chore(deps): update dependency vite-4 to ^4.5.3 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
vite-4 (source)	^4.5.2 -> ^4.5.3

GitHub Vulnerability Alerts

CVE-2024-31207

Summary

Vite dev server option server.fs.deny did not deny requests for patterns with directories. An example of such a pattern is /foo/**/*.

Impact

Only apps setting a custom server.fs.deny that includes a pattern with directories, and explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Patches

Fixed in vite@5.2.6, vite@5.1.7, vite@5.0.13, vite@4.5.3, vite@3.2.10, vite@2.9.18

Details

server.fs.deny uses picomatch with the config of { matchBase: true }. matchBase only matches the basename of the file, not the path due to a bug (https://github.com/micromatch/picomatch/issues/89). The vite config docs read like you should be able to set fs.deny to glob with picomatch. Vite also does not set { dot: true } and that causes dotfiles not to be denied unless they are explicitly defined.

Reproduction

Set fs.deny to ['**/.git/**'] and then curl for /.git/config.

• with matchBase: true, you can get any file under .git/ (config, HEAD, etc).
• with matchBase: false, you cannot get any file under .git/ (config, HEAD, etc).

---

Release Notes

vitejs/vite (vite-4)

v4.5.3

Compare Source

---

Configuration

📅 Schedule: Branch creation - "" in timezone America/New_York, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[cypress-app-bot]

See the guidelines for reviewing dependency updates for info on how to review dependency update PRs.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[cypress]

14 flaky tests on run #55514 ↗︎

0

29255

1328

0

14

Details:

empty commit
Project: cypress	Commit: b20e68d643
Status: Passed	Duration: 19:05 💡
Started: May 21, 2024 5:34 PM	Ended: May 21, 2024 5:53 PM

  project-setup.cy.ts • 1 flaky test • launchpad-e2e

View Output

Test		Artifacts
... > skips the setup page when choosing e2e tests to run		Test Replay Screenshots

  commands/net_stubbing.cy.ts • 1 flaky test • 5x-driver-electron

View Output

Test		Artifacts
... > stops waiting when an fetch request is canceled		Test Replay

  e2e/origin/cookie_login.cy.ts • 1 flaky test • 5x-driver-electron

View Output

Test		Artifacts
cy.origin - cookie login > Max-Age > past max-age -> not logged in		Test Replay

  commands/files.cy.js • 1 flaky test • 5x-driver-electron

View Output

Test		Artifacts
... > passes through assertion error when not about existence		Test Replay

  runner/sessions.ui.cy.ts • 1 flaky test • app-e2e

View Output

Test		Artifacts
runner/cypress sessions.ui.spec > recreates session and fails validation		Test Replay Screenshots

The first 5 flaky specs are shown, see all 12 specs in Cypress Cloud.

Review all test suite changes for PR #29550 ↗︎