chore(deps-dev): bump vite from 7.3.1 to 7.3.2 in /ui/litellm-dashboard

[dependabot]

Bumps vite from 7.3.1 to 7.3.2.

Release notes

Sourced from vite's releases.

v7.3.2

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

7.3.2 (2026-04-06)

Bug Fixes

• avoid path traversal with optimize deps sourcemap handler (#22161) (09d8c90)
• backport #22159, apply server.fs check to env transport (#22162) (19db0f2)
• check server.fs after stripping query as well (#22160) (f8103cc)

Commits

• cc383e0 release: v7.3.2
• 09d8c90 fix: avoid path traversal with optimize deps sourcemap handler (#22161)
• f8103cc fix: check server.fs after stripping query as well (#22160)
• 19db0f2 fix: backport #22159, apply server.fs check to env transport (#22162)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
litellm	Ready	Preview, Comment	Apr 6, 2026 10:15pm

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[greptile-apps]

Greptile Summary

This PR is an automated dependency bump of vite from 7.3.1 to 7.3.2 in the UI dashboard (ui/litellm-dashboard), patching three dev-server security vulnerabilities.

• Security fix: Path traversal vulnerability in the optimize deps sourcemap handler (#22161)
• Security fix: server.fs allowlist bypass via the env transport (#22162)
• Security fix: server.fs check now also applies after the query string is stripped (#22160)
• Minor package-lock.json normalization: several indirect dependencies (e.g. @jridgewell/*, @nodelib/*, tailwindcss and its transitive deps) had their "dev": true flag removed or changed to "devOptional": true as a result of npm's dependency graph recalculation — this is expected and does not affect production runtime behaviour

Confidence Score: 5/5

Safe to merge — automated security patch bump with no logic changes

Patch version bump only; all three fixes address dev-server security issues (path traversal, fs sandbox bypass) relevant when running vite dev. No API changes, no production runtime impact, no custom rule violations.

No files require special attention

Important Files Changed

Filename	Overview
ui/litellm-dashboard/package.json	Bumps vite devDependency from 7.3.1 to 7.3.2
ui/litellm-dashboard/package-lock.json	Lockfile updated with new resolved URL and integrity hash for vite 7.3.2; minor dev flag normalization for several indirect dependencies

Sequence Diagram

sequenceDiagram
    participant Dependabot
    participant PackageJson as package.json
    participant LockFile as package-lock.json
    participant NPM as npm Registry

    Dependabot->>PackageJson: Bump vite 7.3.1 → 7.3.2
    Dependabot->>LockFile: Update resolved URL & integrity hash
    NPM-->>LockFile: vite@7.3.2 (path-traversal fix, fs sandbox fixes)

Loading

_{Reviews (1): Last reviewed commit: "chore(deps-dev): bump vite from 7.3.1 to..." | Re-trigger Greptile}

[codspeed-hq]

Merging this PR will not alter performance

✅ 16 untouched benchmarks

---

_{Comparing dependabot/npm_and_yarn/ui/litellm-dashboard/vite-7.3.2 (8f5a75b) with main (39c1042)}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[dependabot]

Looks like vite is up-to-date now, so this is no longer needed.