Skip to content

Conversation

@MikeMcC399
Copy link
Collaborator

@MikeMcC399 MikeMcC399 commented Oct 27, 2025

Situation

npm audit reports a medium severity vulnerability CVE-2025-62522 "vite allows server.fs.deny bypass via backslash on Windows" from npm module vite >=7.1.0 <=7.1.0 as a transient dependency of npm module [email protected].

Change

Migrate from [email protected] to [email protected].

Verification

npm ci
npm audit
npm test
npm ls vite

Confirm report of:

found 0 vulnerabilities

and:

 Test Files  13 passed (13)
      Tests  149 passed (149)

and use of [email protected] which meets the criteria vite >=7.1.10

@MikeMcC399 MikeMcC399 added the bug label Oct 27, 2025
@MikeMcC399 MikeMcC399 self-assigned this Oct 27, 2025
@MikeMcC399 MikeMcC399 marked this pull request as ready for review October 27, 2025 14:40
@cypress-app-bot
Copy link

@jennifer-shehane jennifer-shehane merged commit 058d2df into cypress-io:master Oct 27, 2025
12 checks passed
@MikeMcC399 MikeMcC399 deleted the update/vitest branch October 27, 2025 20:31
@MikeMcC399 MikeMcC399 modified the milestone: Sprint 17 Oct 28, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants