Bump vite [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
vite (source)	4.5.13 -> 4.5.14
vite (source)	6.0.15 -> 6.1.6
vite (source)	5.4.18 -> 5.4.19

GitHub Vulnerability Alerts

CVE-2025-46565

Summary

The contents of files in the project root that are denied by a file matching pattern can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
Only files that are under project root and are denied by a file matching pattern can be bypassed.

• Examples of file matching patterns: .env, .env.*, *.{crt,pem}, **/.env
• Examples of other patterns: **/.git/**, .git/**, .git/**/*

Details

server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns).
These patterns were able to bypass for files under root by using a combination of slash and dot (/.).

PoC

npm create vite@latest
cd vite-project/
cat "secret" > .env
npm install
npm run dev
curl --request-target /.env/. http://localhost:5173

---

Release Notes

vitejs/vite (vite)

v4.5.14

Compare Source

---

Configuration

📅 Schedule: Branch creation - "" in timezone UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[mui-bot]

Netlify deploy preview

https://deploy-preview-46050--material-ui.netlify.app/

@mui/material/GlobalStyles: parsed: +2.04% , gzip: +2.20%
@mui/material/CssBaseline: parsed: +1.96% , gzip: +2.04%
@mui/material: parsed: +0.20% , gzip: +0.26%
@mui/material/Autocomplete: parsed: +0.70% , gzip: +0.70%
@mui/material/MobileStepper: parsed: +1.28% , gzip: +1.18%
@mui/material/OutlinedInput: parsed: +1.21% , gzip: +1.10%
@mui/system: parsed: +1.34% , gzip: +1.16%
@mui/material/InputBase: parsed: +1.31% , gzip: +1.12%
@mui/material/Chip: parsed: +1.13% , gzip: +1.02%
@mui/material/NativeSelect: parsed: +1.20% , gzip: +1.02%
@mui/material/ListItemButton: parsed: +1.24% , gzip: +1.06%
@mui/material/Pagination: parsed: +1.10% , gzip: +0.97%
@mui/lab: parsed: +0.70% , gzip: +0.65%
@mui/material/SpeedDialAction: parsed: +0.80% , gzip: +0.75%
@mui/material/ScopedCssBaseline: parsed: +1.45% , gzip: +1.20%
@mui/material/TablePagination: parsed: +0.62% , gzip: +0.59%
@mui/material/MenuItem: parsed: +1.23% , gzip: +1.05%
@mui/material/Input: parsed: +1.27% , gzip: +1.07%
@mui/material/FilledInput: parsed: +1.23% , gzip: +1.05%
@mui/material/TabScrollButton: parsed: +1.22% , gzip: +1.00%
and 26 more changes

Bundle size report

Details of bundle changes (Toolpad)
Details of bundle changes

Generated by 🚫 dangerJS against 74cf35b

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.