Skip to content

Fix vulnerabilities through updating vitepress and rollup in node.js#2632

Open
grunt22fox wants to merge 2 commits intohacks-guide:masterfrom
grunt22fox:fix-vulnerabilities
Open

Fix vulnerabilities through updating vitepress and rollup in node.js#2632
grunt22fox wants to merge 2 commits intohacks-guide:masterfrom
grunt22fox:fix-vulnerabilities

Conversation

@grunt22fox
Copy link
Copy Markdown
Member

@grunt22fox grunt22fox commented Feb 28, 2026

Resolves 4 vulnerabilities by updating vitepress and rollup. Font-Awesome is also updated to the latest version. Vitepress is only updated to 2.0.0-alpha.1 as this resolves the three moderate vulnerabilities, and is tested working on wii.hacks.guide. Later versions seem to break the guide outright. Resolves #2626 and #2627.

BEFORE:

image

AFTER:

image

@lifehackerhansol
Copy link
Copy Markdown
Contributor

lifehackerhansol commented Apr 19, 2026

I updated the other deps separately, but I'm not a fan of shipping alpha in production precisely due to the name of the version. Last time I did that in production I switched an entire website to a different framework.

Furthermore, neither Vite vulnerabilities identified affect us because we do not use SSR in production. It does affect when running the dev instance, which nobody should be exposing to the public anyway and most certainly shouldn't be used in prod (and we can't even use it in prod because we're using GitHub Pages.)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants