chore(deps): update dependency vite-plugin-static-copy to v3.1.2 [security] #2101
+43 −18
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
✅ Deploy Preview for kleros-v2-neo ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
❌ Deploy Preview for kleros-v2-university failed. Why did it fail? →
|
✅ Deploy Preview for kleros-v2-testnet ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
| Important Review skippedIgnore keyword(s) in the title. ⛔ Ignored keywords (1)
Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the Note Free review on us!CodeRabbit is offering free reviews until Thu Nov 06 2025 to showcase some of the refinements we've made. Comment |
❌ Deploy Preview for kleros-v2-testnet-devtools failed. Why did it fail? →
|
renovate bot force-pushed the renovate/npm-vite-plugin-static-copy-vulnerability branch 5 times, most recently from ac37d04 to f714aba Compare renovate bot force-pushed the renovate/npm-vite-plugin-static-copy-vulnerability branch 7 times, most recently from 8989296 to cad782e Compare renovate bot force-pushed the renovate/npm-vite-plugin-static-copy-vulnerability branch 2 times, most recently from b1d0576 to 5464187 Compare renovate bot force-pushed the renovate/npm-vite-plugin-static-copy-vulnerability branch 3 times, most recently from bc256a1 to dd1fd7b Compare renovate bot force-pushed the renovate/npm-vite-plugin-static-copy-vulnerability branch 3 times, most recently from 94fa0a7 to 7cb9d42 Compare renovate bot force-pushed the renovate/npm-vite-plugin-static-copy-vulnerability branch 2 times, most recently from ac94285 to c2df71d Compare renovate bot force-pushed the renovate/npm-vite-plugin-static-copy-vulnerability branch 6 times, most recently from dfa4a29 to d63960c Compare renovate bot force-pushed the renovate/npm-vite-plugin-static-copy-vulnerability branch 3 times, most recently from d1f52d9 to c481e11 Compare renovate bot force-pushed the renovate/npm-vite-plugin-static-copy-vulnerability branch 5 times, most recently from 84b3f49 to 8c5bbfa Compare renovate bot force-pushed the renovate/npm-vite-plugin-static-copy-vulnerability branch 2 times, most recently from 471dfc4 to 9f465c6 Compare renovate bot force-pushed the renovate/npm-vite-plugin-static-copy-vulnerability branch from 9f465c6 to 40ebeaa Compare 
|
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Add this suggestion to a batch that can be applied as a single commit. This suggestion is invalid because no changes were made to the code. Suggestions cannot be applied while the pull request is closed. Suggestions cannot be applied while viewing a subset of changes. Only one suggestion per line can be applied in a batch. Add this suggestion to a batch that can be applied as a single commit. Applying suggestions on deleted lines is not supported. You must change the existing code in this line in order to create a valid suggestion. Outdated suggestions cannot be applied. This suggestion has been applied or marked resolved. Suggestions cannot be applied from pending reviews. Suggestions cannot be applied on multi-line comments. Suggestions cannot be applied while the pull request is queued to merge. Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
3.0.0->3.1.2GitHub Vulnerability Alerts
CVE-2025-57753
Summary
Files not included in
srcwas possible to access with a crafted request.Impact
Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
Arbitrary files can be disclosed by exploiting this vulnerability.
Details
Consider the following configuration in used by
vite.config.ts:The files under the
./public/imagesis only expected to be served. Abusing this vulnerability, an attacker can access arbitrary files on the filesystem.PoC
I've attached a demo app to showcase the bug.
Run it with
npm run devand issue the following HTTP requestOR
Observe that the
/etc/passwdfile is included in the response.Release Notes
sapphi-red/vite-plugin-static-copy (vite-plugin-static-copy)
v3.1.2Compare Source
Patch Changes
0bc6b49Thanks @sapphi-red! - Files not included insrcwas possible to acess with a crafted request. See GHSA-pp7p-q8fx-2968 for more details.v3.1.1Compare Source
Patch Changes
fc84156Thanks @sapphi-red! - fix a bug that the content was not sent when multiple vite-plugin-static-copy instance was usedv3.1.0Compare Source
Minor Changes
9c7cf2eThanks @MrRefactoring! - add Vite 7 to peer dep rangev3.0.2Compare Source
Patch Changes
89458b2Thanks @sapphi-red! - improved file grouping algorithm for better performancev3.0.1Compare Source
Patch Changes
#166
60409c5Thanks @sapphi-red! - fix absolute destination paths in copy targets incorrectly returning contents in dev#164
337f976Thanks @sapphi-red! - fixes case-insensitive path conflicts causing copy failures (EEXIST error)Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.
PR-Codex overview
This PR updates various dependencies in the
yarn.lockfile, including version upgrades and checksum changes, to ensure compatibility and stability of the project.Detailed summary
chokidar@npm:^3.6.0fdirfrom6.4.4to6.5.0tinyglobbyfrom0.2.13to0.2.15vite-plugin-static-copyfrom3.0.0to3.1.4picomatch@npm:^4.0.3