chore: [security] bump vite from 6.2.6 to 6.3.5 #467

Merged
martinr92 merged 1 commit from dependabot-npm_and_yarn-develop-vite-6.3.5 into develop 2025-05-18 16:04:15 +00:00
martinr92 commented 2025-05-15 17:05:33 +00:00 (Migrated from gitlab.com)

Bumps vite from 6.2.6 to 6.3.5. This update includes a security fix.

Vulnerabilities fixed

Vite's server.fs.deny bypassed with /. for files under project root

Summary

The contents of files in the project root that are denied by a file matching pattern can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Only files that are under project root and are denied by a file matching pattern can be bypassed.

  • Examples of file matching patterns: .env, .env.*, *.{crt,pem}, **/.env
  • Examples of other patterns: **/.git/**, .git/**, .git/**/*

Details

server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass for files under root by using a combination of slash and dot (/.).

PoC

npm create vite@latest
cd vite-project/
cat "secret" > .env
</tr></table> 

... (truncated)

Patched versions: 4.5.14; 5.4.19; 6.1.6; 6.2.7; 6.3.4 Affected versions: = 6.3.0, <= 6.3.3

Release notes

Sourced from vite's releases.

v6.3.5

Please refer to CHANGELOG.md for details.

v6.3.4

Please refer to CHANGELOG.md for details.

v6.3.3

Please refer to CHANGELOG.md for details.

v6.3.2

Please refer to CHANGELOG.md for details.

create-vite@6.3.1

Please refer to CHANGELOG.md for details.

v6.3.1

Please refer to CHANGELOG.md for details.

create-vite@6.3.0

Please refer to CHANGELOG.md for details.

v6.3.0

Please refer to CHANGELOG.md for details.

v6.3.0-beta.2

Please refer to CHANGELOG.md for details.

v6.3.0-beta.1

Please refer to CHANGELOG.md for details.

v6.3.0-beta.0

Please refer to CHANGELOG.md for details.

v6.2.7

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.3.5 (2025-05-05)

6.3.4 (2025-04-30)

  • fix: check static serve file inside sirv (#19965) (c22c43d), closes #19965
  • fix(optimizer): return plain object when using require to import externals in optimized dependenci (efc5eab), closes #19940
  • refactor: remove duplicate plugin context type (#19935) (d6d01c2), closes #19935

6.3.3 (2025-04-24)

  • fix: ignore malformed uris in tranform middleware (#19853) (e4d5201), closes #19853
  • fix(assets): ensure ?no-inline is not included in the asset url in the production environment (#1949 (16a73c0), closes #19496
  • fix(css): resolve relative imports in sass properly on Windows (#19920) (ffab442), closes #19920
  • fix(deps): update all non-major dependencies (#19899) (a4b500e), closes #19899
  • fix(ssr): fix execution order of re-export (#19841) (ed29dee), closes #19841
  • fix(ssr): fix live binding of default export declaration and hoist exports getter (#19842) (80a91ff), closes #19842
  • perf: skip sourcemap generation for renderChunk hook of import-analysis-build plugin (#19921) (55cfd04), closes #19921
  • test(ssr): test ssrTransform re-export deps and test stacktrace with first line (#19629) (9399cda), closes #19629

6.3.2 (2025-04-18)

6.3.1 (2025-04-17)

6.3.0 (2025-04-16)

... (truncated)

Commits
  • 84e4647 release: v6.3.5
  • fd38d07 fix(ssr): handle uninitialized export access as undefined (#19959)
  • b040d54 release: v6.3.4
  • c22c43d fix: check static serve file inside sirv (#19965)
  • efc5eab fix(optimizer): return plain object when using require to import externals ...
  • d6d01c2 refactor: remove duplicate plugin context type (#19935)
  • db9eb97 release: v6.3.3
  • e4d5201 fix: ignore malformed uris in tranform middleware (#19853)
  • 55cfd04 perf: skip sourcemap generation for renderChunk hook of import-analysis-build...
  • ffab442 fix(css): resolve relative imports in sass properly on Windows (#19920)
  • Additional commits viewable in compare view

Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 6.2.6 to 6.3.5. **This update includes a security fix.** <details> <summary>Vulnerabilities fixed</summary> <blockquote> <p><strong>Vite's server.fs.deny bypassed with /. for files under project root</strong></p> <h3>Summary</h3> <p>The contents of files in <a href="https://vite.dev/config/shared-options.html#root">the project <code>root</code></a> that are denied by a file matching pattern can be returned to the browser.</p> <h3>Impact</h3> <p>Only apps explicitly exposing the Vite dev server to the network (using --host or <a href="https://vitejs.dev/config/server-options.html#server-host">server.host config option</a>) are affected. Only files that are under <a href="https://vite.dev/config/shared-options.html#root">project <code>root</code></a> and are denied by a file matching pattern can be bypassed.</p> <ul> <li>Examples of file matching patterns: <code>.env</code>, <code>.env.*</code>, <code>*.{crt,pem}</code>, <code>**/.env</code></li> <li>Examples of other patterns: <code>**/.git/**</code>, <code>.git/**</code>, <code>.git/**/*</code></li> </ul> <h3>Details</h3> <p><a href="https://vite.dev/config/server-options.html#server-fs-deny"><code>server.fs.deny</code></a> can contain patterns matching against files (by default it includes <code>.env</code>, <code>.env.*</code>, <code>*.{crt,pem}</code> as such patterns). These patterns were able to bypass for files under <code>root</code> by using a combination of slash and dot (<code>/.</code>).</p> <h3>PoC</h3> <pre><code>npm create vite@latest cd vite-project/ cat &quot;secret&quot; &gt; .env &lt;/tr&gt;&lt;/table&gt; </code></pre> </blockquote> <p>... (truncated)</p> <blockquote> <p>Patched versions: 4.5.14; 5.4.19; 6.1.6; 6.2.7; 6.3.4 Affected versions: <!-- raw HTML omitted -->= 6.3.0, &lt;= 6.3.3</p> </blockquote> </details> <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/releases">vite's releases</a>.</em></p> <blockquote> <h2>v6.3.5</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v6.3.5/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v6.3.4</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v6.3.4/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v6.3.3</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v6.3.3/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v6.3.2</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v6.3.2/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>create-vite@6.3.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/create-vite@6.3.1/packages/create-vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v6.3.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v6.3.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>create-vite@6.3.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/create-vite@6.3.0/packages/create-vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v6.3.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v6.3.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v6.3.0-beta.2</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v6.3.0-beta.2/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v6.3.0-beta.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v6.3.0-beta.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v6.3.0-beta.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v6.3.0-beta.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v6.2.7</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v6.2.7/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md">vite's changelog</a>.</em></p> <blockquote> <h2><!-- raw HTML omitted -->6.3.5 (2025-05-05)<!-- raw HTML omitted --></h2> <ul> <li>fix(ssr): handle uninitialized export access as undefined (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/19959">#19959</a>) (<a href="https://github.com/vitejs/vite/commit/fd38d076fe2455aac1e00a7b15cd51159bf12bb5">fd38d07</a>), closes <a href="https://github.com/vitejs/vite/issues/19959">#19959</a></li> </ul> <h2><!-- raw HTML omitted -->6.3.4 (2025-04-30)<!-- raw HTML omitted --></h2> <ul> <li>fix: check static serve file inside sirv (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/19965">#19965</a>) (<a href="https://github.com/vitejs/vite/commit/c22c43de612eebb6c182dd67850c24e4fab8cacb">c22c43d</a>), closes <a href="https://github.com/vitejs/vite/issues/19965">#19965</a></li> <li>fix(optimizer): return plain object when using <code>require</code> to import externals in optimized dependenci (<a href="https://github.com/vitejs/vite/commit/efc5eab253419fde0a6a48b8d2f233063d6a9643">efc5eab</a>), closes <a href="https://github.com/vitejs/vite/issues/19940">#19940</a></li> <li>refactor: remove duplicate plugin context type (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/19935">#19935</a>) (<a href="https://github.com/vitejs/vite/commit/d6d01c2292fa4f9603e05b95d81c8724314c20e0">d6d01c2</a>), closes <a href="https://github.com/vitejs/vite/issues/19935">#19935</a></li> </ul> <h2><!-- raw HTML omitted -->6.3.3 (2025-04-24)<!-- raw HTML omitted --></h2> <ul> <li>fix: ignore malformed uris in tranform middleware (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/19853">#19853</a>) (<a href="https://github.com/vitejs/vite/commit/e4d520141bcd83ad61f16767348b4a813bf9340a">e4d5201</a>), closes <a href="https://github.com/vitejs/vite/issues/19853">#19853</a></li> <li>fix(assets): ensure ?no-inline is not included in the asset url in the production environment (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/1949">#1949</a> (<a href="https://github.com/vitejs/vite/commit/16a73c05d35daa34117a173784895546212db5f4">16a73c0</a>), closes <a href="https://github.com/vitejs/vite/issues/19496">#19496</a></li> <li>fix(css): resolve relative imports in sass properly on Windows (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/19920">#19920</a>) (<a href="https://github.com/vitejs/vite/commit/ffab44270488f54ae344801024474b597249071b">ffab442</a>), closes <a href="https://github.com/vitejs/vite/issues/19920">#19920</a></li> <li>fix(deps): update all non-major dependencies (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/19899">#19899</a>) (<a href="https://github.com/vitejs/vite/commit/a4b500ef9ccc9b19a2882156a9ba8397e69bc6b2">a4b500e</a>), closes <a href="https://github.com/vitejs/vite/issues/19899">#19899</a></li> <li>fix(ssr): fix execution order of re-export (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/19841">#19841</a>) (<a href="https://github.com/vitejs/vite/commit/ed29dee2eb2e3573b2bc337e1a9124c65222a1e5">ed29dee</a>), closes <a href="https://github.com/vitejs/vite/issues/19841">#19841</a></li> <li>fix(ssr): fix live binding of default export declaration and hoist exports getter (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/19842">#19842</a>) (<a href="https://github.com/vitejs/vite/commit/80a91ff82426a4c88d54b9f5ec9a4205cb13899b">80a91ff</a>), closes <a href="https://github.com/vitejs/vite/issues/19842">#19842</a></li> <li>perf: skip sourcemap generation for renderChunk hook of import-analysis-build plugin (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/19921">#19921</a>) (<a href="https://github.com/vitejs/vite/commit/55cfd04b10f98cde7a96814a69b9813543ea79c2">55cfd04</a>), closes <a href="https://github.com/vitejs/vite/issues/19921">#19921</a></li> <li>test(ssr): test <code>ssrTransform</code> re-export deps and test stacktrace with first line (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/19629">#19629</a>) (<a href="https://github.com/vitejs/vite/commit/9399cdaf8c3b2efd5f4015d57dc3b0e4e5b91a9d">9399cda</a>), closes <a href="https://github.com/vitejs/vite/issues/19629">#19629</a></li> </ul> <h2><!-- raw HTML omitted -->6.3.2 (2025-04-18)<!-- raw HTML omitted --></h2> <ul> <li>fix: match default asserts case insensitive (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/19852">#19852</a>) (<a href="https://github.com/vitejs/vite/commit/cbdab1d6a30e07263ec51b2ca042369e736adec6">cbdab1d</a>), closes <a href="https://github.com/vitejs/vite/issues/19852">#19852</a></li> <li>fix: open first url if host does not match any urls (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/19886">#19886</a>) (<a href="https://github.com/vitejs/vite/commit/6abbdce3d77990409e12380e72c7ec9dd3f8bec5">6abbdce</a>), closes <a href="https://github.com/vitejs/vite/issues/19886">#19886</a></li> <li>fix(css): respect <code>css.lightningcss</code> option in css minification process (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/19879">#19879</a>) (<a href="https://github.com/vitejs/vite/commit/b5055e0dd4c0e084115c3dbfead5736a54807e0c">b5055e0</a>), closes <a href="https://github.com/vitejs/vite/issues/19879">#19879</a></li> <li>fix(deps): update all non-major dependencies (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/19698">#19698</a>) (<a href="https://github.com/vitejs/vite/commit/bab4cb92248adf6b9b18df12b2bf03889b0bd1eb">bab4cb9</a>), closes <a href="https://github.com/vitejs/vite/issues/19698">#19698</a></li> <li>feat(css): improve lightningcss messages (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/19880">#19880</a>) (<a href="https://github.com/vitejs/vite/commit/c713f79b5a4bd98542d8dbe4c85ba4cce9b1f358">c713f79</a>), closes <a href="https://github.com/vitejs/vite/issues/19880">#19880</a></li> </ul> <h2><!-- raw HTML omitted -->6.3.1 (2025-04-17)<!-- raw HTML omitted --></h2> <ul> <li>fix: avoid using <code>Promise.allSettled</code> in preload function (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/19805">#19805</a>) (<a href="https://github.com/vitejs/vite/commit/35c7f35e2b67f2158ededf2af58ecec53b3f16c5">35c7f35</a>), closes <a href="https://github.com/vitejs/vite/issues/19805">#19805</a></li> <li>fix: backward compat for internal plugin <code>transform</code> calls (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/19878">#19878</a>) (<a href="https://github.com/vitejs/vite/commit/a152b7cbac72e05668f8fc23074d531ecebb77a5">a152b7c</a>), closes <a href="https://github.com/vitejs/vite/issues/19878">#19878</a></li> </ul> <h2>6.3.0 (2025-04-16)</h2> <ul> <li>fix(hmr): avoid infinite loop happening with <code>hot.invalidate</code> in circular deps (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/19870">#19870</a>) (<a href="https://github.com/vitejs/vite/commit/d4ee5e8655a85f4d6bebc695b063d69406ab53ac">d4ee5e8</a>), closes <a href="https://github.com/vitejs/vite/issues/19870">#19870</a></li> <li>fix(preview): use host url to open browser (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/19836">#19836</a>) (<a href="https://github.com/vitejs/vite/commit/50034340401b4043bb0b158f18ffb7ae1b7f5c86">5003434</a>), closes <a href="https://github.com/vitejs/vite/issues/19836">#19836</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitejs/vite/commit/84e4647efac01efafcef95fb1c7ec9336fe0a94c"><code>84e4647</code></a> release: v6.3.5</li> <li><a href="https://github.com/vitejs/vite/commit/fd38d076fe2455aac1e00a7b15cd51159bf12bb5"><code>fd38d07</code></a> fix(ssr): handle uninitialized export access as undefined (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/19959">#19959</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/b040d547a17c4bfe8aba44534228667a50612318"><code>b040d54</code></a> release: v6.3.4</li> <li><a href="https://github.com/vitejs/vite/commit/c22c43de612eebb6c182dd67850c24e4fab8cacb"><code>c22c43d</code></a> fix: check static serve file inside sirv (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/19965">#19965</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/efc5eab253419fde0a6a48b8d2f233063d6a9643"><code>efc5eab</code></a> fix(optimizer): return plain object when using <code>require</code> to import externals ...</li> <li><a href="https://github.com/vitejs/vite/commit/d6d01c2292fa4f9603e05b95d81c8724314c20e0"><code>d6d01c2</code></a> refactor: remove duplicate plugin context type (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/19935">#19935</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/db9eb97b2f530a3985b29c5d1a529772f1ab1893"><code>db9eb97</code></a> release: v6.3.3</li> <li><a href="https://github.com/vitejs/vite/commit/e4d520141bcd83ad61f16767348b4a813bf9340a"><code>e4d5201</code></a> fix: ignore malformed uris in tranform middleware (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/19853">#19853</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/55cfd04b10f98cde7a96814a69b9813543ea79c2"><code>55cfd04</code></a> perf: skip sourcemap generation for renderChunk hook of import-analysis-build...</li> <li><a href="https://github.com/vitejs/vite/commit/ffab44270488f54ae344801024474b597249071b"><code>ffab442</code></a> fix(css): resolve relative imports in sass properly on Windows (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/19920">#19920</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitejs/vite/commits/v6.3.5/packages/vite">compare view</a></li> </ul> </details> <br />
martinr92 commented 2025-05-15 17:05:34 +00:00 (Migrated from gitlab.com)

assigned to @martinr92

assigned to @martinr92
martinr92 commented 2025-05-15 17:05:38 +00:00 (Migrated from gitlab.com)

mentioned in merge request !431

mentioned in merge request !431
martinr92 commented 2025-05-18 15:59:24 +00:00 (Migrated from gitlab.com)

added 6 commits

  • e9c61175...8ce7c981 - 5 commits from branch develop
  • 1769efa9 - chore: [security] bump vite from 6.2.6 to 6.3.5

Compare with previous version

added 6 commits <ul><li>e9c61175...8ce7c981 - 5 commits from branch <code>develop</code></li><li>1769efa9 - chore: [security] bump vite from 6.2.6 to 6.3.5</li></ul> [Compare with previous version](/marty-media/server/-/merge_requests/443/diffs?diff_id=1360969561&start_sha=e9c611754c30ded05282f377e5d9e93d2639d5d8)
martinr92 (Migrated from gitlab.com) scheduled this pull request to auto merge when all checks succeed 2025-05-18 15:59:34 +00:00
martinr92 commented 2025-05-18 16:03:18 +00:00 (Migrated from gitlab.com)
## SonarQube Cloud Code Analysis ## Quality Gate passed Issues ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed.svg '') [0 New issues](https://sonarcloud.io/project/issues?id=marty-media_server&pullRequest=443&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true) ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/accepted.svg '') [0 Accepted issues](https://sonarcloud.io/project/issues?id=marty-media_server&pullRequest=443&issueStatuses=ACCEPTED) Measures ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed.svg '') [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=marty-media_server&pullRequest=443&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true) ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed.svg '') [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=marty-media_server&pullRequest=443&metric=new_coverage&view=list) ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed.svg '') [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=marty-media_server&pullRequest=443&metric=new_duplicated_lines_density&view=list) [See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=marty-media_server&pullRequest=443)
martinr92 (Migrated from gitlab.com) merged commit into develop 2025-05-18 16:04:15 +00:00
martinr92 commented 2025-05-18 17:00:31 +00:00 (Migrated from gitlab.com)

🎉 This MR is included in version 0.9.0-beta.1 🎉

The release is available on GitLab release.

Your semantic-release bot 📦 🚀

:tada: This MR is included in version 0.9.0-beta.1 :tada: The release is available on [GitLab release](https://gitlab.com/marty-media/server/-/releases/v0.9.0-beta.1). Your **[semantic-release](https://github.com/semantic-release/semantic-release)** bot :package: :rocket:
martinr92 commented 2025-05-25 12:58:34 +00:00 (Migrated from gitlab.com)

🎉 This MR is included in version 0.9.0 🎉

The release is available on GitLab release.

Your semantic-release bot 📦 🚀

:tada: This MR is included in version 0.9.0 :tada: The release is available on [GitLab release](https://gitlab.com/marty-media/server/-/releases/v0.9.0). Your **[semantic-release](https://github.com/semantic-release/semantic-release)** bot :package: :rocket:
Sign in to join this conversation.
No description provided.