Closes the two open Dependabot security alerts:
- Vite path traversal in optimized deps .map handling (Moderate)
- esbuild dev-server lets any website send requests + read responses (Moderate)
Root cause (per the H' analysis in PR #155): the vulnerable chain was
`webview/package.json → vitest@2.1.9 → vite@5.4.21 → esbuild@0.21.5`,
with `vitest@^2.1.0` pinned in TWO places (workspace root +
packages/bus). The existing Dependabot vite PR (#145) only touched
packages/hud (which was already on vitest@3), so it could not close
the alerts alone.
Surgical fix:
- Add `pnpm.overrides` block to webview/package.json pinning
vite >= 8.0.5 and esbuild >= 0.25.0. Vite 8.x demotes esbuild
from a hard dep to an optional peer, so the override floats both
the root and the bus workspace to vite@8.0.10 and drops esbuild
from the tree entirely.
- Bump vitest from ^2.1.0 to ^3.0.0 in webview/package.json and
webview/packages/bus/package.json. Vitest 2 is incompatible with
vite 8 (SSR transform throws `__vite_ssr_exportName__ is not
defined`); vitest 3 is required. The hud workspace was already on
vitest@^3.0.0, so this aligns the workspace.
Verified:
- `pnpm install` regenerates the lockfile cleanly.
- `pnpm why vite` shows vite@8.0.10 only; `pnpm why esbuild` returns
empty.
- `pnpm --filter @jarvis/bus test` → 37/37 pass.
- `pnpm --filter @jarvis/hud test` → 101/101 pass.
- `pnpm -r build` → both workspaces build cleanly.
Deferred to v0.2 (per H' triage in #155):
- Vitest 4.x major bump.
- Vitest@3's `esbuild` plugin-option deprecation in favor of `oxc`.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
james.maesandClaude Opus 4.7