chore(deps): update dependency vite to v5.4.21 [security] (release-3.4.x)

[renovate-sh-app]

This PR contains the following updates:

Package	Change	Age	Confidence
vite (source)	5.4.20 -> 5.4.21

---

vite allows server.fs.deny bypass via backslash on Windows

CVE-2025-62522 / GHSA-93m4-6634-74q7

More information

Details

Summary

Files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows.

Impact

Only apps that match the following conditions are affected:

• explicitly exposes the Vite dev server to the network (using --host or server.host config option)
• running the dev server on Windows

Details

server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass by using a back slash(\). The root cause is that fs.readFile('/foo.png/') loads /foo.png.

PoC

npm create vite@latest
cd vite-project/
cat "secret" > .env
npm install
npm run dev
curl --request-target /.env\ http://localhost:5173

Severity

• CVSS Score: 6.0 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/vitejs/vite/security/advisories/GHSA-93m4-6634-74q7
• https://nvd.nist.gov/vuln/detail/CVE-2025-62522
• https://github.com/vitejs/vite/commit/f479cc57c425ed41ceb434fecebd63931b1ed4ed
• https://github.com/vitejs/vite

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

vitejs/vite (vite)

v5.4.21

Compare Source

Please refer to CHANGELOG.md for details.

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.

[github-actions]

😢 zizmor failed with exit code 14.

Expand for full output

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
  --> ./.github/workflows/images.yml:44:7
   |
44 |       "uses": "actions/setup-node@v4"
   |       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
...
86 |       "uses": "docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1"
   |       --------------------------------------------------------------------------- runtime artifacts usually published here
   |
   = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
   --> ./.github/workflows/images.yml:141:7
    |
141 |       "uses": "actions/setup-node@v4"
    |       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
...
166 |       "uses": "docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1"
    |       --------------------------------------------------------------------------- runtime artifacts usually published here
    |
    = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
   --> ./.github/workflows/images.yml:264:7
    |
264 |       "uses": "actions/setup-node@v4"
    |       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
...
289 |       "uses": "docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1"
    |       --------------------------------------------------------------------------- runtime artifacts usually published here
    |
    = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
   --> ./.github/workflows/images.yml:387:7
    |
387 |       "uses": "actions/setup-node@v4"
    |       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
...
412 |       "uses": "docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1"
    |       --------------------------------------------------------------------------- runtime artifacts usually published here
    |
    = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
   --> ./.github/workflows/images.yml:510:7
    |
510 |       "uses": "actions/setup-node@v4"
    |       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
...
535 |       "uses": "docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1"
    |       --------------------------------------------------------------------------- runtime artifacts usually published here
    |
    = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
   --> ./.github/workflows/minor-release-pr.yml:220:7
    |
220 |       uses: "actions/setup-node@v4"
    |       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
...
248 |       uses: "docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1"
    |       ------------------------------------------------------------------------- runtime artifacts usually published here
    |
    = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
   --> ./.github/workflows/minor-release-pr.yml:293:7
    |
293 |       uses: "actions/setup-node@v4"
    |       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
...
321 |       uses: "docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1"
    |       ------------------------------------------------------------------------- runtime artifacts usually published here
    |
    = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
   --> ./.github/workflows/minor-release-pr.yml:366:7
    |
366 |       uses: "actions/setup-node@v4"
    |       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
...
394 |       uses: "docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1"
    |       ------------------------------------------------------------------------- runtime artifacts usually published here
    |
    = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
   --> ./.github/workflows/minor-release-pr.yml:445:7
    |
445 |       uses: "actions/setup-node@v4"
    |       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
...
473 |       uses: "docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1"
    |       ------------------------------------------------------------------------- runtime artifacts usually published here
    |
    = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
   --> ./.github/workflows/minor-release-pr.yml:518:7
    |
518 |       uses: "actions/setup-node@v4"
    |       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
...
546 |       uses: "docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1"
    |       ------------------------------------------------------------------------- runtime artifacts usually published here
    |
    = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
   --> ./.github/workflows/minor-release-pr.yml:597:7
    |
597 |       uses: "actions/setup-node@v4"
    |       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
...
625 |       uses: "docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1"
    |       ------------------------------------------------------------------------- runtime artifacts usually published here
    |
    = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
   --> ./.github/workflows/minor-release-pr.yml:676:7
    |
676 |       uses: "actions/setup-node@v4"
    |       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
...
704 |       uses: "docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1"
    |       ------------------------------------------------------------------------- runtime artifacts usually published here
    |
    = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
   --> ./.github/workflows/minor-release-pr.yml:848:7
    |
848 |       uses: "actions/setup-node@v4"
    |       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
...
876 |       uses: "docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1"
    |       ------------------------------------------------------------------------- runtime artifacts usually published here
    |
    = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
   --> ./.github/workflows/minor-release-pr.yml:927:7
    |
927 |       uses: "actions/setup-node@v4"
    |       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
...
955 |       uses: "docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1"
    |       ------------------------------------------------------------------------- runtime artifacts usually published here
    |
    = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
    --> ./.github/workflows/patch-release-pr.yml:62:7
     |
  62 |         uses: "actions/setup-node@v4"
     |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
...
1093 | / "on":
1094 | |   push:
1095 | |     branches:
1096 | |     - "release-[0-9]+.[0-9]+.x"
     | |_______________________________- generally used when publishing artifacts generated at runtime
     |
     = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
    --> ./.github/workflows/patch-release-pr.yml:220:7
     |
 220 |         uses: "actions/setup-node@v4"
     |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
...
1093 | / "on":
1094 | |   push:
1095 | |     branches:
1096 | |     - "release-[0-9]+.[0-9]+.x"
     | |_______________________________- generally used when publishing artifacts generated at runtime
     |
     = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
    --> ./.github/workflows/patch-release-pr.yml:293:7
     |
 293 |         uses: "actions/setup-node@v4"
     |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
...
1093 | / "on":
1094 | |   push:
1095 | |     branches:
1096 | |     - "release-[0-9]+.[0-9]+.x"
     | |_______________________________- generally used when publishing artifacts generated at runtime
     |
     = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
    --> ./.github/workflows/patch-release-pr.yml:366:7
     |
 366 |         uses: "actions/setup-node@v4"
     |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
...
1093 | / "on":
1094 | |   push:
1095 | |     branches:
1096 | |     - "release-[0-9]+.[0-9]+.x"
     | |_______________________________- generally used when publishing artifacts generated at runtime
     |
     = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
    --> ./.github/workflows/patch-release-pr.yml:445:7
     |
 445 |         uses: "actions/setup-node@v4"
     |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
...
1093 | / "on":
1094 | |   push:
1095 | |     branches:
1096 | |     - "release-[0-9]+.[0-9]+.x"
     | |_______________________________- generally used when publishing artifacts generated at runtime
     |
     = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
    --> ./.github/workflows/patch-release-pr.yml:518:7
     |
 518 |         uses: "actions/setup-node@v4"
     |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
...
1093 | / "on":
1094 | |   push:
1095 | |     branches:
1096 | |     - "release-[0-9]+.[0-9]+.x"
     | |_______________________________- generally used when publishing artifacts generated at runtime
     |
     = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
    --> ./.github/workflows/patch-release-pr.yml:597:7
     |
 597 |         uses: "actions/setup-node@v4"
     |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
...
1093 | / "on":
1094 | |   push:
1095 | |     branches:
1096 | |     - "release-[0-9]+.[0-9]+.x"
     | |_______________________________- generally used when publishing artifacts generated at runtime
     |
     = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
    --> ./.github/workflows/patch-release-pr.yml:676:7
     |
 676 |         uses: "actions/setup-node@v4"
     |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
...
1093 | / "on":
1094 | |   push:
1095 | |     branches:
1096 | |     - "release-[0-9]+.[0-9]+.x"
     | |_______________________________- generally used when publishing artifacts generated at runtime
     |
     = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
    --> ./.github/workflows/patch-release-pr.yml:753:7
     |
 753 |         uses: "actions/setup-node@v4"
     |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
...
1093 | / "on":
1094 | |   push:
1095 | |     branches:
1096 | |     - "release-[0-9]+.[0-9]+.x"
     | |_______________________________- generally used when publishing artifacts generated at runtime
     |
     = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
    --> ./.github/workflows/patch-release-pr.yml:848:7
     |
 848 |         uses: "actions/setup-node@v4"
     |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
...
1093 | / "on":
1094 | |   push:
1095 | |     branches:
1096 | |     - "release-[0-9]+.[0-9]+.x"
     | |_______________________________- generally used when publishing artifacts generated at runtime
     |
     = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
    --> ./.github/workflows/patch-release-pr.yml:927:7
     |
 927 |         uses: "actions/setup-node@v4"
     |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
...
1093 | / "on":
1094 | |   push:
1095 | |     branches:
1096 | |     - "release-[0-9]+.[0-9]+.x"
     | |_______________________________- generally used when publishing artifacts generated at runtime
     |
     = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
    --> ./.github/workflows/patch-release-pr.yml:1003:7
     |
1003 |         uses: "actions/setup-node@v4"
     |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
...
1093 | / "on":
1094 | |   push:
1095 | |     branches:
1096 | |     - "release-[0-9]+.[0-9]+.x"
     | |_______________________________- generally used when publishing artifacts generated at runtime
     |
     = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
   --> ./.github/workflows/release.yml:44:7
    |
 44 |         uses: "actions/setup-node@v4"
    |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
...
435 | / "on":
436 | |   push:
437 | |     branches:
438 | |     - "release-[0-9]+.[0-9]+.x"
439 | |     - "k[0-9]+"
440 | |     - "main"
    | |____________- generally used when publishing artifacts generated at runtime
    |
    = note: audit confidence → Low

334 findings (9 ignored, 298 suppressed): 0 informational, 0 low, 0 medium, 27 high