[PR #6416] [MERGED] chore(deps): update Vite security patch and dependency inventory #7344

New issue

Closed

opened 2026-11-01 21:47:12 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-01 21:47:12 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/6416
Author: @raidnouredden-ux
Created: 10/22/2026
Status: ✅ Merged
Merged: 10/23/2026
Merged by: @gensokyo-dev

Base: main ← Head: fix/vite-security-bump

📝 Commits (3)

844cc80 fix(deps): bump vite 8.3.2 -> 8.3.5 to resolve high-severity advisories
2157414 chore(deps): update Vite security patch against current main
c35e2e3 Merge remote-tracking branch 'origin/main' into maintenance/vite-security-6416

📊 Changes

2 files changed (+420 additions, -19 deletions)

View changed files

📝 licenses/npm-dependencies.txt (+94 -9)
📝 package-lock.json (+326 -10)

📄 Description

Vite 8.3.2 has six npm advisories (highest severity: high). Update development tooling to Vite 8.3.5 with its required PostCSS/nested Rolldown dependencies, regenerate the dependency inventory, and preserve the existing TSRS libc selectors. Runtime dependency versions and root Rolldown remain unchanged.

Validation: full and production-only audits report zero vulnerabilities; installed-platform signature verification passes with no invalid/missing signatures (total verified count and cross-platform coverage unavailable). Static checks, docs checks and 11 compiled CLI/MCP cases pass. Runtime build outputs were byte-identical across the dependency update. Six isolated Ubuntu 26 runs of seven real CLI cases pass; updated default run: 22.235 s elapsed / 21.345 s CPU / 691.4 MiB peak cgroup memory, limited to one CPU and 2 GiB. No cache configuration changes or general speedup claim. Commands, measurements and limitations.

Current-head CI 39946346209 has completed: source/static checks and actual Windows, macOS arm64, Linux x64/arm64 package verification pass. Portable results: 28,070 passed / one failed / 209 skipped. The sole failure is independently reproduced on clean main with the original Vite 8.3.2 (#6675). Three matrix jobs are marked cancelled by fail-fast but all eight reports exist; all 2,127 expected files are represented with zero missing/duplicates and 28 skipped files. This is a failed diagnostic result, not successful CI. Both automated reviews have no actionable current findings.

Merge uses the existing PR-only permission under the owner's explicit authorization to ignore unrelated main failures. Required failure statuses and repository settings remain intact. No personal human-review attestation is made. Refs #6480.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/6416 **Author:** [@raidnouredden-ux](https://github.com/raidnouredden-ux) **Created:** 10/22/2026 **Status:** ✅ Merged **Merged:** 10/23/2026 **Merged by:** [@gensokyo-dev](https://github.com/gensokyo-dev) **Base:** `main` ← **Head:** `fix/vite-security-bump` --- ### 📝 Commits (3) - [`844cc80`](https://github.com/morluto/rea/commit/844cc80f9bee1edda9c27abb382d2ce3b2c7709a) fix(deps): bump vite 8.3.2 -> 8.3.5 to resolve high-severity advisories - [`2157414`](https://github.com/morluto/rea/commit/215741411e5ef67f8c370c03f0fec66f731a6113) chore(deps): update Vite security patch against current main - [`c35e2e3`](https://github.com/morluto/rea/commit/c35e2e37fe3c37e18f54cae9fb03d84e6a84bca3) Merge remote-tracking branch 'origin/main' into maintenance/vite-security-6416 ### 📊 Changes **2 files changed** (+420 additions, -19 deletions) <details> <summary>View changed files</summary> 📝 `licenses/npm-dependencies.txt` (+94 -9) 📝 `package-lock.json` (+326 -10) </details> ### 📄 Description Vite 8.3.2 has six npm advisories (highest severity: high). Update development tooling to Vite 8.3.5 with its required PostCSS/nested Rolldown dependencies, regenerate the dependency inventory, and preserve the existing TSRS libc selectors. Runtime dependency versions and root Rolldown remain unchanged. Validation: full and production-only audits report zero vulnerabilities; installed-platform signature verification passes with no invalid/missing signatures (total verified count and cross-platform coverage unavailable). Static checks, docs checks and 11 compiled CLI/MCP cases pass. Runtime build outputs were byte-identical across the dependency update. Six isolated Ubuntu 26 runs of seven real CLI cases pass; updated default run: 22.235 s elapsed / 21.345 s CPU / 691.4 MiB peak cgroup memory, limited to one CPU and 2 GiB. No cache configuration changes or general speedup claim. [Commands, measurements and limitations](https://github.com/morluto/rea/pull/6416#issuecomment-6363904437). Current-head CI 39946346209 has completed: source/static checks and actual Windows, macOS arm64, Linux x64/arm64 package verification pass. Portable results: 28,070 passed / one failed / 209 skipped. The sole failure is independently reproduced on clean main with the original Vite 8.3.2 (#6675). Three matrix jobs are marked cancelled by fail-fast but all eight reports exist; all 2,127 expected files are represented with zero missing/duplicates and 28 skipped files. This is a failed diagnostic result, not successful CI. Both automated reviews have no actionable current findings. Merge uses the existing PR-only permission under the owner's explicit authorization to ignore unrelated main failures. Required failure statuses and repository settings remain intact. No personal human-review attestation is made. Refs #6480. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-11-01 21:47:12 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-03 00:29:32 +00:00

[GH-ISSUE #5653] [Tracker] New issue intake by area (October 2026) #3423

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#7344

No description provided.

Rows
Columns