Skip to content

chore(deps): update vite-plus to v1.3.0 [security] - #50

Merged
setchy merged 1 commit into
mainfrom
renovate/npm-vite-plus-vulnerability
Oct 22, 2026
Merged

chore(deps): update vite-plus to v1.3.0 [security]#50
setchy merged 1 commit into
mainfrom
renovate/npm-vite-plus-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Oct 22, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
vite-plus (source) 1.1.0 → 1.3.0 age confidence

Vitest: Servers misapply server.fs.deny, serving .env, private keys, .git, and the API token file

CVE-2026-112948 / GHSA-p458-7748-mcp3

More information

Details

Summary

In Vitest 5, Vite's server.fs.deny is not applied as intended on Vitest's dev servers. Depending on the server, files that Vite refuses to serve by default (such as .env, private keys and certificates, .npmrc, and .git) or Vitest's own API token file (.vitest-secret-token) can be read over plain HTTP by a client that can reach the server. In Browser Mode with test.projects, a malicious website can also read .env values through the developer's browser.

This only applies when Vitest runs an HTTP server, which happens with the UI (--ui), Browser Mode, or api enabled. Plain vitest and vitest run don't listen on any port and are not affected. The fix ships in vitest, and @vitest/ui and @vitest/browser are listed because they are what enables the affected setups. Both pin vitest to the same version as a peer dependency, so upgrading either one also requires the patched vitest. Users who enable api without @vitest/ui or @vitest/browser are also affected and should upgrade vitest.

Details

Vitest 5 adds its API token file to server.fs.deny, but neither server ended up with the intended list. That's because of two Vite behaviors. Vite applies its default deny list only when server.fs.deny is unset, and it compiles the list into a matcher during config resolution, so later changes to the array have no effect.

setup listening server Vite's default deny list .vitest-secret-token
plain vitest / vitest run none not reachable not reachable
--ui or api root denied served (fallback location only)
Browser Mode, single project root (also the browser server) denied served (fallback location only)
Browser Mode with test.projects each browser project's server served denied
  • Project servers set deny: ['.vitest-secret-token'] from a config() hook, which replaces Vite's defaults. A project server listens on a port in Browser Mode with test.projects, so in that setup a request like GET /.env?raw returns the file. A plain GET /.env is also served as text/javascript, so a malicious page can include it with <script src="http://localhost:<port>/.env">. A classic script include needs no CORS, and each dotenv line whose value is valid JavaScript (a quoted string, number, or boolean) runs as a global assignment the page can read. A syntax error anywhere in the file, such as a # comment, keeps the whole script from running. The same missing defaults also loosen Browser Mode's file-access checks for server.readFile/writeFile/removeFile, screenshots, and traces.
  • The root server adds the token entry after Vite has compiled the matcher, so the entry is never applied. The token file normally lives in the per-user data directory, which is outside server.fs.allow. When that directory can't be written, for example in a container whose user has no writable HOME, Vitest falls back to <workspaceRoot>/node_modules/.vitest/.vitest-secret-token, which the root server then serves. The token authenticates the UI, /__vitest_attachment__, and the API WebSocket, whose RPC can write and rerun test files when api.allowWrite/api.allowExec are enabled.
Impact

Information disclosure from the Vitest dev server, and with the token, privileged API access.

  • From a malicious website, in Browser Mode with test.projects: while the browser server runs, any page the developer visits can read .env values that are valid JavaScript, through a classic <script> include. This works when the file consists of KEY="value" lines. An unquoted value causes a runtime error that stops the script at that line, so only the lines before it leak. A syntax error anywhere in the file, such as a # comment line or an export prefix, prevents the script from running at all. Recent Chrome versions may ask for Local Network Access permission first. fetch and XHR reads from other websites are still blocked by Vite's default CORS policy, and Vite's Host check blocks DNS rebinding. That CORS policy does allow localhost origins, so a page served from another local dev server could read full files. The token file can't be read through a classic <script>, because a bare token isn't valid JavaScript.
  • With local access or developer-set network exposure (such as api.host or browser.api.host, port forwarding, or a published container port): full file contents are readable over plain HTTP, including the token file when it's in the fallback location.

Only the machine running Vitest is exposed, while it runs one of the setups above. Applications built or deployed from the project aren't affected.

The fix is in vitest <PATCHED>. Vitest 4 and earlier are unaffected. They don't persist an API token, and they don't override server.fs.deny.

Workaround

Set server.fs.deny explicitly in the root Vitest config, including Vite's default list for your Vite version and the token file. For Vite 8.3:

export default defineConfig({
  server: {
    fs: {
      deny: [
        '.env',
        '.env.*',
        '*.{crt,pem,key,p12,pfx,cer,der}',
        '.npmrc',
        '.yarnrc.yml',
        '**/.git/**',
        '.vitest-secret-token',
      ],
    },
  },
})

Severity

  • CVSS Score: 6.5 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

voidzero-dev/vite-plus (vite-plus)

v1.3.0: vite-plus v1.3.0

Compare Source

Vite+ 1.3 adds create-vite-plus for starting a project without the global vp, new vp pm pkg and vp pm licenses commands, and package-manager dist-tags in vp env.

Features
  • Create a Vite+ project without installing the global vp through pnpm create vite-plus, npm create vite-plus@latest, yarn create vite-plus, or bun create vite-plus, which run vp create with the same arguments (docs) (#​3028, #​3048), by @​liangmiQwQ.
  • vp pm pkg get, set, delete, and fix read and update package.json through the detected package manager: npm 7.20.0 and later (fix from 9.8.0), pnpm 11.3.0 and later, and Bun 1.2.19 and later (docs) (#​3020), by @​jong-kyung.
  • vp pm licenses list (or ls) lists dependency licenses through pnpm 7.17.0 and later, Yarn Classic, or Bun 1.4.0 and later, with --json for machine-readable output (#​3037), by @​jong-kyung.
  • vp env accepts npm dist-tags in package-manager specs: vp env pin pnpm@latest-10 pins the exact version the tag points to, and vp env default pnpm@latest-10 follows the tag on each use (#​3047), by @​liangmiQwQ.
  • Upgrade the bundled tools (#​3058, #​3078), by @​voidzero-guard[bot] and @​fengmk2:
    • rolldown@1.2.13 to rolldown@1.2.14. Rolldown adds the output.charset option and fixes several tree-shaking, code-splitting, and renaming bugs.
    • vitest@5.0.4 to vitest@5.0.5, with fixes for browser mode, hook cleanup after a failing hook, and --changed with quoted file names.
Fixes & Enhancements
  • Import rewriting in vp migrate is up to 14 times faster on large projects, for example 78 s to 5.6 s on Dify (#​2987), by @​fengmk2.
  • vp dev prints Vite's ready in N ms line, so scripts that wait for it no longer time out after vp migrate. --debug, --filter, and --profile now take effect in vp dev, vp build, and vp preview, and vp preview stops when the build output is missing, as vite preview does (#​3056), by @​fengmk2.
  • vp staged prints one result line per task, such as ✔ vp check --fix, instead of the task list and Git progress. Warnings, errors, and rollback results stay visible, --verbose shows task output, and --debug keeps the full log (#​3060), by @​fengmk2.
  • After a successful upgrade, vp upgrade reminds you to run vp migrate in projects that use an older Vite+ version (#​3063), by @​KTrain5169.
  • The coding agent picker in vp create and vp migrate lists Claude Code under AGENTS.md and no longer offers a separate CLAUDE.md option. --agent claude and existing CLAUDE.md files still work (#​3055), by @​fengmk2.
Docs
  • Recommend setting runtimeOnFail: ignore and pmOnFail: ignore in the project's pnpm-workspace.yaml for pnpm 11 and later, since pnpm does not read runtimeOnFail from its global config (#​3077), by @​liangmiQwQ.
Chore
Bundled Versions
Tool Version Source Changelog
vite 8.3.4 b6c20f6 unchanged
rolldown 1.2.14 c9a8cda 1.2.14
tsdown 0.23.1 npm unchanged
vitest 5.0.5 npm 5.0.5
oxlint 1.88.0 npm unchanged
oxlint-tsgolint 7.0.2004 npm unchanged
oxfmt 0.73.0 npm unchanged
Upgrade
vp upgrade

Full Changelog: voidzero-dev/vite-plus@v1.2.0...v1.3.0

Published Packages
  • @voidzero-dev/vite-plus-core@1.3.0
  • vite-plus@1.3.0
  • create-vite-plus@1.3.0
Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

Docker:

docker run --rm -it -v "$PWD:/app" -w /app ghcr.io/voidzero-dev/vite-plus:1.3.0 vp build

Run any vp command without installing it; see the Docker guide for more.

Create a New App

Start a project without installing the global vp: create-vite-plus runs vp create through your package manager.

pnpm create vite-plus vite:application --directory my-app
cd my-app && pnpm exec vp dev

Run the command without arguments to pick a template interactively, and see the create guide for other package managers, templates, and options.

v1.2.0: vite-plus v1.2.0

Compare Source

Vite+ 1.2 supports authenticated private npm registries and shows a new vp run summary that counts cache hits among cache-enabled tasks and reports successful tasks. It also verifies installer downloads, shows download progress in vp upgrade, and fixes task cache misses in pnpm projects and PowerShell exit status.

Highlights
  • Support authenticated private npm registries (#​2624), by @​RSS1102.
  • The vp run summary now reads like 3/4 cache hit (75%), 9/10 successful, 2s saved.: the cache hit rate leaves out tasks with caching disabled, and the count of successful tasks replaces the count of failed tasks (vite-task#821), by @​wan9chi.
Features
  • The install.sh and install.ps1 installers check each downloaded platform archive against the registry's SHA-512 dist.integrity before extracting it, and stop when the digest is missing or does not match (#​2949), by @​fengmk2.
  • vp upgrade shows a progress bar while it downloads the new platform package, instead of looking frozen on slow connections (#​2968), by @​kshanxs.
  • When a task is not cached because it wrote a file it also read, the summary says it modified its inputs, and vp run --last-details shows the cache: { input, output } exclusions that let it be cached. Detailed summaries show each cause of an error on its own line, and an invalid --filter glob reports its error once (vite-task#783, vite-task#784, vite-task#761, vite-task#763), by @​wan9chi.
  • The task runner can be built without file-access tracking on additional platforms. Tasks on those platforms must configure both input and output explicitly to be cached (vite-task#829), by @​mfechner.
  • Upgrade the bundled tools (#​2935, #​2977, #​2998, #​3021, #​3039), by @​voidzero-guard[bot] and @​fengmk2:
    • vite@8.3.3 to vite@8.3.4.
    • rolldown@1.2.12 to rolldown@1.2.13.
    • tsdown@0.23.0 to tsdown@0.23.1.
    • vitest@5.0.3 to vitest@5.0.4. Vitest now turns on its on-disk caches by default, and vp test tasks run through vp run stay cacheable with them.
    • oxlint@1.87.0 to oxlint@1.88.0 and oxfmt@0.72.0 to oxfmt@0.73.0. Oxfmt now also formats TOML in Markdown code blocks and frontmatter. The new lint and format versions can flag code that passed before, so run vp fmt after upgrading if CI runs vp check.
    • vp migrate keeps Prettier and continues the rest of the migration when the Prettier config uses a format the bundled Oxfmt cannot read, such as .prettierrc.yml.
    • oxlint-tsgolint@7.0.2003 to oxlint-tsgolint@7.0.2004. Line disable comments apply to type-aware diagnostics again (tsgolint#1271), so disable comments moved to the } as T line for v1.1.0 need to move back above the statement.
    • Projects that use @effect/tsgo should stay on v1.1.0 for now. The latest @effect/tsgo@0.52.0 supports oxlint-tsgolint@7.0.2004 but not oxlint@1.88.0, so its install-time patch step fails until @effect/tsgo adds support.
Fixes & Enhancements
  • Reinstalling dependencies with pnpm, or installing them at another path, no longer causes task cache misses, and tasks that run pnpm run or pnpm exec no longer miss the cache after pnpm rechecks dependencies (vite-task#823, vite-task#824, vite-task#825), by @​wan9chi.
  • On macOS, tasks with automatic file-access tracking can run Node.js single executable applications, such as pnpm 11's standalone binary, and deno compile outputs (vite-task#840), by @​wan9chi.
  • Cached tasks can run scripts whose shebang names an interpreter path longer than 126 bytes (vite-task#788), by @​lifeiscontent.
  • When a cache hit's outputs cannot be restored, vp run fails with an error suggesting vp cache clean instead of reporting a successful cache hit (vite-task#770), by @​wan9chi.
  • vp run no longer stops every task when concurrent tasks write to a full output pipe, such as a CI log collector (vite-task#801), by @​naokihaba.
  • On Linux, tasks with automatic file-access tracking start faster (vite-task#817), by @​wan9chi.
  • In PowerShell, a failing vp command sets $? to False and stops && chains, as calling vp.exe directly does (#​2947), by @​fengmk2.
  • The Windows installer works when the PowerShell profile enables Set-StrictMode, and leaves the caller's strict mode unchanged (#​3005), by @​fengmk2.
  • Sourcing the Vite+ env script in POSIX shells is much faster with a long PATH, for example from 1.5 s to 6 ms in dash with 147 entries (#​2905), by @​jonykru.
  • Node.js version ranges from .node-version, engines.node, and devEngines.runtime, and package-manager version ranges, follow npm's semver rules (#​2835), by @​ryuapp.
  • vp migrate adds the tsdown <0.23 compatibility settings (deps.resolveDepSubpath and attw.profile) only for projects on an older tsdown, so upgrades from Vite+ 1.x or tsdown@0.23.0 and later keep the modern defaults (#​2910), by @​fengmk2.
  • vp create vite:generator keeps the description prompt visible instead of drawing the spinner over it, uses concrete version ranges for dependencies missing from the workspace catalog, adds rootDir: "src" to the generated tsconfig.json, and scaffolds generators on bingo@0.13.2 with Zod 4 option schemas (#​2940, #​2996, #​1831), by @​jong-kyung, @​fengmk2, and @​renovate[bot].
  • vp create stops processing an organization template archive that expands past fixed size, compression ratio, or entry count limits (#​2950), by @​fengmk2.
  • vp config skips Git config writes that change nothing, so concurrent runs across linked worktrees no longer fail with could not lock config file after the first setup (#​2958), by @​naokihaba.
  • Git hooks no longer append the legacy $VP_HOME/bin or ~/.vite-plus/bin directory to PATH. They use the inherited environment with the project's node_modules/.bin first, so projects without a local vite-plus dependency need the Vite+ bin directory on the Git client's PATH (#​2930), by @​liangmiQwQ.
  • Concurrent commands that need the same uninstalled Node.js version download it once; the others wait and reuse the installation (#​3024), by @​fengmk2.
  • @voidzero-dev/vite-plus-core declares the same postcss, optional fsevents, and Yuku parser ranges as the bundled Vite and tsdown, and @oxlint/plugins matches the bundled oxlint (#​2921), by @​fengmk2.
  • vp pack --help lists both default env prefixes, VITE_PACK_ and TSDOWN_ (#​3002), by @​jong-kyung.
  • Prompts and status lines use one space after status symbols (#​2928), by @​cpojer.
Docs
Chore
Bundled Versions
Tool Version Source Changelog
vite 8.3.4 b6c20f6 8.3.4
rolldown 1.2.13 f7de35f 1.2.13
tsdown 0.23.1 npm 0.23.1
vitest 5.0.4 npm 5.0.4
oxlint 1.88.0 npm 1.88.0
oxlint-tsgolint 7.0.2004 npm 7.0.2004
oxfmt 0.73.0 npm 0.73.0
Upgrade
vp upgrade
New Contributors

@​ryuapp @​jonykru @​myuron @​kshanxs @​mfechner

Full Changelog: voidzero-dev/vite-plus@v1.1.0...v1.2.0

Published Packages
  • @voidzero-dev/vite-plus-core@1.2.0
  • vite-plus@1.2.0
Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

Docker:

docker run --rm -it -v "$PWD:/app" -w /app ghcr.io/voidzero-dev/vite-plus:1.2.0 vp build

Run any vp command without installing it; see the Docker guide for more.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependency label Oct 22, 2026
@sonarqubecloud

sonarqubecloud Bot commented Oct 22, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@setchy
setchy merged commit 1a78d1d into main Oct 22, 2026
7 of 8 checks passed
@setchy
setchy deleted the renovate/npm-vite-plus-vulnerability branch October 22, 2026 09:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@afonsojramos afonsojramos Awaiting requested review from afonsojramos afonsojramos is a code owner
@setchy setchy Awaiting requested review from setchy setchy is a code owner

Assignees

No one assigned

Labels

dependency

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@setchy