fix(deps): raise vite to 8.1.5 to close three dev-server file-read advisories; 2.0.0-rc.3 - #1841
Merged
Merged
Conversation
…visories; 2.0.0-rc.3 The #1837 sweep moved vite to 8.0.16 in the root and tui manifests but left `clients/web` pinned at **8.0.0** — `npm update` reported "up to date" and only an explicit install would move it. That left five open advisories, three high: GHSA-fx2h-pf6j-xcff high `server.fs.deny` bypass via Windows ADS GHSA-v2wj-q39q-566r high `server.fs.deny` bypassed with queries GHSA-p9ff-h696-f583 high arbitrary file read via the dev server GHSA-v6wh-96g9-6wx3 medium launch-editor NTLMv2 hash disclosure GHSA-4w7w-66w2-5vf9 medium path traversal in optimized deps These are worth fixing rather than dismissing as "dev-only". Unlike the other remaining dev-scope alerts, `server.fs.deny` bypass is *remotely triggerable*: a malicious page can read arbitrary files from anyone running `npm run dev`. Published-package users are unaffected — they get the built `dist` and never run vite — but contributors are. Also raises the declared floor to `^8.1.5` in all three manifests that declare vite. The root previously declared `^8.0.0`, which still *permitted* the vulnerable 8.0.0 on a fresh resolve, so pinning the lockfile alone would have left a regression path open. Bumped to rc.3 rather than folding this into 2.0.0: vite builds the shipped bundle, so changing it changes the artifact, and the tree that ships should be the tree that was validated against the live registry. rc.2 validated a different tree. `npm run ci` passes — full chain including the coverage gate, build gate, smokes, and 462 Storybook tests. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD
Merged
cliffhall
added a commit
that referenced
this pull request
Jul 28, 2026
The v2 go-live release (#1818, phase 5 of #1804). This is byte-identical to 2.0.0-rc.3 apart from dropping the prerelease suffix, which is what makes rc.3's validation meaningful: the tree that ships is the tree that was validated against the live registry. `2.0.0` has no hyphen, so the derivation added in #1834 resolves it to `latest` — this is the release that takes the tag from 1.0.1. Validated across three release candidates: - rc.1 caught two publish-path defects invisible to every local check — `NODE_AUTH_TOKEN` pointing at a non-existent secret (shadowing OIDC trusted publishing) and a missing npm CLI upgrade (trusted publishing needs >= 11.5.1; Node 22 bundles 10.x). Both fixed in #1836. - rc.2 validated the dependency sweep (#1837) that cleared every prod-scope advisory using lockfile-only changes. - rc.3 validated the vite 8.1.5 bump (#1841) closing three high-severity dev-server file-read advisories. Each RC was verified with a cold `node:22` container install driving the published tarball end to end — install, `--help`, and a real `--cli tools/list` against a live stdio server. `latest` remained on 1.0.1 throughout, proving the `--tag` derivation. Zero open Dependabot alerts at time of release. Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #1818. Closes five vite advisories, three of them high, and bumps to
2.0.0-rc.3.What the sweep missed
#1837 moved vite to 8.0.16 in the root and tui manifests, but
clients/webstayed pinned at 8.0.0.npm update vitereported "up to date" and only an explicit install would move it — nothing in the peer graph actually pinned it, npm was just being conservative.server.fs.denybypass via Windows alternate data streamsserver.fs.denybypassed with querieslaunch-editorNTLMv2 hash disclosure via UNC pathWhy these are worth fixing rather than dismissing
The other remaining dev-scope alerts are being dismissed as tolerable — these are not, and the distinction matters.
server.fs.denybypass is remotely triggerable: a malicious page can read arbitrary files from anyone runningnpm run dev. Published-package users are unaffected (they get the builtdistand never run vite), but contributors to this repo are directly exposed. That is a materially different risk profile from a lint-time glob DoS.The declared floor, not just the pin
Also raises the declared range to
^8.1.5in all three manifests that declare vite. The root previously declared^8.0.0, which still permitted the vulnerable 8.0.0 on a fresh resolve — so updating the lockfile alone would have left the regression path open.^8.0.0^8.1.5^8.0.0(pinned 8.0.0)^8.1.5^8.0.16^8.1.5Why rc.3 rather than folding into 2.0.0
vite builds the shipped bundle, so changing it changes the artifact. rc.2 validated a different tree. The discipline held throughout this phase is that the tree which ships is the tree that was validated against the live registry — so this gets its own RC rather than riding along untested.
Verification
npm run ci— exit 0. Full chain:validate→coverage(per-file ≥90) → build-gate → smokes → Storybook (462 tests, 109 files).What remains after this
Only
@vitest/browser(3 critical — the exact-pin knot, #1839) andesbuild(3 low). Both dev-scope, both genuinely blocked, both to be dismissed astolerable_risk. The eslint cluster was auto-dismissed by GitHub itself; see #1838 for whynpm auditstill reports it.🤖 Generated with Claude Code
https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD