chore(deps-dev): bump vite from 7.3.1 to 7.3.2 in the npm_and_yarn group across 1 directory

[dependabot]

Bumps the npm_and_yarn group with 1 update in the / directory: vite.

Updates vite from 7.3.1 to 7.3.2

Release notes

Sourced from vite's releases.

v7.3.2

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

7.3.2 (2026-04-06)

Bug Fixes

• avoid path traversal with optimize deps sourcemap handler (#22161) (09d8c90)
• backport #22159, apply server.fs check to env transport (#22162) (19db0f2)
• check server.fs after stripping query as well (#22160) (f8103cc)

Commits

• cc383e0 release: v7.3.2
• 09d8c90 fix: avoid path traversal with optimize deps sourcemap handler (#22161)
• f8103cc fix: check server.fs after stripping query as well (#22160)
• 19db0f2 fix: backport #22159, apply server.fs check to env transport (#22162)
• See full diff in compare view

[mrangelmarino]

/review

Auto-triggered after E2E tests passed.

[claude]

Code Review

Dependabot patch bump: vite 7.3.1 → 7.3.2.

This is a security patch release. The changelog includes three fixes:

• Path traversal fix in the optimize deps sourcemap handler (#22161)
• server.fs bypass fix via env transport (#22162)
• server.fs check applied after query stripping (#22160)

The first two are security-relevant — they close potential file-system access bypasses in Vite's dev server. While these primarily affect development (not production builds), merging promptly is still the right call.

Electron security checklist: No privilege-boundary files touched — this is a dev dependency update only. All checklist items N/A.

Verdict: Clean patch, no concerns. Merge.

[github-actions]

✅ Ready to Merge

Code review found no significant issues. This PR is ready for human approval and merge.

[mrangelmarino]

/review

Auto-triggered after E2E tests passed.

[claude]

Code Review

Dependabot security patch: vite 7.3.1 → 7.3.2

This PR bumps vite from 7.3.1 to 7.3.2. The changelog reveals this is a security patch addressing path traversal and filesystem boundary bypass vulnerabilities in the dev server:

• #22161 — Path traversal via optimize deps sourcemap handler
• #22160 — server.fs check bypassed when query strings are present
• #22162 — server.fs check not applied to env transport

These are dev-server-only vulnerabilities (not production runtime), but they could allow an attacker to read arbitrary files outside the project root during development if a malicious file or dependency triggers the affected code paths. Merging promptly is the right call.

Electron security checklist: No privilege-boundary files touched — this is a devDependency update only. No IPC, preload, or main process changes. Checklist items are N/A.

Verdict: Clean patch, correct lockfile update, no unrelated changes. Merge immediately.

[github-actions]

✅ Ready to Merge

Code review found no significant issues. This PR is ready for human approval and merge.