From b2025cd47b14dabf1a08ecc43780e30ac933fa36 Mon Sep 17 00:00:00 2001 From: Cliff Hall Date: Fri, 17 Jul 2026 19:59:15 -0400 Subject: [PATCH] chore(deps): bump vite to ^7.3.5 (CVE fixes) (#1709) Bumps the client's vite dev dependency from ^7.1.11 to ^7.3.5 to resolve Dependabot security alerts. - #123 (HIGH): vite server.fs.deny bypass, patched in 7.3.5 - #129 (MEDIUM): vulnerability in launch-editor, a transitive dep of vite; the newer vite no longer pulls in launch-editor, clearing it Claude-Session: https://claude.ai/code/session_01HiccCEh9mwCfVzE8qYcop1 Co-authored-by: Claude Opus 4.8 (1M context) --- client/package.json | 2 +- package-lock.json | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/client/package.json b/client/package.json index 26689deb..643e5e48 100644 --- a/client/package.json +++ b/client/package.json @@ -85,6 +85,6 @@ "ts-jest": "^29.4.0", "typescript": "^5.5.3", "typescript-eslint": "^8.38.0", - "vite": "^7.1.11" + "vite": "^7.3.5" } } diff --git a/package-lock.json b/package-lock.json index b283f1dc..fc765bf5 100644 --- a/package-lock.json +++ b/package-lock.json @@ -136,7 +136,7 @@ "ts-jest": "^29.4.0", "typescript": "^5.5.3", "typescript-eslint": "^8.38.0", - "vite": "^7.1.11" + "vite": "^7.3.5" } }, "client/node_modules/jest-environment-jsdom": { @@ -12959,13 +12959,13 @@ } }, "node_modules/vite": { - "version": "7.3.3", - "resolved": "https://registry.npmjs.org/vite/-/vite-7.3.3.tgz", - "integrity": "sha512-/4XH147Ui7OGTjg3HbdWe5arnZQSbfuRzdr9Ec7TQi5I7R+ir0Rlc9GIvD4v0XZurELqA035KVXJXpR61xhiTA==", + "version": "7.3.6", + "resolved": "https://registry.npmjs.org/vite/-/vite-7.3.6.tgz", + "integrity": "sha512-4XP60spRGjSZFf1qYH+dJIkK2znL3zQfl9KkOV9MkkRR/3Dls0dxaBsQPTloEc5BLXWPL9vsOxopxyKoMmDueg==", "dev": true, "license": "MIT", "dependencies": { - "esbuild": "^0.27.0", + "esbuild": "^0.27.0 || ^0.28.0", "fdir": "^6.5.0", "picomatch": "^4.0.3", "postcss": "^8.5.6",