fix(deps): Vite 7.3.2 and yaml 2.8.3 (Dependabot #56–#59)#7
Merged
Conversation
- Override vite to ^7.3.2 (CVE-2026-39363–39365 / GHSA alerts #57–59) - Override yaml to ^2.8.3 (CVE-2026-33532 / GHSA-48c2-rrv3-qjmp #56) - Refresh package-lock.json; npm audit reports 0 vulnerabilities See documentation/pr-body-dependabot-vite-yaml.md for full advisory context.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR: Address Dependabot alerts — Vite (57–59) and yaml (56)
Summary
This PR targets four open Dependabot alerts on
patterns-in-leaves: three Vite issues (high/moderate, dev-server–focused) and one yaml stack-overflow issue (moderate, transitive). Resolution is expected to be dependency bumps / lockfile refresh (and optionallyoverridesif a parent package pins a vulnerable nestedyaml).Source data (CLI)
Full alert payloads were retrieved with the GitHub CLI:
Equivalent REST documentation: Get a dependabot alert.
Snapshot date: 2026-04-07 (fields such as
updated_aton advisories may change on GitHub’s side).Alert overview
yaml2.8.3(npm)vite7.3.2(npm)vite7.3.2(npm)vite7.3.2(npm)Manifest: all four are reported against
package-lock.json. Relationship: transitive (not directpackage.jsondependencies).API resources:
https://api.github.com/repos/keithSchumacher/patterns-in-leaves/dependabot/alerts/56https://api.github.com/repos/keithSchumacher/patterns-in-leaves/dependabot/alerts/57https://api.github.com/repos/keithSchumacher/patterns-in-leaves/dependabot/alerts/58https://api.github.com/repos/keithSchumacher/patterns-in-leaves/dependabot/alerts/59Alert #56 —
yaml: Stack overflow via deeply nested YAMLnpmpackageyaml, scope runtime, relationship transitive, manifestpackage-lock.json.CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L>= 2.0.0, < 2.8.32.8.3Advisory description (full)
Parsing a YAML document with
yamlmay throw aRangeErrordue to a stack overflow.The node resolution/composition phase uses recursive function calls without a depth bound. An attacker who can supply YAML for parsing can trigger a
RangeError: Maximum call stack size exceededwith a small payload (~2–10 KB). TheRangeErroris not aYAMLParseError, so applications that only catch YAML-specific errors will encounter an unexpected exception type. Depending on the host application's exception handling, this can fail requests or terminate the Node.js process.Flow sequences allow deep nesting with minimal bytes (2 bytes per level: one
[and one]). On the default Node.js stack, approximately 1,000–5,000 levels of nesting (2–10 KB input) exhaust the call stack. The exact threshold is environment-dependent (Node.js version, stack size, call stack depth at invocation).Note: the library's
Parser(CST phase) uses a stack-based iterative approach and is not affected. Only the compose/resolve phase uses actual call-stack recursion.All three public parsing APIs are affected:
YAML.parse(),YAML.parseDocument(), andYAML.parseAllDocuments().The advisory also documents a PoC, version table (fixed in 2.8.3 / 1.10.3), and NVD link: https://nvd.nist.gov/vuln/detail/CVE-2026-33532
References (from advisory)
Repo note (for the fix)
Top-level
package-lock.jsonmay already listyaml@2.8.3while a nested copy (e.g. underyaml-language-serveratyaml@2.7.1) remains in range< 2.8.3. Dependabot correctly flags the transitive instance. Fixing may requirenpm overridesforyamlor upgrading the parent chain once upstream publishes a compatible release.Alert #57 — Vite:
server.fs.denybypassed with queriesnpmpackagevite, scope runtime, relationship transitive, manifestpackage-lock.json.server.fs.denybypassed with queriesCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N>= 7.1.0, <= 7.3.17.3.2Advisory description (full)
Summary: The contents of files that are specified by
server.fs.denycan be returned to the browser.Impact: Only apps that match all of the following are affected:
--hostorserver.host)server.fs.allowserver.fs.denyDetails: On the Vite dev server, files that should be blocked by
server.fs.deny(e.g.,.env,*.crt) can be retrieved with HTTP 200 responses when query parameters such as?raw,?import&raw, or?import&url&inlineare appended.References (from advisory)
server.fsafter stripping query as well vitejs/vite#22160Alert #58 — Vite: Path traversal in optimized deps
.maphandlingnpmpackagevite, scope runtime, relationship transitive, manifestpackage-lock.json..mapHandlingCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N>= 7.0.0, <= 7.3.17.3.2Advisory description (full)
Summary: Any files ending with
.mapeven outside the project can be returned to the browser.Impact: Only apps that match both of the following are affected:
--hostorserver.host).mapand the path is predictableDetails: In Vite v7.3.1, the dev server’s handling of
.maprequests for optimized dependencies resolves file paths and callsreadFilewithout restricting../segments in the URL. As a result, it is possible to bypass theserver.fs.strictallow list and retrieve.mapfiles located outside the project root, provided they can be parsed as valid source map JSON.The advisory includes a PoC using a file under
/tmpand optimized-deps URL prefix manipulation.References (from advisory)
Alert #59 — Vite: Arbitrary file read via dev server WebSocket
npmpackagevite, scope runtime, relationship transitive, manifestpackage-lock.json.CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N>= 7.0.0, <= 7.3.17.3.2Advisory description (full)
Summary:
server.fscheck was not enforced on thefetchModulemethod that is exposed in the Vite dev server's WebSocket.Impact: Only apps that match both of the following are affected:
--hostorserver.host)server.ws: falseArbitrary files on the server (development machine, CI environment, container, etc.) can be exposed.
Details: If it is possible to connect to the Vite dev server’s WebSocket without an
Originheader, an attacker can invokefetchModulevia the custom WebSocket eventvite:invokeand combinefile://...with?raw(or?inline) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g.,export default "...").The access control enforced in the HTTP request path (such as
server.fs.allow) is not applied to this WebSocket-based execution path.The advisory includes a PoC contrasting blocked HTTP
/@fs/...access with successful WebSocket retrieval.References (from advisory)
Proposed remediation (for implementer)
vitetree picks up the patched release. At snapshot time the lockfile listedvite@7.3.1(vulnerable to all three).yamlin the lockfile is ≥ 2.8.3 (or ≥ 1.10.3 on the 1.x line). If a dependency still pins 2.7.x, useoverridesinpackage.jsonor wait for/upstream bump of the parent package.npm install,npm run build(andnpm auditif useful), then confirm Dependabot clears #56–#59 after the default scan.Risk / exposure note (static site)
This project builds static output; Vite’s dev server is primarily a local development concern. The advisory text still recommends treating dev-server exposure (
--host/ network binding) as the sensitive case. Production GitHub Pages serving does not run the Vite dev server.Checklist
vite/yamlper ranges abovenpm run buildpasses