Repository navigation
vite dependency has high severity security vulnerability #460
Description
Activity
It's a development time dependency. Are you going to attack yourself?
Please do not open these kinds of issues. Package managers are more than capable of handling these updates silently.
@shellscape I'm sorry if opening this upset you. I fully realize I can force the package manager to use unaffected versions, so truly just trying to help the ecosystem and project. I don't understand the strong response 🤷♂️ I'd be happy to open a PR if it helps. I'd just need guidance on how you'd like it done.
FWIW, the react-router-dom version being used also exposes seven vulnerabilities. I would have opened an issue for those, too, but I'm not sure now how you'd want to handle those.
Also, I see both
viteandreact-router-domas dependencies, not devDependencies?It didn't upset me, I didn't say it did. Perhaps you're a bit too sensitive to plain language?
If you'd like to open a PR, feel free.
Also, I see both vite and react-router-dom as dependencies, not devDependencies?
Yes, due to how they're used. jsx-email is a development tool. When someone installs it, they need to have all of the dependencies to use all of the functionality. The preview functionality uses vite, hence it's a dep and not a devDep.
jsx-email3.2.1Expected Behavior / Situation
Transitive dependencies are free from vulnerabilities.
Actual Behavior / Situation
vite8.0.10is vulnerable:GHSA-fx2h-pf6j-xcff
Modification Proposal
Upgrade
viteto8.0.16(ideally with semver^8.0.16or~8.0.16).