Vite dev server optionserver.fs.deny can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows.
Vite dev server optionserver.fs.deny did not deny requests for patterns with directories. An example of such a pattern is /foo/**/*.
Impact
Only apps setting a custom server.fs.deny that includes a pattern with directories, and explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
Patches
Fixed in vite@5.2.6, vite@5.1.7, vite@5.0.13, vite@4.5.3, vite@3.2.10, vite@2.9.18
Details
server.fs.deny uses picomatch with the config of { matchBase: true }. matchBase only matches the basename of the file, not the path due to a bug (https://github.com/micromatch/picomatch/issues/89). The vite config docs read like you should be able to set fs.deny to glob with picomatch. Vite also does not set { dot: true } and that causes dotfiles not to be denied unless they are explicitly defined.
Reproduction
Set fs.deny to ['**/.git/**'] and then curl for /.git/config.
with matchBase: true, you can get any file under .git/ (config, HEAD, etc).
with matchBase: false, you cannot get any file under .git/ (config, HEAD, etc).
Release Notes
vitejs/vite (vite)
### [`v5.0.13`](https://togithub.com/vitejs/vite/releases/tag/v5.0.13)
[Compare Source](https://togithub.com/vitejs/vite/compare/v5.0.12...v5.0.13)
Please refer to [CHANGELOG.md](https://togithub.com/vitejs/vite/blob/v5.0.13/packages/vite/CHANGELOG.md) for details.
### [`v5.0.12`](https://togithub.com/vitejs/vite/releases/tag/v5.0.12)
[Compare Source](https://togithub.com/vitejs/vite/compare/v5.0.11...v5.0.12)
Please refer to [CHANGELOG.md](https://togithub.com/vitejs/vite/blob/v5.0.12/packages/vite/CHANGELOG.md) for details.
### [`v5.0.11`](https://togithub.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small5011-2024-01-05-small)
[Compare Source](https://togithub.com/vitejs/vite/compare/v5.0.10...v5.0.11)
- fix: don't pretransform classic script links ([#15361](https://togithub.com/vitejs/vite/issues/15361)) ([19e3c9a](https://togithub.com/vitejs/vite/commit/19e3c9a)), closes [#15361](https://togithub.com/vitejs/vite/issues/15361)
- fix: inject `__vite__mapDeps` code before sourcemap file comment ([#15483](https://togithub.com/vitejs/vite/issues/15483)) ([d2aa096](https://togithub.com/vitejs/vite/commit/d2aa096)), closes [#15483](https://togithub.com/vitejs/vite/issues/15483)
- fix(assets): avoid splitting `,` inside base64 value of `srcset` attribute ([#15422](https://togithub.com/vitejs/vite/issues/15422)) ([8de7bd2](https://togithub.com/vitejs/vite/commit/8de7bd2)), closes [#15422](https://togithub.com/vitejs/vite/issues/15422)
- fix(html): handle offset magic-string slice error ([#15435](https://togithub.com/vitejs/vite/issues/15435)) ([5ea9edb](https://togithub.com/vitejs/vite/commit/5ea9edb)), closes [#15435](https://togithub.com/vitejs/vite/issues/15435)
- chore(deps): update dependency strip-literal to v2 ([#15475](https://togithub.com/vitejs/vite/issues/15475)) ([49d21fe](https://togithub.com/vitejs/vite/commit/49d21fe)), closes [#15475](https://togithub.com/vitejs/vite/issues/15475)
- chore(deps): update tj-actions/changed-files action to v41 ([#15476](https://togithub.com/vitejs/vite/issues/15476)) ([2a540ee](https://togithub.com/vitejs/vite/commit/2a540ee)), closes [#15476](https://togithub.com/vitejs/vite/issues/15476)
### [`v5.0.10`](https://togithub.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small5010-2023-12-15-small)
[Compare Source](https://togithub.com/vitejs/vite/compare/v5.0.9...v5.0.10)
- fix: omit protocol does not require pre-transform ([#15355](https://togithub.com/vitejs/vite/issues/15355)) ([d9ae1b2](https://togithub.com/vitejs/vite/commit/d9ae1b2)), closes [#15355](https://togithub.com/vitejs/vite/issues/15355)
- fix(build): use base64 for inline SVG if it contains both single and double quotes ([#15271](https://togithub.com/vitejs/vite/issues/15271)) ([1bbff16](https://togithub.com/vitejs/vite/commit/1bbff16)), closes [#15271](https://togithub.com/vitejs/vite/issues/15271)
### [`v5.0.9`](https://togithub.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small509-2023-12-14-small)
[Compare Source](https://togithub.com/vitejs/vite/compare/v5.0.8...v5.0.9)
- fix: htmlFallbackMiddleware for favicon ([#15301](https://togithub.com/vitejs/vite/issues/15301)) ([c902545](https://togithub.com/vitejs/vite/commit/c902545)), closes [#15301](https://togithub.com/vitejs/vite/issues/15301)
- fix: more stable hash calculation for depsOptimize ([#15337](https://togithub.com/vitejs/vite/issues/15337)) ([2b39fe6](https://togithub.com/vitejs/vite/commit/2b39fe6)), closes [#15337](https://togithub.com/vitejs/vite/issues/15337)
- fix(scanner): catch all external files for glob imports ([#15286](https://togithub.com/vitejs/vite/issues/15286)) ([129d0d0](https://togithub.com/vitejs/vite/commit/129d0d0)), closes [#15286](https://togithub.com/vitejs/vite/issues/15286)
- fix(server): avoid chokidar throttling on startup ([#15347](https://togithub.com/vitejs/vite/issues/15347)) ([56a5740](https://togithub.com/vitejs/vite/commit/56a5740)), closes [#15347](https://togithub.com/vitejs/vite/issues/15347)
- fix(worker): replace `import.meta` correctly for IIFE worker ([#15321](https://togithub.com/vitejs/vite/issues/15321)) ([08d093c](https://togithub.com/vitejs/vite/commit/08d093c)), closes [#15321](https://togithub.com/vitejs/vite/issues/15321)
- feat: log re-optimization reasons ([#15339](https://togithub.com/vitejs/vite/issues/15339)) ([b1a6c84](https://togithub.com/vitejs/vite/commit/b1a6c84)), closes [#15339](https://togithub.com/vitejs/vite/issues/15339)
- chore: temporary typo ([#15329](https://togithub.com/vitejs/vite/issues/15329)) ([7b71854](https://togithub.com/vitejs/vite/commit/7b71854)), closes [#15329](https://togithub.com/vitejs/vite/issues/15329)
- perf: avoid computing paths on each request ([#15318](https://togithub.com/vitejs/vite/issues/15318)) ([0506812](https://togithub.com/vitejs/vite/commit/0506812)), closes [#15318](https://togithub.com/vitejs/vite/issues/15318)
- perf: temporary hack to avoid fs checks for /[@react-refresh](https://togithub.com/react-refresh) ([#15299](https://togithub.com/vitejs/vite/issues/15299)) ([b1d6211](https://togithub.com/vitejs/vite/commit/b1d6211)), closes [#15299](https://togithub.com/vitejs/vite/issues/15299)
### [`v5.0.8`](https://togithub.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small508-2023-12-12-small)
[Compare Source](https://togithub.com/vitejs/vite/compare/v5.0.7...v5.0.8)
- perf: cached fs utils ([#15279](https://togithub.com/vitejs/vite/issues/15279)) ([c9b61c4](https://togithub.com/vitejs/vite/commit/c9b61c4)), closes [#15279](https://togithub.com/vitejs/vite/issues/15279)
- fix: missing warmupRequest in transformIndexHtml ([#15303](https://togithub.com/vitejs/vite/issues/15303)) ([103820f](https://togithub.com/vitejs/vite/commit/103820f)), closes [#15303](https://togithub.com/vitejs/vite/issues/15303)
- fix: public files map will be updated on add/unlink in windows ([#15317](https://togithub.com/vitejs/vite/issues/15317)) ([921ca41](https://togithub.com/vitejs/vite/commit/921ca41)), closes [#15317](https://togithub.com/vitejs/vite/issues/15317)
- fix(build): decode urls in CSS files (fix [#15109](https://togithub.com/vitejs/vite/issues/15109)) ([#15246](https://togithub.com/vitejs/vite/issues/15246)) ([ea6a7a6](https://togithub.com/vitejs/vite/commit/ea6a7a6)), closes [#15109](https://togithub.com/vitejs/vite/issues/15109) [#15246](https://togithub.com/vitejs/vite/issues/15246)
- fix(deps): update all non-major dependencies ([#15304](https://togithub.com/vitejs/vite/issues/15304)) ([bb07f60](https://togithub.com/vitejs/vite/commit/bb07f60)), closes [#15304](https://togithub.com/vitejs/vite/issues/15304)
- fix(ssr): check esm file with normal file path ([#15307](https://togithub.com/vitejs/vite/issues/15307)) ([1597170](https://togithub.com/vitejs/vite/commit/1597170)), closes [#15307](https://togithub.com/vitejs/vite/issues/15307)
### [`v5.0.7`](https://togithub.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small507-2023-12-08-small)
[Compare Source](https://togithub.com/vitejs/vite/compare/v5.0.6...v5.0.7)
- fix: suppress terser warning if minify disabled ([#15275](https://togithub.com/vitejs/vite/issues/15275)) ([3e42611](https://togithub.com/vitejs/vite/commit/3e42611)), closes [#15275](https://togithub.com/vitejs/vite/issues/15275)
- fix: symbolic links in public dir ([#15264](https://togithub.com/vitejs/vite/issues/15264)) ([ef2a024](https://togithub.com/vitejs/vite/commit/ef2a024)), closes [#15264](https://togithub.com/vitejs/vite/issues/15264)
- fix(html): skip inlining icon and manifest links ([#14958](https://togithub.com/vitejs/vite/issues/14958)) ([8ad81b4](https://togithub.com/vitejs/vite/commit/8ad81b4)), closes [#14958](https://togithub.com/vitejs/vite/issues/14958)
- chore: remove unneeded condition in getRealPath ([#15267](https://togithub.com/vitejs/vite/issues/15267)) ([8e4655c](https://togithub.com/vitejs/vite/commit/8e4655c)), closes [#15267](https://togithub.com/vitejs/vite/issues/15267)
- perf: cache empty optimizer result ([#15245](https://togithub.com/vitejs/vite/issues/15245)) ([8409b66](https://togithub.com/vitejs/vite/commit/8409b66)), closes [#15245](https://togithub.com/vitejs/vite/issues/15245)
### [`v5.0.6`](https://togithub.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small506-2023-12-06-small)
[Compare Source](https://togithub.com/vitejs/vite/compare/v5.0.5...v5.0.6)
- perf: in-memory public files check ([#15195](https://togithub.com/vitejs/vite/issues/15195)) ([0f9e1bf](https://togithub.com/vitejs/vite/commit/0f9e1bf)), closes [#15195](https://togithub.com/vitejs/vite/issues/15195)
- chore: remove unneccessary eslint-disable-next-line regexp/no-unused-capturing-group ([#15247](https://togithub.com/vitejs/vite/issues/15247)) ([35a5bcf](https://togithub.com/vitejs/vite/commit/35a5bcf)), closes [#15247](https://togithub.com/vitejs/vite/issues/15247)
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
[ ] If you want to rebase/retry this PR, check this box
This PR has been generated by Mend Renovate. View repository job log here.
This PR contains the following updates:
5.0.5
->5.0.13
GitHub Vulnerability Alerts
CVE-2024-23331
Summary
Vite dev server option
server.fs.deny
can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows.This bypass is similar to https://nvd.nist.gov/vuln/detail/CVE-2023-34092 -- with surface area reduced to hosts having case-insensitive filesystems.
Patches
Fixed in vite@5.0.12, vite@4.5.2, vite@3.2.8, vite@2.9.17
Details
Since
picomatch
defaults to case-sensitive glob matching, but the file server doesn't discriminate; a blacklist bypass is possible.See
picomatch
usage, wherenocase
is defaulted tofalse
: https://github.com/vitejs/vite/blob/v5.1.0-beta.1/packages/vite/src/node/server/index.ts#L632By requesting raw filesystem paths using augmented casing, the matcher derived from
config.server.fs.deny
fails to block access to sensitive files.PoC
Setup
npm create vite@latest
on a Standard Azure hosted Windows 10 instance.npm run dev -- --host 0.0.0.0
custom.secret
andproduction.pem
vite.config.js
withReproduction
curl -s http://20.12.242.81:5173/@​fs//
curl -s http://20.12.242.81:5173/@​fs/C:/Users/darbonzo/Desktop/vite-project/vite.config.js
curl -s http://20.12.242.81:5173/@​fs/C:/Users/darbonzo/Desktop/vite-project/custom.sEcReT
Proof![Screenshot 2024-01-19 022736](https://user-images.githubusercontent.com/907968/298020728-3a8d3c06-fcfd-4009-9182-e842f66a6ea5.png)
Impact
Who
What
server.fs.deny
are both discoverable, and accessibleCVE-2024-31207
Summary
Vite dev server option
server.fs.deny
did not deny requests for patterns with directories. An example of such a pattern is/foo/**/*
.Impact
Only apps setting a custom
server.fs.deny
that includes a pattern with directories, and explicitly exposing the Vite dev server to the network (using--host
orserver.host
config option) are affected.Patches
Fixed in vite@5.2.6, vite@5.1.7, vite@5.0.13, vite@4.5.3, vite@3.2.10, vite@2.9.18
Details
server.fs.deny
uses picomatch with the config of{ matchBase: true }
. matchBase only matches the basename of the file, not the path due to a bug (https://github.com/micromatch/picomatch/issues/89). The vite config docs read like you should be able to set fs.deny to glob with picomatch. Vite also does not set{ dot: true }
and that causes dotfiles not to be denied unless they are explicitly defined.Reproduction
Set fs.deny to
['**/.git/**']
and then curl for/.git/config
.matchBase: true
, you can get any file under.git/
(config, HEAD, etc).matchBase: false
, you cannot get any file under.git/
(config, HEAD, etc).Release Notes
vitejs/vite (vite)
### [`v5.0.13`](https://togithub.com/vitejs/vite/releases/tag/v5.0.13) [Compare Source](https://togithub.com/vitejs/vite/compare/v5.0.12...v5.0.13) Please refer to [CHANGELOG.md](https://togithub.com/vitejs/vite/blob/v5.0.13/packages/vite/CHANGELOG.md) for details. ### [`v5.0.12`](https://togithub.com/vitejs/vite/releases/tag/v5.0.12) [Compare Source](https://togithub.com/vitejs/vite/compare/v5.0.11...v5.0.12) Please refer to [CHANGELOG.md](https://togithub.com/vitejs/vite/blob/v5.0.12/packages/vite/CHANGELOG.md) for details. ### [`v5.0.11`](https://togithub.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small5011-2024-01-05-small) [Compare Source](https://togithub.com/vitejs/vite/compare/v5.0.10...v5.0.11) - fix: don't pretransform classic script links ([#15361](https://togithub.com/vitejs/vite/issues/15361)) ([19e3c9a](https://togithub.com/vitejs/vite/commit/19e3c9a)), closes [#15361](https://togithub.com/vitejs/vite/issues/15361) - fix: inject `__vite__mapDeps` code before sourcemap file comment ([#15483](https://togithub.com/vitejs/vite/issues/15483)) ([d2aa096](https://togithub.com/vitejs/vite/commit/d2aa096)), closes [#15483](https://togithub.com/vitejs/vite/issues/15483) - fix(assets): avoid splitting `,` inside base64 value of `srcset` attribute ([#15422](https://togithub.com/vitejs/vite/issues/15422)) ([8de7bd2](https://togithub.com/vitejs/vite/commit/8de7bd2)), closes [#15422](https://togithub.com/vitejs/vite/issues/15422) - fix(html): handle offset magic-string slice error ([#15435](https://togithub.com/vitejs/vite/issues/15435)) ([5ea9edb](https://togithub.com/vitejs/vite/commit/5ea9edb)), closes [#15435](https://togithub.com/vitejs/vite/issues/15435) - chore(deps): update dependency strip-literal to v2 ([#15475](https://togithub.com/vitejs/vite/issues/15475)) ([49d21fe](https://togithub.com/vitejs/vite/commit/49d21fe)), closes [#15475](https://togithub.com/vitejs/vite/issues/15475) - chore(deps): update tj-actions/changed-files action to v41 ([#15476](https://togithub.com/vitejs/vite/issues/15476)) ([2a540ee](https://togithub.com/vitejs/vite/commit/2a540ee)), closes [#15476](https://togithub.com/vitejs/vite/issues/15476) ### [`v5.0.10`](https://togithub.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small5010-2023-12-15-small) [Compare Source](https://togithub.com/vitejs/vite/compare/v5.0.9...v5.0.10) - fix: omit protocol does not require pre-transform ([#15355](https://togithub.com/vitejs/vite/issues/15355)) ([d9ae1b2](https://togithub.com/vitejs/vite/commit/d9ae1b2)), closes [#15355](https://togithub.com/vitejs/vite/issues/15355) - fix(build): use base64 for inline SVG if it contains both single and double quotes ([#15271](https://togithub.com/vitejs/vite/issues/15271)) ([1bbff16](https://togithub.com/vitejs/vite/commit/1bbff16)), closes [#15271](https://togithub.com/vitejs/vite/issues/15271) ### [`v5.0.9`](https://togithub.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small509-2023-12-14-small) [Compare Source](https://togithub.com/vitejs/vite/compare/v5.0.8...v5.0.9) - fix: htmlFallbackMiddleware for favicon ([#15301](https://togithub.com/vitejs/vite/issues/15301)) ([c902545](https://togithub.com/vitejs/vite/commit/c902545)), closes [#15301](https://togithub.com/vitejs/vite/issues/15301) - fix: more stable hash calculation for depsOptimize ([#15337](https://togithub.com/vitejs/vite/issues/15337)) ([2b39fe6](https://togithub.com/vitejs/vite/commit/2b39fe6)), closes [#15337](https://togithub.com/vitejs/vite/issues/15337) - fix(scanner): catch all external files for glob imports ([#15286](https://togithub.com/vitejs/vite/issues/15286)) ([129d0d0](https://togithub.com/vitejs/vite/commit/129d0d0)), closes [#15286](https://togithub.com/vitejs/vite/issues/15286) - fix(server): avoid chokidar throttling on startup ([#15347](https://togithub.com/vitejs/vite/issues/15347)) ([56a5740](https://togithub.com/vitejs/vite/commit/56a5740)), closes [#15347](https://togithub.com/vitejs/vite/issues/15347) - fix(worker): replace `import.meta` correctly for IIFE worker ([#15321](https://togithub.com/vitejs/vite/issues/15321)) ([08d093c](https://togithub.com/vitejs/vite/commit/08d093c)), closes [#15321](https://togithub.com/vitejs/vite/issues/15321) - feat: log re-optimization reasons ([#15339](https://togithub.com/vitejs/vite/issues/15339)) ([b1a6c84](https://togithub.com/vitejs/vite/commit/b1a6c84)), closes [#15339](https://togithub.com/vitejs/vite/issues/15339) - chore: temporary typo ([#15329](https://togithub.com/vitejs/vite/issues/15329)) ([7b71854](https://togithub.com/vitejs/vite/commit/7b71854)), closes [#15329](https://togithub.com/vitejs/vite/issues/15329) - perf: avoid computing paths on each request ([#15318](https://togithub.com/vitejs/vite/issues/15318)) ([0506812](https://togithub.com/vitejs/vite/commit/0506812)), closes [#15318](https://togithub.com/vitejs/vite/issues/15318) - perf: temporary hack to avoid fs checks for /[@react-refresh](https://togithub.com/react-refresh) ([#15299](https://togithub.com/vitejs/vite/issues/15299)) ([b1d6211](https://togithub.com/vitejs/vite/commit/b1d6211)), closes [#15299](https://togithub.com/vitejs/vite/issues/15299) ### [`v5.0.8`](https://togithub.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small508-2023-12-12-small) [Compare Source](https://togithub.com/vitejs/vite/compare/v5.0.7...v5.0.8) - perf: cached fs utils ([#15279](https://togithub.com/vitejs/vite/issues/15279)) ([c9b61c4](https://togithub.com/vitejs/vite/commit/c9b61c4)), closes [#15279](https://togithub.com/vitejs/vite/issues/15279) - fix: missing warmupRequest in transformIndexHtml ([#15303](https://togithub.com/vitejs/vite/issues/15303)) ([103820f](https://togithub.com/vitejs/vite/commit/103820f)), closes [#15303](https://togithub.com/vitejs/vite/issues/15303) - fix: public files map will be updated on add/unlink in windows ([#15317](https://togithub.com/vitejs/vite/issues/15317)) ([921ca41](https://togithub.com/vitejs/vite/commit/921ca41)), closes [#15317](https://togithub.com/vitejs/vite/issues/15317) - fix(build): decode urls in CSS files (fix [#15109](https://togithub.com/vitejs/vite/issues/15109)) ([#15246](https://togithub.com/vitejs/vite/issues/15246)) ([ea6a7a6](https://togithub.com/vitejs/vite/commit/ea6a7a6)), closes [#15109](https://togithub.com/vitejs/vite/issues/15109) [#15246](https://togithub.com/vitejs/vite/issues/15246) - fix(deps): update all non-major dependencies ([#15304](https://togithub.com/vitejs/vite/issues/15304)) ([bb07f60](https://togithub.com/vitejs/vite/commit/bb07f60)), closes [#15304](https://togithub.com/vitejs/vite/issues/15304) - fix(ssr): check esm file with normal file path ([#15307](https://togithub.com/vitejs/vite/issues/15307)) ([1597170](https://togithub.com/vitejs/vite/commit/1597170)), closes [#15307](https://togithub.com/vitejs/vite/issues/15307) ### [`v5.0.7`](https://togithub.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small507-2023-12-08-small) [Compare Source](https://togithub.com/vitejs/vite/compare/v5.0.6...v5.0.7) - fix: suppress terser warning if minify disabled ([#15275](https://togithub.com/vitejs/vite/issues/15275)) ([3e42611](https://togithub.com/vitejs/vite/commit/3e42611)), closes [#15275](https://togithub.com/vitejs/vite/issues/15275) - fix: symbolic links in public dir ([#15264](https://togithub.com/vitejs/vite/issues/15264)) ([ef2a024](https://togithub.com/vitejs/vite/commit/ef2a024)), closes [#15264](https://togithub.com/vitejs/vite/issues/15264) - fix(html): skip inlining icon and manifest links ([#14958](https://togithub.com/vitejs/vite/issues/14958)) ([8ad81b4](https://togithub.com/vitejs/vite/commit/8ad81b4)), closes [#14958](https://togithub.com/vitejs/vite/issues/14958) - chore: remove unneeded condition in getRealPath ([#15267](https://togithub.com/vitejs/vite/issues/15267)) ([8e4655c](https://togithub.com/vitejs/vite/commit/8e4655c)), closes [#15267](https://togithub.com/vitejs/vite/issues/15267) - perf: cache empty optimizer result ([#15245](https://togithub.com/vitejs/vite/issues/15245)) ([8409b66](https://togithub.com/vitejs/vite/commit/8409b66)), closes [#15245](https://togithub.com/vitejs/vite/issues/15245) ### [`v5.0.6`](https://togithub.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small506-2023-12-06-small) [Compare Source](https://togithub.com/vitejs/vite/compare/v5.0.5...v5.0.6) - perf: in-memory public files check ([#15195](https://togithub.com/vitejs/vite/issues/15195)) ([0f9e1bf](https://togithub.com/vitejs/vite/commit/0f9e1bf)), closes [#15195](https://togithub.com/vitejs/vite/issues/15195) - chore: remove unneccessary eslint-disable-next-line regexp/no-unused-capturing-group ([#15247](https://togithub.com/vitejs/vite/issues/15247)) ([35a5bcf](https://togithub.com/vitejs/vite/commit/35a5bcf)), closes [#15247](https://togithub.com/vitejs/vite/issues/15247)Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.