chore: bump up vite version to v5.0.13 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
vite (source)	5.0.12 -> 5.0.13

GitHub Vulnerability Alerts

CVE-2024-31207

Summary

Vite dev server option server.fs.deny did not deny requests for patterns with directories. An example of such a pattern is /foo/**/*.

Impact

Only apps setting a custom server.fs.deny that includes a pattern with directories, and explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Patches

Fixed in vite@5.2.6, vite@5.1.7, vite@5.0.13, vite@4.5.3, vite@3.2.10, vite@2.9.18

Details

server.fs.deny uses picomatch with the config of { matchBase: true }. matchBase only matches the basename of the file, not the path due to a bug (https://github.com/micromatch/picomatch/issues/89). The vite config docs read like you should be able to set fs.deny to glob with picomatch. Vite also does not set { dot: true } and that causes dotfiles not to be denied unless they are explicitly defined.

Reproduction

Set fs.deny to ['**/.git/**'] and then curl for /.git/config.

• with matchBase: true, you can get any file under .git/ (config, HEAD, etc).
• with matchBase: false, you cannot get any file under .git/ (config, HEAD, etc).

---

Release Notes

vitejs/vite (vite)

v5.0.13

Compare Source

Please refer to CHANGELOG.md for details.

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[nx-cloud]

☁️ Nx Cloud Report

CI is running/has finished running commands for commit f590d84. As they complete they will appear below. Click to see the status, the terminal output, and the build insights.

📂 See all runs for this CI Pipeline Execution

---

✅ Successfully ran 6 targets

• nx test:coverage @affine/monorepo
• nx build @affine/native -- --target x86_64-unknown-linux-gnu --use-napi-cross
• nx build @affine/native -- --target x86_64-pc-windows-msvc --use-napi-cross
• nx build @affine/storage -- --target x86_64-unknown-linux-gnu --use-napi-cross
• nx build @affine/native -- --target x86_64-apple-darwin --use-napi-cross
• nx build @affine/native -- --target aarch64-apple-darwin --use-napi-cross

---

Sent with 💌 from NxCloud.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 38.71%. Comparing base (b01a8bb) to head (f590d84).

Additional details and impacted files

@@             Coverage Diff             @@
##           canary    #6455       +/-   ##
===========================================
- Coverage   62.30%   38.71%   -23.60%     
===========================================
  Files         519      363      -156     
  Lines       24023     7884    -16139     
  Branches     2267     1363      -904     
===========================================
- Hits        14967     3052    -11915     
+ Misses       8790     4600     -4190     
+ Partials      266      232       -34     

Flag	Coverage Δ
server-test	?
unittest	38.71% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[graphite-app]

Merge activity

• Apr 7, 10:14 PM EDT: Brooooooklyn added this pull request to the Graphite merge queue.
• Apr 7, 10:45 PM EDT: The Graphite merge queue couldn't merge this PR because it was not satisfying all requirements (Failed CI: '3, 2, 1 Launch', 'E2E Test (2)', 'Server E2E Test 3/3').
• Apr 8, 9:11 AM EDT: Brooooooklyn added this pull request to the Graphite merge queue.
• Apr 8, 9:31 AM EDT: Brooooooklyn merged this pull request with the Graphite merge queue.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠ Warning: custom changes will be lost.