fix(devdeps): update dependency vite to v6.4.1 [security]#424
Conversation
![renovate-approve[bot]](https://avatars.githubusercontent.com/in/7394?s=60&v=4){kind=small}
|
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the Comment |
|
View your CI Pipeline Execution ↗ for commit ba3c30e
☁️ Nx Cloud last updated this comment at |
![nx-cloud[bot]](https://avatars.githubusercontent.com/in/80458?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
renovate
Bot
force-pushed
the
renovate/npm-vite-vulnerability
branch
from
553069a to
24b6737
Compare
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
renovate
Bot
force-pushed
the
renovate/npm-vite-vulnerability
branch
from
24b6737 to
55b730a
Compare
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
renovate
Bot
force-pushed
the
renovate/npm-vite-vulnerability
branch
from
55b730a to
7daf7cb
Compare
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
renovate
Bot
force-pushed
the
renovate/npm-vite-vulnerability
branch
from
7daf7cb to
e1f0996
Compare
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
renovate
Bot
force-pushed
the
renovate/npm-vite-vulnerability
branch
from
e1f0996 to
f35d3b4
Compare
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
renovate
Bot
force-pushed
the
renovate/npm-vite-vulnerability
branch
from
f35d3b4 to
3b9da9d
Compare
renovate
Bot
changed the title
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
renovate
Bot
force-pushed
the
renovate/npm-vite-vulnerability
branch
from
3b9da9d to
fccbcdd
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. ❌ Your project status has failed because the head coverage (18.75%) is below the target coverage (40.00%). You can increase the head coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## main #424 +/- ##
=======================================
Coverage 18.75% 18.75%
=======================================
Files 138 138
Lines 27368 27368
Branches 951 951
=======================================
Hits 5132 5132
Misses 22236 22236 🚀 New features to boost your workflow:
|
@forgerock/davinci-client
@forgerock/oidc-client
@forgerock/protect
@forgerock/sdk-types
@forgerock/sdk-utilities
@forgerock/iframe-manager
@forgerock/sdk-logger
@forgerock/sdk-oidc
@forgerock/sdk-request-middleware
@forgerock/storage
commit: |
|
Deployed d7f66d7 to https://ForgeRock.github.io/ping-javascript-sdk/pr-424/d7f66d7f386edff30bbeb6031beb4a95911f4c65 branch gh-pages in ForgeRock/ping-javascript-sdk |
📦 Bundle Size Analysis📦 Bundle Size Analysis🚨 Significant Changes🔻 @forgerock/journey-client - 0.0 KB (-82.0 KB, -100.0%) 📊 Minor Changes📈 @forgerock/journey-client - 82.0 KB (+0.0 KB) ➖ No Changes➖ @forgerock/device-client - 9.2 KB 13 packages analyzed • Baseline from latest Legend🆕 New package ℹ️ How bundle sizes are calculated
🔄 Updated automatically on each push to this PR |
renovate
Bot
force-pushed
the
renovate/npm-vite-vulnerability
branch
2 times, most recently
from
6c1ae3e to
bcfe2d0
Compare
There was a problem hiding this comment.
Nx Cloud has identified a possible root cause for your failed CI:
The PR introduces a security update for Vite (6.3.6 → 6.4.1) and adds immer 10.1.3 to the pnpm catalog. The lint failure occurs in @forgerock/davinci-client:nxLint with the error: "The 'immer' package is not used by '@forgerock/davinci-client' project" at packages/davinci-client/package.json:32:5.
Investigation findings:
- The davinci-client package.json line 32 contains:
"immer": "catalog:" - Source code analysis shows only one reference to immer: a side-effect import in src/types.ts:6 (
import 'immer';) with a comment indicating it's "needed only for getting types in workspace" - Dependency tree analysis (via pnpm list) confirms that immer 10.1.3 is already available as a transitive dependency through @reduxjs/toolkit 2.8.2
- The @nx/dependency-checks ESLint rule flags this because there are no direct runtime imports of the immer package beyond the side-effect import
Classification: code_change
The Nx dependency-checks rule is correctly identifying that immer should not be listed as a direct dependency since it's not directly imported/used in the package's code (except for the type side-effect). The package already receives immer through its @reduxjs/toolkit dependency.
The fix involves removing line 32 from packages/davinci-client/package.json ("immer": "catalog:"). The side-effect import in types.ts will continue to function because immer remains available in node_modules through the @reduxjs/toolkit transitive dependency chain. This aligns with best practices: only list packages as direct dependencies when they are directly imported in the source code.
The pnpm-lock.yaml will need to be regenerated after removing the direct dependency, but the immer package will still be present due to the @reduxjs/toolkit dependency, ensuring no functional changes.
A code change would likely not resolve this issue, so no action was taken.
🎓 To learn more about Self Healing CI, please visit nx.dev
renovate
Bot
force-pushed
the
renovate/npm-vite-vulnerability
branch
from
bcfe2d0 to
ba3c30e
Compare
2 participants
This PR contains the following updates:
6.3.4->6.4.16.3.6->6.4.1GitHub Vulnerability Alerts
CVE-2025-58751
Summary
Files starting with the same name with the public directory were served bypassing the
server.fssettings.Impact
Only apps that match the following conditions are affected:
server.hostconfig option)Details
The servePublicMiddleware function is in charge of serving public files from the server. It returns the viteServePublicMiddleware function which runs the needed tests and serves the page. The viteServePublicMiddleware function checks if the publicFiles variable is defined, and then uses it to determine if the requested page is public. In the case that the publicFiles is undefined, the code will treat the requested page as a public page, and go on with the serving function. publicFiles may be undefined if there is a symbolic link anywhere inside the public directory. In that case, every requested page will be passed to the public serving function. The serving function is based on the sirv library. Vite patches the library to add the possibility to test loading access to pages, but when the public page middleware disables this functionality since public pages are meant to be available always, regardless of whether they are in the allow or deny list.
In the case of public pages, the serving function is provided with the path to the public directory as a root directory. The code of the sirv library uses the join function to get the full path to the requested file. For example, if the public directory is "/www/public", and the requested file is "myfile", the code will join them to the string "/www/public/myfile". The code will then pass this string to the normalize function. Afterwards, the code will use the string's startsWith function to determine whether the created path is within the given directory or not. Only if it is, it will be served.
Since sirv trims the trailing slash of the public directory, the string's startsWith function may return true even if the created path is not within the public directory. For example, if the server's root is at "/www", and the public directory is at "/www/p", if the created path will be "/www/private.txt", the startsWith function will still return true, because the string "/www/private.txt" starts with "/www/p". To achieve this, the attacker will use ".." to ask for the file "../private.txt". The code will then join it to the "/www/p" string, and will receive "/www/p/../private.txt". Then, the normalize function will return "/www/private.txt", which will then be passed to the startsWith function, which will return true, and the processing of the page will continue without checking the deny list (since this is the public directory middleware which doesn't check that).
PoC
Execute the following shell commands:
Then, in a different shell, run the following command:
curl -v --path-as-is 'http://localhost:5173/private.txt'You will receive a 403 HTTP Response, because private.txt is denied.
Now in the same shell run the following command:
curl -v --path-as-is 'http://localhost:5173/../private.txt'You will receive the contents of private.txt.
Related links
CVE-2025-58752
Summary
Any HTML files on the machine were served regardless of the
server.fssettings.Impact
Only apps that match the following conditions are affected:
appType: 'spa'(default) orappType: 'mpa'is usedThis vulnerability also affects the preview server. The preview server allowed HTML files not under the output directory to be served.
Details
The serveStaticMiddleware function is in charge of serving static files from the server. It returns the viteServeStaticMiddleware function which runs the needed tests and serves the page. The viteServeStaticMiddleware function checks if the extension of the requested file is ".html". If so, it doesn't serve the page. Instead, the server will go on to the next middlewares, in this case htmlFallbackMiddleware, and then to indexHtmlMiddleware. These middlewares don't perform any test against allow or deny rules, and they don't make sure that the accessed file is in the root directory of the server. They just find the file and send back its contents to the client.
PoC
Execute the following shell commands:
Then, in a different shell, run the following command:
curl -v --path-as-is 'http://localhost:5173/../../../../../../../../../../../tmp/secret.html'The contents of /tmp/secret.html will be returned.
This will also work for HTML files that are in the root directory of the project, but are in the deny list (or not in the allow list). Test that by stopping the running server (CTRL+C), and running the following commands in the server's shell:
Then, in a different shell, run the following command:
curl -v --path-as-is 'http://localhost:5173/secret_files/secret.txt'You will receive a 403 HTTP Response, because everything in the secret_files directory is denied.
Now in the same shell run the following command:
curl -v --path-as-is 'http://localhost:5173/secret_files/secret.html'You will receive the contents of secret_files/secret.html.
CVE-2025-62522
Summary
Files denied by
server.fs.denywere sent if the URL ended with\when the dev server is running on Windows.Impact
Only apps that match the following conditions are affected:
server.hostconfig option)Details
server.fs.denycan contain patterns matching against files (by default it includes.env,.env.*,*.{crt,pem}as such patterns). These patterns were able to bypass by using a back slash(\). The root cause is thatfs.readFile('/foo.png/')loads/foo.png.PoC
Release Notes
vitejs/vite (vite)
v6.4.1Compare Source
Please refer to CHANGELOG.md for details.
v6.4.0Compare Source
Please refer to CHANGELOG.md for details.
v6.3.7Compare Source
Please refer to CHANGELOG.md for details.
v6.3.6Compare Source
Please refer to CHANGELOG.md for details.
v6.3.5Compare Source
Today, we're excited to announce the release of the next Vite major:
⚠ BREAKING CHANGES
Objectvariable in ssr transformed code (#19996)experimental.skipSsrTransformoption (#20038)HotBroadcaster(#19988)build.targetand name itbaseline-widely-available(#20007)HotBroadcasterrelated types (#19987)enforce/transformfromtransformIndexHtmlhook (#19349)Features
configurePreviewServerhook (#20224) (b989c42)configureServerhook (#20222) (f5cc4c0)this.meta.viteVersion(#20088) (f55bf41)createServer(#19894) (c1ae9bd)build.targetand name itbaseline-widely-available(#20007) (4a8aa82)css.preprocessorMaxWorkersand default totrue(#19992) (70aee13)optimizeDeps.noDiscovery(#19984) (6d2dcb4)Bug Fixes
import.meta.urlin bundled Vite (#20235) (3bf3a8a)ssrExportNameKey(#20266) (ac302a7)normalizeModuleId(#20277) (9b98dcb).then(m => m.a)(#20117) (7b7410a)build.rollupOptions.inputresolution with rollup (#20080) (9759c29)Objectvariable in ssr transformed code (#19996) (fceff60)preprocessorOptions.sass(fix #20150) (#20166) (7db56be)cleanGlobalCLIOptions()clean--force(#19999) (d4a171a)environments.*.resolve.noExternalproperly (#20077) (daf4a25)server.allowedHosts: truecorrectly (#20138) (2ade756)computeEntriesfailed (#20079) (b742b46)optimizeDeps.entriesvalues as globs (#20045) (1422395)Performance Improvements
numberToPos(#20244) (3f46901)Documentation
Miscellaneous Chores
ResolvedConfig.createResolverand recommendcreateIdResolver(#20031) (d101d64)devEnvironmentOptions.moduleRunnerTransform(#20035) (338081d)patch-typesplugin for bundling vite (#20089) (c127955)Code Refactoring
src/node/publicUtils.tstosrc/node/index.ts(#20086) (999a1ed)experimental.skipSsrTransformoption (#20038) (6c3dd8e)HotBroadcaster(#19988) (cda8c94)options?.ssrsupport in clientInjectionsPlugin (#19589) (88e0076)HotBroadcasterrelated types (#19987) (86b5e00)enforce/transformfromtransformIndexHtmlhook (#19349) (6198b9d)legacy.proxySsrExternalModules(#20013) (a37ac83)hostValidationMiddleware(#20019) (83bf90e)mergeWithDefaultsfor experimental option (#20012) (98c5741)Tests
useDefineForClassFieldstest (#20143) (d90796e)Continuous Integration
Beta Changelogs
7.0.0-beta.2 (2025-06-17)
See 7.0.0-beta.2 changelog
7.0.0-beta.1 (2025-06-10)
See 7.0.0-beta.1 changelog
7.0.0-beta.0 (2025-06-02)
See 7.0.0-beta.0 changelog
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.