fix(deps): close vite + esbuild CVEs via pnpm.overrides + vitest@3 #159

2026-05-13T11:41:41Z

KofTwentyTwo commented

2026-05-13 11:41:41 +00:00

(Migrated from github.com)

Summary

Closes the two open Dependabot security alerts in webview/pnpm-lock.yaml:

Alert #2 — Vite path traversal in optimized deps .map handling (Moderate, dev-dep).
Alert #1 — esbuild dev-server lets any website send requests + read responses (Moderate, dev-dep).

Root cause

The vulnerable chain was webview/package.json → vitest@2.1.9 → vite@5.4.21 → esbuild@0.21.5, with vitest@^2.1.0 pinned in two places (workspace root + packages/bus). The existing Dependabot vite PR (#145) only touched packages/hud (already on vitest@^3.0.0), so it could not close the alerts alone. Surfaced by the H' triage report on PR #155.

Surgical fix

pnpm.overrides block added to webview/package.json pinning vite >= 8.0.5 and esbuild >= 0.25.0. Vite 8.x demotes esbuild from a hard dep to an optional peer, so the override floats both root + bus workspace to vite@8.0.10 and drops esbuild from the tree entirely.
vitest bumped from ^2.1.0 to ^3.0.0 in both webview/package.json and webview/packages/bus/package.json. Vitest 2 is incompatible with Vite 8 (SSR transform throws __vite_ssr_exportName__ is not defined); vitest 3 is required. The hud workspace was already on vitest@^3.0.0, so this aligns the workspace.

Verification

pnpm install regenerates the lockfile cleanly (719 deletions are the pruned transitive vite-5/esbuild-0.21 closure).
pnpm why vite shows vite@8.0.10 only; pnpm why esbuild returns empty (no longer transitively required).
pnpm --filter @jarvis/bus test → 37/37 pass.
pnpm --filter @jarvis/hud test → 101/101 pass.
pnpm -r build → both workspaces build cleanly.

Deferred to v0.2

Vitest 4.x major bump (separate evaluation per H' recommendation).
Vitest@3's esbuild plugin-option deprecation in favor of oxc — warning logged on each test run, not breaking.

Test plan

pnpm install clean
pnpm -r build clean
pnpm --filter @jarvis/bus test green (37/37)
pnpm --filter @jarvis/hud test green (101/101)
pnpm why vite confirms vite@8.0.10 only
pnpm why esbuild returns empty
Both Dependabot alerts auto-close after merge (verify on Settings → Code security)

🤖 Generated with Claude Code

## Summary Closes the two open Dependabot security alerts in `webview/pnpm-lock.yaml`: - **Alert #2** — Vite path traversal in optimized deps `.map` handling (Moderate, dev-dep). - **Alert #1** — esbuild dev-server lets any website send requests + read responses (Moderate, dev-dep). ## Root cause The vulnerable chain was `webview/package.json → vitest@2.1.9 → vite@5.4.21 → esbuild@0.21.5`, with `vitest@^2.1.0` pinned in **two** places (workspace root + `packages/bus`). The existing Dependabot vite PR (#145) only touched `packages/hud` (already on `vitest@^3.0.0`), so it could not close the alerts alone. Surfaced by the H' triage report on PR #155. ## Surgical fix 1. `pnpm.overrides` block added to `webview/package.json` pinning `vite >= 8.0.5` and `esbuild >= 0.25.0`. Vite 8.x demotes esbuild from a hard dep to an optional peer, so the override floats both root + bus workspace to `vite@8.0.10` **and drops esbuild from the tree entirely**. 2. `vitest` bumped from `^2.1.0` to `^3.0.0` in both `webview/package.json` and `webview/packages/bus/package.json`. Vitest 2 is incompatible with Vite 8 (SSR transform throws `__vite_ssr_exportName__ is not defined`); vitest 3 is required. The `hud` workspace was already on `vitest@^3.0.0`, so this aligns the workspace. ## Verification - `pnpm install` regenerates the lockfile cleanly (719 deletions are the pruned transitive vite-5/esbuild-0.21 closure). - `pnpm why vite` shows `vite@8.0.10` only; `pnpm why esbuild` returns empty (no longer transitively required). - `pnpm --filter @jarvis/bus test` → **37/37 pass**. - `pnpm --filter @jarvis/hud test` → **101/101 pass**. - `pnpm -r build` → both workspaces build cleanly. ## Deferred to v0.2 - Vitest 4.x major bump (separate evaluation per H' recommendation). - Vitest@3's `esbuild` plugin-option deprecation in favor of `oxc` — warning logged on each test run, not breaking. ## Test plan - [x] `pnpm install` clean - [x] `pnpm -r build` clean - [x] `pnpm --filter @jarvis/bus test` green (37/37) - [x] `pnpm --filter @jarvis/hud test` green (101/101) - [x] `pnpm why vite` confirms vite@8.0.10 only - [x] `pnpm why esbuild` returns empty - [ ] Both Dependabot alerts auto-close after merge (verify on Settings → Code security) 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/Jarvis#159