Repository navigation
build(deps): add vite to core dev dependencies - #98
Merged
Merged
Conversation
vitest 5 turned vite into a required peer dependency. core did not declare it, so pnpm auto-installed the peer and kept it at the first version it resolved, 8.1.0. Neither pnpm update -r vite nor updating vitest re-resolves it, and Dependabot security updates for it failed with security_update_not_possible. vite 8.1.0 is affected by five advisories in its dev server and the launch-editor code it bundles: GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22 and GHSA-9jrq-w75r-8gcw, all fixed in 8.1.6. Declaring vite ^8.3.5 resolves it to 8.3.5 and lets pnpm update and Dependabot track it. vite 8.3.5 depends on rolldown ~1.2.14, so it shares rolldown 1.2.15 with tsdown and the lockfile drops rolldown 1.1.5 and its bindings.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Follow-up to #97, which cleared nine of the 14 Dependabot alerts on main. The other five are all for vite 8.1.0 and are fixed in 8.1.6:
fs.existsSync()existence check can be bypassed on WindowsescapeCmdArgs()omits%escaping on Windowsserver.fs.allowcould be served when project paths match system paths on non-Windows machinesAll five are in the Vite dev server and the launch-editor code it bundles. vite is only used by vitest in
@zipkit/core; the web app does not depend on it.vite stayed on 8.1.0 because nothing declares it. vitest 5 made vite a required peer dependency, so pnpm auto-installs it and keeps the version it first resolved.
pnpm update -r vite, the same with--depth Infinity, andpnpm update -r vitestall leave the lockfile unchanged, and Dependabot's security update jobs for vite fail withsecurity_update_not_possible.Changes
^8.3.5in the@zipkit/coredevDependencies, which resolves to 8.3.5. As a direct dependency, vite is now covered bypnpm outdated,pnpm updateand the weekly Dependabot group.~1.2.14and shares rolldown 1.2.15 with tsdown, so rolldown 1.1.5, its platform bindings and the wasm runtime packages only they used drop out of the lockfile.Verification
pnpm install --frozen-lockfile,pnpm dedupe --check,pnpm check,pnpm test(29 passed, on vite 8.3.5) andpnpm build(379 static pages)pnpm auditreports no known vulnerabilities, and no vite version in the new lockfile falls in the five alert rangespnpm --filter @zipkit/core add -D vite@^8.3.5leaves the lockfile unchanged