Skip to content
This repository was archived by the owner on Jul 14, 2023. It is now read-only.

Update dependency vite to v3.2.7 [SECURITY] #107

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update dependency vite to v3.2.7 [SECURITY] #107

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Jun 6, 2023 •
edited
Loading

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
vite (source) 3.1.4 -> 3.2.7 age adoption passing confidence

⚠ Dependency Lookup Warnings ⚠

Warnings were logged while processing this repo. Please check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2023-34092

Summary

Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) allows any unauthenticated user to read file from the Vite root-path of the application including the default fs.deny settings (['.env', '.env.*', '*.{crt,pem}'])

Impact

Only users explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected, and only files in the immediate Vite project root folder could be exposed.

Patches

Fixed in [email protected], [email protected], [email protected], [email protected]
And in the latest minors of the previous two majors: [email protected], [email protected]

Details

Vite serve the application with under the root-path of the project while running on the dev mode. By default, vite using server options fs.deny to protected the sensitive information of the file. But, with simply double forward-slash, we can bypass this fs restriction.

PoC

  1. Create a new latest project of vite using any package manager. (here I'm using react and vue templates for tested and pnpm)
  2. Serve the application on dev mode using pnpm run dev.
  3. Directly access the file from url using double forward-slash (//) (e.g: //.env, //.env.local)
  4. Server Options fs.deny restrict successfully bypassed.

Proof Images:
proof-1
proof-2

Release Notes

vitejs/vite

v3.2.7

Compare Source

Please refer to CHANGELOG.md for details.

v3.2.6

Compare Source

v3.2.5

Compare Source

v3.2.4

Compare Source

v3.2.3

Compare Source

v3.2.2

Compare Source

v3.2.1

Compare Source

v3.2.0

Compare Source

Main Changes
Multiple Entries for Library Mode

Library mode now supports multiple entries:

  lib: {
    entry: {
        primary: 'src/index.ts',
        secondary: 'src/secondary.ts'
    },
    formats: ['es', 'cjs']
  }
  // => primary.es.js, primary.cjs.js, secondary.es.js, secondary.cjs.js

Check out the PR #​7047, and the build.lib config docs

build.modulePreload options

Vite now allows filtering and modifying module preload dependencies for each entry and async chunk. experimental.renderBuiltUrl will also get called for preload asset paths. And build.modulePreload.resolveDependencies will be called both for JS dynamic imports preload lists and also for HTML preload lists for chunks imported from entry HTML files. Refer to the PR for more context #​9938 and check out the modulePreload config docs. Note: build.modulePreloadPolyfill is now deprecated, please migrate to build.modulePreload.polyfill.

Include Duplicate Assets in the Manifest

Laravel and other backends integrations will now get entries for every asset file, even if they have been de-duplicated. See #​9928 for more information.

Customizable ErrorOverlay

You can now customize the ErrorOverlay by using css parts. Check out the PR for more details: #​10234.

Features
Bug Fixes
Previous Changelogs
3.2.0-beta.4 (2022-10-24)

See 3.2.0-beta.4 changelog

3.2.0-beta.3 (2022-10-20)

See 3.2.0-beta.3 changelog

3.2.0-beta.2 (2022-10-14)

See 3.2.0-beta.2 changelog

3.2.0-beta.1 (2022-10-10)

See 3.2.0-beta.1 changelog

3.2.0-beta.0 (2022-10-05)

See 3.2.0-beta.0 changelog

v3.1.8

Compare Source

Please refer to CHANGELOG.md for details.

v3.1.7

Compare Source

Please refer to CHANGELOG.md for details.

v3.1.6

Compare Source

Please refer to CHANGELOG.md for details.

v3.1.5

Compare Source

Please refer to CHANGELOG.md for details.

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@vercel
Copy link

vercel bot commented Jun 6, 2023 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
strum-docs ❌ Failed (Inspect) Jun 6, 2023 4:49am

@renovate
Copy link
Contributor Author

renovate bot commented Jun 6, 2023

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml
installing v2 tool node v18.16.0
linking tool node v18.16.0
node: v18.16.0 /usr/local/bin/node
npm: 9.5.1  /usr/local/bin/npm
Installed v2 //usr/local/containerbase/tools/v2/node.sh in 3 seconds
installing v2 tool pnpm v7.18.2
linking tool pnpm v7.18.2
7.18.2
Installed v2 //usr/local/containerbase/tools/v2/pnpm.sh in 1 seconds
Scope: all 5 workspace projects

   ╭─────────────────────────────────────────────────────────────────╮
   │                                                                 │
   │                Update available! 7.18.2 → 8.6.1.                │
   │   Changelog: https://github.com/pnpm/pnpm/releases/tag/v8.6.1   │
   │                Run "pnpm add -g pnpm" to update.                │
   │                                                                 │
   │     Follow @pnpmjs for updates: https://twitter.com/pnpmjs      │
   │                                                                 │
   ╰─────────────────────────────────────────────────────────────────╯

Progress: resolved 1, reused 0, downloaded 0, added 0
 WARN  GET https://registry.npmjs.org/@fortawesome/fontawesome-svg-core/-/6.4.0/fontawesome-svg-core-6.4.0.tgz error (ERR_PNPM_FETCH_404). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/@fortawesome/free-brands-svg-icons/-/6.4.0/free-brands-svg-icons-6.4.0.tgz error (ERR_PNPM_FETCH_404). Will retry in 10 seconds. 2 retries left.
 WARN  GET https://registry.npmjs.org/@fortawesome/react-fontawesome/-/0.2.0/react-fontawesome-0.2.0.tgz error (ERR_PNPM_FETCH_404). Will retry in 10 seconds. 2 retries left.
Progress: resolved 19, reused 0, downloaded 14, added 0
Progress: resolved 33, reused 0, downloaded 28, added 0
packages/strum-react                     |  WARN  deprecated @vanilla-extract/[email protected]
Progress: resolved 57, reused 0, downloaded 52, added 0
 WARN  GET https://registry.npmjs.org/@fortawesome/sharp-solid-svg-icons/-/6.4.0/sharp-solid-svg-icons-6.4.0.tgz error (ERR_PNPM_FETCH_404). Will retry in 10 seconds. 2 retries left.
Progress: resolved 77, reused 0, downloaded 77, added 0
Progress: resolved 80, reused 0, downloaded 79, added 0
Progress: resolved 82, reused 0, downloaded 82, added 0
 WARN  GET https://registry.npmjs.org/@fortawesome/fontawesome-svg-core/-/6.4.0/fontawesome-svg-core-6.4.0.tgz error (ERR_PNPM_FETCH_404). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/@fortawesome/free-brands-svg-icons/-/6.4.0/free-brands-svg-icons-6.4.0.tgz error (ERR_PNPM_FETCH_404). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/@fortawesome/react-fontawesome/-/0.2.0/react-fontawesome-0.2.0.tgz error (ERR_PNPM_FETCH_404). Will retry in 1 minute. 1 retries left.
 WARN  GET https://registry.npmjs.org/@fortawesome/sharp-solid-svg-icons/-/6.4.0/sharp-solid-svg-icons-6.4.0.tgz error (ERR_PNPM_FETCH_404). Will retry in 1 minute. 1 retries left.
 ERR_PNPM_FETCH_404  GET https://registry.npmjs.org/@fortawesome/fontawesome-svg-core/-/6.4.0/fontawesome-svg-core-6.4.0.tgz: Not Found - 404

No authorization header was set for the request.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants