paths": "^5.1.2",
"vitest": "^1.5.0"
},
"lint-staged": {
Expand Down
2 changes: 1 addition & 1 deletion packages/bundle-analyzer/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@
"ts-node": "^10.9.2",
"typedoc": "^0.25.12",
"unbuild": "^2.0.0",
"vite": "^5.2.10",
"vite": "^5.2.14",
"vite-tsconfig-paths": "^4.3.2",
"vitest": "^1.5.0"
},
Expand Down
1 change: 0 additions & 1 deletion packages/nextjs-webpack-plugin/vitest.config.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,6 @@ const packageJson = await import("./package.json");
export default defineProject({
...config,
plugins: [
// @ts-expect-error - using rollup plugin
{
...replace({
preventAssignment: true,
Expand Down
2 changes: 1 addition & 1 deletion packages/nuxt-plugin/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@
"typedoc": "^0.25.12",
"typescript": "^5.3.3",
"unbuild": "^2.0.0",
"vite": "^5.2.10",
"vite": "^5.2.14",
"vite-tsconfig-paths": "^4.3.2",
"vitest": "^1.5.0"
},
Expand Down
1 change: 0 additions & 1 deletion packages/nuxt-plugin/vitest.config.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,6 @@ const packageJson = await import("./package.json");
export default defineProject({
...config,
plugins: [
// @ts-expect-error - using rollup plugin
{
...replace({
preventAssignment: true,
Expand Down
Loading
Loading