chore(deps): update dependency vite to v6.2.5 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
vite (source)	6.2.4 -> 6.2.5

GitHub Vulnerability Alerts

CVE-2025-31486

Summary

The contents of arbitrary files can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected..

Details

.svg

Requests ending with .svg are loaded at this line.
https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290
By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the restriction was able to bypass.

This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+.

relative paths

The check was applied before the id normalization. This allowed requests to bypass with relative paths (e.g. ../../).

PoC

npm create vite@latest
cd vite-project/
npm install
npm run dev

send request to read etc/passwd

curl 'http://127.0.0.1:5173/etc/passwd?.svg?.wasm?init'

curl 'http://127.0.0.1:5173/@​fs/x/x/x/vite-project/?/../../../../../etc/passwd?import&?raw'

---

Release Notes

vitejs/vite (vite)

v6.2.5

Compare Source

Please refer to CHANGELOG.md for details.

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cloudflare-workers-and-pages]

Deploying unplugin-vue-router with    Cloudflare Pages

Latest commit:	de91409
Status:	✅  Deploy successful!
Preview URL:	https://a2350c66.unplugin-vue-router.pages.dev
Branch Preview URL:	https://renovate-npm-vite-vulnerabil.unplugin-vue-router.pages.dev

View logs

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/unplugin-vue-router@620

commit: 1a17fdb

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/unplugin-vue-router@620

commit: de91409

[socket-security]

New, updated, and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher

🚮 Removed packages: npm/[email protected]

View full report↗︎

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 61.68%. Comparing base (da55c28) to head (de91409).
Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #620   +/-   ##
=======================================
  Coverage   61.68%   61.68%           
=======================================
  Files          32       32           
  Lines        3145     3145           
  Branches      580      580           
=======================================
  Hits         1940     1940           
  Misses       1199     1199           
  Partials        6        6           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.