wonder/xinfra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: upgrade vite to 6.4.3 to fix launch-editor command injection and fs.deny bypass vulnerabilities

Browse Source 
- Fixes Dependabot alert #7 (GHSA-c27g-q93r-2cwf): launch-editor command injection via crafted request on Windows, patched in vite >= 5.4.9
- Fixes Dependabot alert #8 (GHSA-fx2h-pf6j-xcff): server.fs.deny bypass on Windows alternate paths, patched in vite >= 6.4.3
- Upgraded @vitejs/plugin-vue to ^5.2.4 for vite 6 compatibility
- Upgraded vue-tsc to ^2.2.12 for vite 6 compatibility
This commit is contained in:
guoyonghao
2026-07-22 16:22:01 +08:00
parent 75e1177b70
commit a974dd03cb
2 changed files with 743 additions and 210 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/package-lock.json
Generated
+740 -207
View File
File diff suppressed because it is too large Load Diff
frontend/package.json
+3 -3
View File
@@ -17,10 +17,10 @@
"axios": "^1.5.0" "axios": "^1.5.0"
}, },
"devDependencies": { "devDependencies": {
"@vitejs/plugin-vue": "^4.3.4", "@vitejs/plugin-vue": "^5.2.4",
"typescript": "^5.2.2", "typescript": "^5.2.2",
"vite": "^4.4.9", "vite": "^6.4.3",
"vue-tsc": "^1.8.11", "vue-tsc": "^2.2.12",
"unplugin-auto-import": "^0.16.6", "unplugin-auto-import": "^0.16.6",
"unplugin-vue-components": "^0.25.2" "unplugin-vue-components": "^0.25.2"
} }