Repository navigation
chore(deps-dev): bump vite from 6.4.3 to 6.4.4 in /packages/components - #269
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 6.4.3 to 6.4.4. - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.4/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.4/packages/vite) --- updated-dependencies: - dependency-name: vite dependency-version: 6.4.4 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 7dda0a8. Configure here.
| "typescript": "5.9.3", | ||
| "ultracite": "7.0.12", | ||
| "vite": "6.4.3", | ||
| "vite": "6.4.4", |
There was a problem hiding this comment.
Lockfile still pins previous Vite
Medium Severity
package.json now pins vite to 6.4.4, but pnpm-lock.yaml still specifies and resolves 6.4.3. CI runs pnpm install --frozen-lockfile, so the install fails and the 6.4.4 server security fixes never get applied.
Reviewed by Cursor Bugbot for commit 7dda0a8. Configure here.
Bumps vite from 6.4.3 to 6.4.4.
Release notes
Sourced from vite's releases.
Changelog
Sourced from vite's changelog.
Commits
5f0d9a4release: v6.4.4eec6464fix(server): check resolved ids for transform access (#20410)e570d8dfix(server): store ids tosafeModulePathsrather than URLs (#23656)8afec69fix(deps): update launch-editor to v2.14.2 (#23654)19902cffix(html): filename passed to transformIndexHtml should not include queries (...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Low Risk
Dev-only patch bump to the build/Storybook toolchain with no production dependency or source changes.
Overview
Bumps the vite dev dependency in
packages/componentsfrom 6.4.3 to 6.4.4. Vite remains the bundler for librarybuild/devand Storybook via@storybook/react-vite; no application or runtime dependency changes.The upstream patch includes fixes for dev-server transform access,
safeModulePathshandling,transformIndexHtmlfilenames, and an updatedlaunch-editordependency.Reviewed by Cursor Bugbot for commit 7dda0a8. Bugbot is set up for automated code reviews on this repo. Configure here.