morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #5776] [CLOSED] build(deps): update vite to 8.3.4 for launch-editor advisories #7050

New issue

Closed

opened 2026-11-01 21:44:59 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-01 21:44:59 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/5776
Author: @Yashasm18
Created: 10/21/2026
Status: ❌ Closed

Base: main ← Head: deps/vite-8.3.4

📝 Commits (1)

fd3b92c build(deps): update vite to 8.3.4 for launch-editor advisories

📊 Changes

1 file changed (+5 additions, -5 deletions)

View changed files

📝 package-lock.json (+5 -5)

📄 Description

Summary

npm audit flags one high severity issue in the tree: vite 8.3.2, which comes in through Vitest. Vite 8.3.0 to 8.3.2 ship a version of launch-editor with three published advisories:

GHSA-r825-w8mm-5pxw: editor CLI flags can be misread in a way that runs commands for some editors
GHSA-698v-4r3x-3vcv: escapeCmdArgs() doesn't escape % on Windows
GHSA-587h-7wmj-h5pm: the fs.existsSync() check can be bypassed on Windows

Vite fixed this in 8.3.3 back on October 6, so this bumps the lockfile to 8.3.4.

Problem and expected behavior

Vite is only a dev dependency here, so nothing in the published package changes and REA users aren't affected. It matters for anyone running the dev tooling locally. With this change, npm audit comes back clean.

Change and scope

Only package-lock.json changes. Vitest 5.0.3 already allows vite ^8.0.0, so package.json stays the same.

I used the pinned npm 11.16.0, so the diff is just the vite entry: its version, tarball and integrity, plus its postcss and rolldown ranges. The postcss 8.5.29 and rolldown 1.2.12 already in the lockfile satisfy those ranges, so nothing else moves. The vitepress override to vite 6.4.4 stays as it is, and that version isn't affected.

No scope decision needed, since this is a dependency update with no behavior change.

Contract and boundary impact

Semantic owner and earliest changed stage: the dev dependency lockfile.
Contribution scope fit and linked maintainer decision: dependency security update, not applicable.
CLI and MCP/tool-catalog contract: none.
Provider, bridge, target-format, or platform compatibility: none.
Evidence, artifact, provenance, or reconstruction contract: none.
Target selection, authority, upstream behavior, and cleanup details: not applicable.
Generated metadata, package, or installation impact: none. Vite isn't part of the published package.

Expected effects (none of these apply, since only dev tooling changes):

Read existing files or captured data.
Launch or attach to a process.
Inject instrumentation or run scripts/code.
Change process memory, registers, files, or configuration.
Contact network services.
Recover protected code or work around protections.
Documentation or usability only; no target interaction.
Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

Before, on main:

npm audit: 1 high (vite 8.3.2: GHSA-r825-w8mm-5pxw, GHSA-698v-4r3x-3vcv, GHSA-587h-7wmj-h5pm)

After:

npm audit: {"info":0,"low":0,"moderate":0,"high":0,"critical":0,"total":0}

npm ls vite postcss rolldown shows nothing invalid or missing.

For evidence-bearing changes:

Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

On macOS arm64 with Node v22.23.1 and npm 11.16.0:

npm ci, then npm update vite: the lockfile diff is the vite entry only, 5 lines.
npm audit: 0 vulnerabilities, down from 1 high.
npm run check:fast: typecheck and lint passed.
npx vitest run src: 11,901 passed and 13 skipped. One test (evidenceBundle.test.ts, the 125,000 dependents case) hit the 30 s timeout while another full test run was going on the same machine. On its own it passes in 10.4 s.

Compatibility, safety, and release

Breaking changes or migration steps: none. It's a patch update within Vite 8.3.
Real Hopper/Ghidra, browser, or OS coverage: not applicable.
Package or release metadata impact: none.
Security, privacy, process, or containment review: this takes a known vulnerable launch-editor out of the dev toolchain. The advisories are already public, so nothing new is disclosed here.

Author readiness

Human owner: @Yashasm18

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

Before merge

This PR addresses a concrete problem or an agreed enhancement.
Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/5776 **Author:** [@Yashasm18](https://github.com/Yashasm18) **Created:** 10/21/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `deps/vite-8.3.4` --- ### 📝 Commits (1) - [`fd3b92c`](https://github.com/morluto/rea/commit/fd3b92c208268a2ed917269e8a13828aa00cdcce) build(deps): update vite to 8.3.4 for launch-editor advisories ### 📊 Changes **1 file changed** (+5 additions, -5 deletions) <details> <summary>View changed files</summary> 📝 `package-lock.json` (+5 -5) </details> ### 📄 Description ## Summary `npm audit` flags one high severity issue in the tree: `vite` 8.3.2, which comes in through Vitest. Vite 8.3.0 to 8.3.2 ship a version of `launch-editor` with three published advisories: - [GHSA-r825-w8mm-5pxw](https://github.com/advisories/GHSA-r825-w8mm-5pxw): editor CLI flags can be misread in a way that runs commands for some editors - [GHSA-698v-4r3x-3vcv](https://github.com/advisories/GHSA-698v-4r3x-3vcv): `escapeCmdArgs()` doesn't escape `%` on Windows - [GHSA-587h-7wmj-h5pm](https://github.com/advisories/GHSA-587h-7wmj-h5pm): the `fs.existsSync()` check can be bypassed on Windows Vite fixed this in 8.3.3 back on October 6, so this bumps the lockfile to 8.3.4. ## Problem and expected behavior Vite is only a dev dependency here, so nothing in the published package changes and REA users aren't affected. It matters for anyone running the dev tooling locally. With this change, `npm audit` comes back clean. ## Change and scope Only `package-lock.json` changes. Vitest 5.0.3 already allows `vite ^8.0.0`, so `package.json` stays the same. I used the pinned npm 11.16.0, so the diff is just the vite entry: its version, tarball and integrity, plus its `postcss` and `rolldown` ranges. The `postcss` 8.5.29 and `rolldown` 1.2.12 already in the lockfile satisfy those ranges, so nothing else moves. The `vitepress` override to `vite` 6.4.4 stays as it is, and that version isn't affected. No scope decision needed, since this is a dependency update with no behavior change. ## Contract and boundary impact - Semantic owner and earliest changed stage: the dev dependency lockfile. - Contribution scope fit and linked maintainer decision: dependency security update, not applicable. - CLI and MCP/tool-catalog contract: none. - Provider, bridge, target-format, or platform compatibility: none. - Evidence, artifact, provenance, or reconstruction contract: none. - Target selection, authority, upstream behavior, and cleanup details: not applicable. - Generated metadata, package, or installation impact: none. Vite isn't part of the published package. Expected effects (none of these apply, since only dev tooling changes): - [ ] Read existing files or captured data. - [ ] Launch or attach to a process. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage Before, on `main`: ``` npm audit: 1 high (vite 8.3.2: GHSA-r825-w8mm-5pxw, GHSA-698v-4r3x-3vcv, GHSA-587h-7wmj-h5pm) ``` After: ``` npm audit: {"info":0,"low":0,"moderate":0,"high":0,"critical":0,"total":0} ``` `npm ls vite postcss rolldown` shows nothing invalid or missing. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed On macOS arm64 with Node v22.23.1 and npm 11.16.0: - `npm ci`, then `npm update vite`: the lockfile diff is the vite entry only, 5 lines. - `npm audit`: 0 vulnerabilities, down from 1 high. - `npm run check:fast`: typecheck and lint passed. - `npx vitest run src`: 11,901 passed and 13 skipped. One test (`evidenceBundle.test.ts`, the 125,000 dependents case) hit the 30 s timeout while another full test run was going on the same machine. On its own it passes in 10.4 s. ## Compatibility, safety, and release - Breaking changes or migration steps: none. It's a patch update within Vite 8.3. - Real Hopper/Ghidra, browser, or OS coverage: not applicable. - Package or release metadata impact: none. - Security, privacy, process, or containment review: this takes a known vulnerable `launch-editor` out of the dev toolchain. The advisories are already public, so nothing new is disclosed here. ## Author readiness Human owner: @Yashasm18 - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. ## Before merge - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-11-01 21:44:59 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-03 13:39:05 +00:00

[PR #7055] [CLOSED] fix(build): normalize release dependency patch directory for git apply #7608

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#7050

No description provided.

Rows
Columns