Vite 6.3.0 introduces subtle but potentially impactful changes compared to its predecessor, version 6.2.7. For developers, the key differences lie primarily in the updated dependencies. The newer version incorporates fdir as a new direct dependency, indicating potential improvements or additions to file system handling within Vite. Several dependency updates appear in the devDependencies section. Most notably, @babel/parser moves from version 7.26.9 to 7.26.10, and @rollup/plugin-node-resolve goes from 16.0.0 to 16.0.1. Other notable changes include rollup moving from version 4.30.1 to 4.34.9 and lightningcss moving from version 1.29.2 to 1.29.3 , these indicate bug fixes or new features in those tools. These upgrades likely entail performance enhancements, bug fixes, or new features within Vite's internal build processes. The version bump for nanoid from 5.1.3 to 5.1.4 might address security vulnerabilities or improve unique ID generation. These adjustments collectively enhance Vite's capabilities in areas such as module resolution, code parsing, and overall build optimization. Developers should review the changelogs of these updated dependencies for specific details regarding introduced features or resolved issues. It's worth noting that file count and unpacked size were reduced compared to the previous stable version (35 to 35 and 2854442 to 2649331) maybe indicating optimization in the source code.
All the vulnerabilities related to the version 6.3.0 of the package
Vite's server.fs.deny bypassed with /. for files under project root
The contents of files in the project root that are denied by a file matching pattern can be returned to the browser.
Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
Only files that are under project root and are denied by a file matching pattern can be bypassed.
.env, .env.*, *.{crt,pem}, **/.env**/.git/**, .git/**, .git/**/*server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns).
These patterns were able to bypass for files under root by using a combination of slash and dot (/.).
npm create vite@latest
cd vite-project/
cat "secret" > .env
npm install
npm run dev
curl --request-target /.env/. http://localhost:5173