Skip to content

Update dependency vite to v7.1.11 [SECURITY] #3541

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Oct 23, 2025
Merged

Update dependency vite to v7.1.11 [SECURITY] #3541

merged 1 commit into from
Oct 23, 2025

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Oct 20, 2025 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
vite (source) 7.1.5 -> 7.1.11 age confidence

GitHub Vulnerability Alerts

CVE-2025-62522

Summary

Files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows.

Impact

Only apps that match the following conditions are affected:

  • explicitly exposes the Vite dev server to the network (using --host or server.host config option)
  • running the dev server on Windows

Details

server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass by using a back slash(\). The root cause is that fs.readFile('/foo.png/') loads /foo.png.

PoC

npm create vite@latest
cd vite-project/
cat "secret" > .env
npm install
npm run dev
curl --request-target /.env\ http://localhost:5173
image

Release Notes

vitejs/vite (vite)

v7.1.11

Compare Source

Bug Fixes
Miscellaneous Chores
Code Refactoring
Build System

v7.1.10

Compare Source

Bug Fixes
Documentation
Miscellaneous Chores

v7.1.9

Compare Source

Reverts

v7.1.8

Compare Source

Bug Fixes
Documentation
Miscellaneous Chores

v7.1.7

Compare Source

Bug Fixes
  • build: fix ssr environment emitAssets: true when sharedConfigBuild: true (#​20787) (4c4583c)
  • client: use CSP nonce when rendering error overlay (#​20791) (9bc9d12)
  • deps: update all non-major dependencies (#​20811) (9f2247c)
  • glob: handle glob imports from folders starting with dot (#​20800) (105abe8)
  • hmr: trigger prune event when import is removed from non hmr module (#​20768) (9f32b1d)
  • hmr: wait for import.meta.hot.prune callbacks to complete before running other HMRs (#​20698) (98a3484)

v7.1.6

Compare Source

Bug Fixes
  • deps: update all non-major dependencies (#​20773) (88af2ae)
  • esbuild: inject esbuild helper functions with minified $ variables correctly (#​20761) (7e8e004)
  • fallback terser to main thread when nameCache is provided (#​20750) (a679a64)
  • types: strict env typings fail when skipLibCheck is false (#​20755) (cc54e29)
Miscellaneous Chores

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the dependencies Pull requests that update a dependency file label Oct 20, 2025
@renovate renovate bot requested a review from a team as a code owner October 20, 2025 22:29
@renovate renovate bot added the Security label Oct 20, 2025
@renovate renovate bot requested a review from BillCarsonFr October 20, 2025 22:29
@renovate renovate bot force-pushed the renovate/npm-vite-vulnerability branch from 0655a99 to 081ad69 Compare October 23, 2025 15:15
@fkwp fkwp merged commit 06337b9 into livekit Oct 23, 2025
19 checks passed
@renovate renovate bot deleted the renovate/npm-vite-vulnerability branch October 23, 2025 15:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@fkwp fkwp fkwp approved these changes

@BillCarsonFr BillCarsonFr Awaiting requested review from BillCarsonFr BillCarsonFr is a code owner automatically assigned from element-hq/element-call-reviewers

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file Security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@fkwp