This repository was archived by the owner on Aug 30, 2026. It is now read-only.
v2.6.3 — Security: vite CVE fixes
Security
Bumps vite from 8.0.2 to 8.0.5, resolving all 3 Dependabot security alerts:
| # | Severity | CVE | Description |
|---|---|---|---|
| 5 | High | Path traversal | Optimized deps .map handling allows reading arbitrary files |
| 6 | High | Arbitrary file read | Dev server WebSocket allows unauthorized file access |
| 7 | Moderate | server.fs.deny bypass |
Query string parameters bypass filesystem deny rules |
Merged via Dependabot PR #18.
Tests
- ✅ 252 tests passed (4 skipped)
- No functional changes — dev dependency only