security: Upgrade Vite (#517)

elliott-with-the-longest-name-on-github · web-flow · commit 1901433d41d3 · 2025-03-31T11:48:07.000-06:00
* security: Upgrade Vite

* fix lockfile

* changeset

* fix: Breaking change from acorn-typescript
diff --git a/.changeset/chilly-bobcats-appear.md b/.changeset/chilly-bobcats-appear.md
@@ -0,0 +1,5 @@
+---
+'sv': patch
+---
+
+security: Upgrade Vite to avoid CVE-2025-31125
diff --git a/packages/ast-tooling/index.ts b/packages/ast-tooling/index.ts
@@ -61,7 +61,7 @@ export type {
 export function parseScript(content: string): TsEstree.Program {
 	const comments: TsEstree.Comment[] = [];
 
-	const acornTs = acorn.Parser.extend(tsPlugin({ allowSatisfies: true }));
+	const acornTs = acorn.Parser.extend(tsPlugin());
 
 	// Acorn doesn't add comments to the AST by itself. This factory returns the capabilities to add them after the fact.
 	const ast = acornTs.parse(content, {
diff --git a/packages/create/templates/demo/package.json b/packages/create/templates/demo/package.json
@@ -16,6 +16,6 @@
 		"@sveltejs/vite-plugin-svelte": "^5.0.0",
 		"svelte": "^5.25.0",
 		"typescript": "^5.3.3",
-		"vite": "^6.0.0"
+		"vite": "^6.2.4"
 	}
 }
diff --git a/packages/create/templates/demo/package.template.json b/packages/create/templates/demo/package.template.json
@@ -16,6 +16,6 @@
 		"@sveltejs/kit": "^2.16.0",
 		"@sveltejs/vite-plugin-svelte": "^5.0.0",
 		"svelte": "^5.25.0",
-		"vite": "^6.0.0"
+		"vite": "^6.2.4"
 	}
 }
diff --git a/packages/create/templates/library/package.template.json b/packages/create/templates/library/package.template.json
@@ -30,7 +30,7 @@
 		"publint": "^0.3.2",
 		"svelte": "^5.0.0",
 		"typescript": "^5.3.2",
-		"vite": "^6.0.0"
+		"vite": "^6.2.4"
 	},
 	"keywords": ["svelte"]
 }
diff --git a/packages/create/templates/minimal/package.template.json b/packages/create/templates/minimal/package.template.json
@@ -14,6 +14,6 @@
 		"@sveltejs/kit": "^2.16.0",
 		"@sveltejs/vite-plugin-svelte": "^5.0.0",
 		"svelte": "^5.0.0",
-		"vite": "^6.0.0"
+		"vite": "^6.2.4"
 	}
 }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml

-Original file line number
+Diff line change
@@ @@ -0,0 +1,5 @@ @@
 +---
 +'sv': patch
 +---
++
 +security: Upgrade Vite to avoid CVE-2025-31125
Original file line number	Diff line number	Diff line change
`@@ -16,6 +16,6 @@`
`16`	`16`	`"@sveltejs/vite-plugin-svelte": "^5.0.0",`
`17`	`17`	`"svelte": "^5.25.0",`
`18`	`18`	`"typescript": "^5.3.3",`
`19`		`- "vite": "^6.0.0"`
	`19`	`+ "vite": "^6.2.4"`
`20`	`20`	`}`
`21`	`21`	`}`
Original file line number	Diff line number	Diff line change
`@@ -30,7 +30,7 @@`
`30`	`30`	`"publint": "^0.3.2",`
`31`	`31`	`"svelte": "^5.0.0",`
`32`	`32`	`"typescript": "^5.3.2",`
`33`		`- "vite": "^6.0.0"`
	`33`	`+ "vite": "^6.2.4"`
`34`	`34`	`},`
`35`	`35`	`"keywords": ["svelte"]`
`36`	`36`	`}`
Original file line number	Diff line number	Diff line change
`@@ -14,6 +14,6 @@`
`14`	`14`	`"@sveltejs/kit": "^2.16.0",`
`15`	`15`	`"@sveltejs/vite-plugin-svelte": "^5.0.0",`
`16`	`16`	`"svelte": "^5.0.0",`
`17`		`- "vite": "^6.0.0"`
	`17`	`+ "vite": "^6.2.4"`
`18`	`18`	`}`
`19`	`19`	`}`