Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
⬆️ Update dependency vite to v5.4.6 [SECURITY] (#5261)
This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [vite](https://vitejs.dev) ([source](https://redirect.github.com/vitejs/vite/tree/HEAD/packages/vite)) | [`5.4.2` -> `5.4.6`](https://renovatebot.com/diffs/npm/vite/5.4.2/5.4.6) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | ### GitHub Vulnerability Alerts #### [CVE-2024-45811](https://redirect.github.com/vitejs/vite/security/advisories/GHSA-9cwx-2883-4wfx) ### Summary The contents of arbitrary files can be returned to the browser. ### Details `@fs` denies access to files outside of Vite serving allow list. Adding `?import&raw` to the URL bypasses this limitation and returns the file content if it exists. ### PoC ```sh $ npm create vite@latest $ cd vite-project/ $ npm install $ npm run dev $ echo "top secret content" > /tmp/secret.txt # expected behaviour $ curl "http://localhost:5173/@​fs/tmp/secret.txt" <body> <h1>403 Restricted</h1> <p>The request url "/tmp/secret.txt" is outside of Vite serving allow list. # security bypassed $ curl "http://localhost:5173/@​fs/tmp/secret.txt?import&raw" export default "top secret content\n" //# sourceMappingURL=data:application/json;base64,eyJ2... ``` --- ### Release Notes <details> <summary>vitejs/vite (vite)</summary> ### [`v5.4.6`](https://redirect.github.com/vitejs/vite/releases/tag/v5.4.6) [Compare Source](https://redirect.github.com/vitejs/vite/compare/v5.4.5...v5.4.6) Please refer to [CHANGELOG.md](https://redirect.github.com/vitejs/vite/blob/v5.4.6/packages/vite/CHANGELOG.md) for details. ### [`v5.4.5`](https://redirect.github.com/vitejs/vite/releases/tag/v5.4.5) [Compare Source](https://redirect.github.com/vitejs/vite/compare/v5.4.4...v5.4.5) Please refer to [CHANGELOG.md](https://redirect.github.com/vitejs/vite/blob/v5.4.5/packages/vite/CHANGELOG.md) for details. ### [`v5.4.4`](https://redirect.github.com/vitejs/vite/releases/tag/v5.4.4) [Compare Source](https://redirect.github.com/vitejs/vite/compare/v5.4.3...v5.4.4) Please refer to [CHANGELOG.md](https://redirect.github.com/vitejs/vite/blob/v5.4.4/packages/vite/CHANGELOG.md) for details. ### [`v5.4.3`](https://redirect.github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small543-2024-09-03-small) [Compare Source](https://redirect.github.com/vitejs/vite/compare/v5.4.2...v5.4.3) - fix: allow getting URL of JS files in publicDir ([#​17915](https://redirect.github.com/vitejs/vite/issues/17915)) ([943ece1](https://redirect.github.com/vitejs/vite/commit/943ece177e7709b3ba574e810afce347c51d4442)), closes [#​17915](https://redirect.github.com/vitejs/vite/issues/17915) - fix: cjs warning respect the logLevel flag ([#​17993](https://redirect.github.com/vitejs/vite/issues/17993)) ([dc3c14f](https://redirect.github.com/vitejs/vite/commit/dc3c14f39fcd57867c8ae81b75ae768b53b4b880)), closes [#​17993](https://redirect.github.com/vitejs/vite/issues/17993) - fix: improve CJS warning trace information ([#​17926](https://redirect.github.com/vitejs/vite/issues/17926)) ([5c5f82c](https://redirect.github.com/vitejs/vite/commit/5c5f82c84bb64309875b42eee9d4dd525ab42e8c)), closes [#​17926](https://redirect.github.com/vitejs/vite/issues/17926) - fix: only remove entry assets handled by Vite core ([#​17916](https://redirect.github.com/vitejs/vite/issues/17916)) ([ebfaa7e](https://redirect.github.com/vitejs/vite/commit/ebfaa7e6019783f308db5e759a6a67abb7cc626c)), closes [#​17916](https://redirect.github.com/vitejs/vite/issues/17916) - fix: waitForRequestIdle locked ([#​17982](https://redirect.github.com/vitejs/vite/issues/17982)) ([ad13760](https://redirect.github.com/vitejs/vite/commit/ad1376018a94b42540a8488d897cc520849e1228)), closes [#​17982](https://redirect.github.com/vitejs/vite/issues/17982) - fix(css): fix directory index import in sass modern api ([#​17960](https://redirect.github.com/vitejs/vite/issues/17960)) ([9b001ba](https://redirect.github.com/vitejs/vite/commit/9b001baa70c8489ac5550107c110a5dca281cda4)), closes [#​17960](https://redirect.github.com/vitejs/vite/issues/17960) - fix(css): fix sass `file://` reference ([#​17909](https://redirect.github.com/vitejs/vite/issues/17909)) ([561b940](https://redirect.github.com/vitejs/vite/commit/561b940f6f963fbb78058a6e23b4adad53a2edb9)), closes [#​17909](https://redirect.github.com/vitejs/vite/issues/17909) - fix(css): fix sass modern source map ([#​17938](https://redirect.github.com/vitejs/vite/issues/17938)) ([d428e7e](https://redirect.github.com/vitejs/vite/commit/d428e7e3a05f8da5ea00bb1b6a0827a5cc225899)), closes [#​17938](https://redirect.github.com/vitejs/vite/issues/17938) - fix(deps): bump tsconfck ([#​17990](https://redirect.github.com/vitejs/vite/issues/17990)) ([8c661b2](https://redirect.github.com/vitejs/vite/commit/8c661b20e92f33eb2e3ba3841b20dd6f6076f1ef)), closes [#​17990](https://redirect.github.com/vitejs/vite/issues/17990) - fix(html): rewrite assets url in <template> ([#​17988](https://redirect.github.com/vitejs/vite/issues/17988)) ([413c86a](https://redirect.github.com/vitejs/vite/commit/413c86aa971bc1ad8958578c929f45a368799f74)), closes [#​17988](https://redirect.github.com/vitejs/vite/issues/17988) - fix(preload): add crossorigin attribute in CSS link tags ([#​17930](https://redirect.github.com/vitejs/vite/issues/17930)) ([15871c7](https://redirect.github.com/vitejs/vite/commit/15871c75e0722adeda23f771fd6c45fecba4d118)), closes [#​17930](https://redirect.github.com/vitejs/vite/issues/17930) - chore: reduce diffs with v6 branch ([#​17942](https://redirect.github.com/vitejs/vite/issues/17942)) ([bf9065a](https://redirect.github.com/vitejs/vite/commit/bf9065aa13da6a519014c3bc1d34cfb1cb49ccca)), closes [#​17942](https://redirect.github.com/vitejs/vite/issues/17942) - chore(deps): update all non-major dependencies ([#​17945](https://redirect.github.com/vitejs/vite/issues/17945)) ([cfb621e](https://redirect.github.com/vitejs/vite/commit/cfb621e7a5a3e24d710a9af156e6855e73caf891)), closes [#​17945](https://redirect.github.com/vitejs/vite/issues/17945) - chore(deps): update all non-major dependencies ([#​17991](https://redirect.github.com/vitejs/vite/issues/17991)) ([0ca53cf](https://redirect.github.com/vitejs/vite/commit/0ca53cff9ff49108fcec75ff01d2445f9c2f2a4c)), closes [#​17991](https://redirect.github.com/vitejs/vite/issues/17991) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/dubzzz/fast-check). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOC44MC4wIiwidXBkYXRlZEluVmVyIjoiMzguODAuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
- Loading branch information
1 parent
58798b8
commit 85d21d3