Skip to content

Commit caee1d5

Browse files
authored
fix(deps): bump vite to 7.3.5 in site/ (Dependabot #62 #63) (#1664)
* fix(deps): bump vite to 7.3.5 in site/ via npm overrides Adds overrides.vite=^7.3.5 to site/package.json to force resolution of the transitive vite dep from 7.3.2 to 7.3.5, fixing Dependabot alerts #62 and #63 (server.fs.deny bypass and NTLMv2 hash disclosure). Dependabot couldn't auto-update because @astrojs/tailwind@6.0.2 only declares peer dep support for astro@^3-5 (not v6), causing strict resolution to conflict when bumping vite past 7.3.2.
1 parent 83bde6a commit caee1d5

2 files changed

Lines changed: 6 additions & 3 deletions

File tree

site/package-lock.json

Lines changed: 3 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

site/package.json

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@
1717
"astro": "^6.4.6",
1818
"tailwindcss": "^3.4.18"
1919
},
20+
"overrides": {
21+
"vite": "^7.3.5"
22+
},
2023
"devDependencies": {
2124
"@astrojs/check": "^0.9.9",
2225
"@typescript-eslint/parser": "^8.61.0",

0 commit comments

Comments
 (0)