Vite 6.3.1 is a minor update over version 6.3.0, both serving as native-ESM powered web development build tools. Examining the differences can inform developers about incremental improvements. Notably, within the dist object, vite-6.3.1 reports a slightly larger unpackedSize of 2649883 compared to 2649331 of vite-6.3.0 implying that the new version includes some improvements increasing a little bit the size. The releaseDate reveals that version 6.3.1 was released approximately 18 hours after version 6.3.0 showing an hotfix release which is more important that what it seems to be. While most dependencies and devDependencies remain consistent, this change is a prompt for developers to update.
Both versions list the same core dependencies: fdir, rollup, esbuild, postcss, picomatch, and tinyglobby. Similarly, the devDependencies and peerDependencies appear identical, indicating that the core development workflow and compatibility requirements haven't changed between the two versions. This consistency simplifies the upgrade process for developers as they don't need to worry about major breaking changes or compatibility issues with their existing toolchain. The peerDependencies like tsx, jiti, less, sass, yaml, stylus, terser, and @types/node versions are identical.
The versions share the same licensing (MIT), repository details, author, and funding information, reinforcing that this is a continuation of the same project under the same governance. The minor difference in unpacked size and the short time between releases suggest bug fixes, performance improvements, or very small feature enhancements which is probably the only reason to upgrade to last version.
All the vulnerabilities related to the version 6.3.1 of the package
Vite's server.fs.deny bypassed with /. for files under project root
The contents of files in the project root that are denied by a file matching pattern can be returned to the browser.
Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
Only files that are under project root and are denied by a file matching pattern can be bypassed.
.env, .env.*, *.{crt,pem}, **/.env**/.git/**, .git/**, .git/**/*server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns).
These patterns were able to bypass for files under root by using a combination of slash and dot (/.).
npm create vite@latest
cd vite-project/
cat "secret" > .env
npm install
npm run dev
curl --request-target /.env/. http://localhost:5173