ArchitectUI Vue Admin Free - v2.2.2

🔒 Security Patch & Dependency Refresh

Resolves 9 Dependabot alerts and refreshes every direct dependency to its latest release. All flagged packages are dev-only / transitive — none ship in the production bundle.

Security fixes

Advisory	Severity	Package	Issue
GHSA-fx2h-pf6j-xcff	High	vite	server.fs.deny bypass on Windows alternate paths
GHSA-v6wh-96g9-6wx3	Moderate	launch-editor	NTLMv2 hash disclosure via UNC path (Windows)
GHSA-vmh5-mc38-953g	High	undici	TLS certificate validation bypass (SOCKS5 ProxyAgent)
GHSA-hm92-r4w5-c3mj	High	undici	Cross-origin request routing (SOCKS5 pool reuse)
GHSA-pr7r-676h-xcf6	Moderate	undici	Cross-user disclosure (shared-cache whitespace bypass)
GHSA-p88m-4jfj-68fv	Moderate	undici	HTTP header injection (Set-Cookie percent-decoding)
GHSA-g8m3-5g58-fq7m	Low	undici	Set-Cookie SameSite downgrade (substring matching)
GHSA-35p6-xmwp-9g52	Low	undici	HTTP response queue poisoning (keep-alive socket reuse)
GHSA-4x5r-pxfx-6jf8	Low	@babel/core	Arbitrary file read via sourceMappingURL comment

• vite → 8.1.2 — clears the fs.deny bypass and drops the vulnerable launch-editor dependency from the tree entirely.
• undici → 7.28.0 (transitive via jsdom) — clears all six SOCKS5 / Set-Cookie / cache advisories (vulnerable range 7.0.0 – 7.27.2).
• @babel/core → 7.29.7 (transitive via @vitejs/plugin-vue-jsx) — clears the sourceMappingURL file-read advisory.
• npm audit: 3 vulnerabilities → 0.

Dependency updates

Vite 8.1.2 · Vue 3.5.39 · Vue Router 5.1.0 · BootstrapVueNext 0.45.7 · FontAwesome 7.3 · @types/node 26 · Vitest 4.1.9 · @vue/test-utils 2.4.11 · vue-tsc 3.3.6 · ESLint 10.6 · eslint-plugin-vue 10.9.2 · @typescript-eslint 8.62.1 · Prettier 3.9.4 · sass 1.101 · PostCSS 8.5.16 · autoprefixer 10.5.2 · @googlemaps/js-api-loader 2.1.1.

Verification

• npm run type-check — clean
• npm run build — succeeds, all chunks generated
• npm run test:run — 8/8 tests passing
• npm run lint — clean
• npm audit — 0 vulnerabilities

Full changelog: CHANGELOG.md