Skip to content

Update dependency vite to v7.1.11 [SECURITY] #107

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Draft
wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

Update dependency vite to v7.1.11 [SECURITY] #107

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Oct 20, 2025

This PR contains the following updates:

Package Change Age Confidence
vite (source) 7.1.6 -> 7.1.11 age confidence

GitHub Vulnerability Alerts

CVE-2025-62522

Summary

Files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows.

Impact

Only apps that match the following conditions are affected:

  • explicitly exposes the Vite dev server to the network (using --host or server.host config option)
  • running the dev server on Windows

Details

server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass by using a back slash(\). The root cause is that fs.readFile('/foo.png/') loads /foo.png.

PoC

npm create vite@latest
cd vite-project/
cat "secret" > .env
npm install
npm run dev
curl --request-target /.env\ http://localhost:5173
image

Release Notes

vitejs/vite (vite)

v7.1.11

Compare Source

Bug Fixes
Miscellaneous Chores
Code Refactoring
Build System

v7.1.10

Compare Source

Bug Fixes
Documentation
Miscellaneous Chores

v7.1.9

Compare Source

Reverts

v7.1.8

Compare Source

Bug Fixes
Documentation
Miscellaneous Chores

v7.1.7

Compare Source

Bug Fixes
  • build: fix ssr environment emitAssets: true when sharedConfigBuild: true (#​20787) (4c4583c)
  • client: use CSP nonce when rendering error overlay (#​20791) (9bc9d12)
  • deps: update all non-major dependencies (#​20811) (9f2247c)
  • glob: handle glob imports from folders starting with dot (#​20800) (105abe8)
  • hmr: trigger prune event when import is removed from non hmr module (#​20768) (9f32b1d)
  • hmr: wait for import.meta.hot.prune callbacks to complete before running other HMRs (#​20698) (98a3484)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added dependencies Pull requests that update a dependency file T-Task labels Oct 20, 2025
@renovate renovate bot force-pushed the renovate/npm-vite-vulnerability branch from 19f0a86 to 2b7c710 Compare October 21, 2025 10:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file T-Task

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants