Skip to content

Conversation

jrd-lewis
Copy link
Contributor

With the included vite ^6.0.3 dependency, there is a vulnerability with its own esbuild dependency. This PR updates vite to ^6.2.0, which mitigated it by updating esbuild to ^0.25.0 in vitejs/vite#19389.

Below is the warning before this PR:

# npm audit report

esbuild  <=0.24.2
Severity: moderate
esbuild enables any website to send any requests to the development server and read the response - https://github.com/advisories/GHSA-67mh-4wv8-2f99
fix available via `npm audit fix`
node_modules/esbuild
  vite  0.11.0 - 6.1.1
  Depends on vulnerable versions of esbuild
  node_modules/vite

2 moderate severity vulnerabilities

To address all issues, run:
  npm audit fix

@taylorotwell taylorotwell merged commit 596adac into laravel:main Feb 25, 2025
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants