eclipse-langium / langium-website

Source of langium.org
https://langium.org/
MIT License
14 stars 34 forks source link

build: update vite to 4.5.3 #225

Open bjthehun opened 5 months ago

bjthehun commented 5 months ago

Updates vite to version 4.5.3, resolving multiple vulnerabilities with version 4.4.11:

$ npm audit
# npm audit report

@babel/traverse  <7.23.2
Severity: critical
Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code - https://github.com/advisories/GHSA-67hx-6x53-jw92
fix available via `npm audit fix`
node_modules/@babel/traverse

express  <4.19.2
Severity: moderate
Express.js Open Redirect in malformed URLs - https://github.com/advisories/GHSA-rv95-896h-c2vc
fix available via `npm audit fix`
node_modules/express

postcss  <8.4.31
Severity: moderate
PostCSS line return parsing error - https://github.com/advisories/GHSA-7fh5-64p2-3v2j
fix available via `npm audit fix`
node_modules/postcss

vite  4.0.0 - 4.5.2
Severity: high
Vite XSS vulnerability in `server.transformIndexHtml` via URL payload - https://github.com/advisories/GHSA-92r3-m2mg-pj97
Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem - https://github.com/advisories/GHSA-c24v-8rfc-w8vw
Vite's `server.fs.deny` did not deny requests for patterns with directories. - https://github.com/advisories/GHSA-8jhw-289h-jh2g
fix available via `npm audit fix`
node_modules/vite

4 vulnerabilities (2 moderate, 1 high, 1 critical)

To address all issues, run:
  npm audit fix

@msujew This addresses your review for #224.

github-actions[bot] commented 5 months ago

PR Preview Action v1.4.6 :---: :rocket: Deployed preview to https://eclipse-langium.github.io/langium-previews/pr-previews/pr-225/ on branch previews at 2024-04-17 10:01 UTC