fix(deps): update dependency vite to v5.4.12 [security] #131

renovate · 2025-02-17T07:11:00Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
vite (source)	`5.4.9` -> `5.4.12`

GitHub Vulnerability Alerts

CVE-2025-24010

Summary

Vite allowed any websites to send any requests to the development server and read the response due to default CORS settings and lack of validation on the Origin header for WebSocket connections.

Warning

This vulnerability even applies to users that only run the Vite dev server on the local machine and does not expose the dev server to the network.

Upgrade Path

Users that does not match either of the following conditions should be able to upgrade to a newer version of Vite that fixes the vulnerability without any additional configuration.

Using the backend integration feature
Using a reverse proxy in front of Vite
Accessing the development server via a domain other than localhost or *.localhost
Using a plugin / framework that connects to the WebSocket server on their own from the browser

Using the backend integration feature

If you are using the backend integration feature and not setting server.origin, you need to add the origin of the backend server to the server.cors.origin option. Make sure to set a specific origin rather than *, otherwise any origin can access your development server.

Using a reverse proxy in front of Vite

If you are using a reverse proxy in front of Vite and sending requests to Vite with a hostname other than localhost or *.localhost, you need to add the hostname to the new server.allowedHosts option. For example, if the reverse proxy is sending requests to http://vite:5173, you need to add vite to the server.allowedHosts option.

Accessing the development server via a domain other than `localhost` or `*.localhost`

You need to add the hostname to the new server.allowedHosts option. For example, if you are accessing the development server via http://foo.example.com:8080, you need to add foo.example.com to the server.allowedHosts option.

Using a plugin / framework that connects to the WebSocket server on their own from the browser

If you are using a plugin / framework, try upgrading to a newer version of Vite that fixes the vulnerability. If the WebSocket connection appears not to be working, the plugin / framework may have a code that connects to the WebSocket server on their own from the browser.

In that case, you can either:

fix the plugin / framework code to the make it compatible with the new version of Vite
set legacy.skipWebSocketTokenCheck: true to opt-out the fix for [2] while the plugin / framework is incompatible with the new version of Vite
- When enabling this option, make sure that you are aware of the security implications described in the impact section of [2] above.

Mitigation without upgrading Vite

[1]: Permissive default CORS settings

Set server.cors to false or limit server.cors.origin to trusted origins.

[2]: Lack of validation on the Origin header for WebSocket connections

There aren't any mitigations for this.

[3]: Lack of validation on the Host header for HTTP requests

Use Chrome 94+ or use HTTPS for the development server.

Details

There are three causes that allowed malicious websites to send any requests to the development server:

[1]: Permissive default CORS settings

Vite sets the Access-Control-Allow-Origin header depending on server.cors option. The default value was true which sets Access-Control-Allow-Origin: *. This allows websites on any origin to fetch contents served on the development server.

Attack scenario:

The attacker serves a malicious web page (http://malicious.example.com).
The user accesses the malicious web page.
The attacker sends a fetch('http://127.0.0.1:5173/main.js') request by JS in that malicious web page. This request is normally blocked by same-origin policy, but that's not the case for the reasons above.
The attacker gets the content of http://127.0.0.1:5173/main.js.

[2]: Lack of validation on the Origin header for WebSocket connections

Vite starts a WebSocket server to handle HMR and other functionalities. This WebSocket server did not perform validation on the Origin header and was vulnerable to Cross-Site WebSocket Hijacking (CSWSH) attacks. With that attack, an attacker can read and write messages on the WebSocket connection. Vite only sends some information over the WebSocket connection (list of the file paths that changed, the file content where the errored happened, etc.), but plugins can send arbitrary messages and may include more sensitive information.

Attack scenario:

The attacker serves a malicious web page (http://malicious.example.com).
The user accesses the malicious web page.
The attacker runs new WebSocket('http://127.0.0.1:5173', 'vite-hmr') by JS in that malicious web page.
The user edits some files.
Vite sends some HMR messages over WebSocket.
The attacker gets the content of the HMR messages.

[3]: Lack of validation on the Host header for HTTP requests

Unless server.https is set, Vite starts the development server on HTTP. Non-HTTPS servers are vulnerable to DNS rebinding attacks without validation on the Host header. But Vite did not perform validation on the Host header. By exploiting this vulnerability, an attacker can send arbitrary requests to the development server bypassing the same-origin policy.

The attacker serves a malicious web page that is served on HTTP (http://malicious.example.com:5173) (HTTPS won't work).
The user accesses the malicious web page.
The attacker changes the DNS to point to 127.0.0.1 (or other private addresses).
The attacker sends a fetch('/main.js') request by JS in that malicious web page.
The attacker gets the content of http://127.0.0.1:5173/main.js bypassing the same origin policy.

Impact

[1]: Permissive default CORS settings

Users with the default server.cors option may:

get the source code stolen by malicious websites
give the attacker access to functionalities that are not supposed to be exposed externally
- Vite core does not have any functionality that causes changes somewhere else when receiving a request, but plugins may implement those functionalities and servers behind server.proxy may have those functionalities.

[2]: Lack of validation on the Origin header for WebSocket connections

All users may get the file paths of the files that changed and the file content where the error happened be stolen by malicious websites.

For users that is using a plugin that sends messages over WebSocket, that content may be stolen by malicious websites.

For users that is using a plugin that has a functionality that is triggered by messages over WebSocket, that functionality may be exploited by malicious websites.

[3]: Lack of validation on the Host header for HTTP requests

Users using HTTP for the development server and using a browser that is not Chrome 94+ may:

get the source code stolen by malicious websites
give the attacker access to functionalities that are not supposed to be exposed externally
- Vite core does not have any functionality that causes changes somewhere else when receiving a request, but plugins may implement those functionalities and servers behind server.proxy may have those functionalities.

Chrome 94+ users are not affected for [3], because sending a request to a private network page from public non-HTTPS page is forbidden since Chrome 94.

Related Information

Safari has a bug that blocks requests to loopback addresses from HTTPS origins. This means when the user is using Safari and Vite is listening on lookback addresses, there's another condition of "the malicious web page is served on HTTP" to make [1] and [2] to work.

PoC

[2]: Lack of validation on the Origin header for WebSocket connections

I used the react template which utilizes HMR functionality.

npm create vite@latest my-vue-app-react -- --template react

Then on a malicious server, serve the following POC html:

<!doctype html>
<html lang="en">
    <head>
        <meta charset="utf-8" />
        <title>vite CSWSH</title>
    </head>
    <body>
        <div id="logs"></div>
        <script>
            const div = document.querySelectorAll('#logs')[0];
            const ws = new WebSocket('ws://localhost:5173','vite-hmr');
            ws.onmessage = event => {
                const logLine = document.createElement('p');
                logLine.innerHTML = event.data;
                div.append(logLine);
            };
        </script>
    </body>
</html>

Kick off Vite

npm run dev

Load the development server (open http://localhost:5173/) as well as the malicious page in the browser.
Edit src/App.jsx file and intentionally place a syntax error
Notice how the malicious page can view the websocket messages and a snippet of the source code is exposed

Here's a video demonstrating the POC:

vite-cswsh.mov

Release Notes

vitejs/vite (vite)

`v5.4.12`

Compare Source

This version contains a breaking change due to security fixes. See GHSA-vg6x-rcgg-rjx6 for more details.

Please refer to CHANGELOG.md for details.

`v5.4.11`

Compare Source

Please refer to CHANGELOG.md for details.

`v5.4.10`

Compare Source

Please refer to CHANGELOG.md for details.

Configuration

📅 Schedule: Branch creation - "" in timezone Asia/Tokyo, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

cloudflare-workers-and-pages · 2025-02-17T07:11:02Z

Deploying tutoriallm-demo with Cloudflare Pages

Latest commit:	`b391a84`
Status:	✅ Deploy successful!
Preview URL:	https://cea5df62.tutoriallm-dev.pages.dev
Branch Preview URL:	https://renovate-npm-vite-vulnerabil.tutoriallm-dev.pages.dev

View logs

cloudflare-workers-and-pages · 2025-02-17T09:44:21Z

Deploying tutoriallm with Cloudflare Pages

Latest commit:	`1ac9572`
Status:	✅ Deploy successful!
Preview URL:	https://f32b74a4.tutoriallm.pages.dev
Branch Preview URL:	https://renovate-npm-vite-vulnerabil.tutoriallm.pages.dev

View logs

* Renovate Updates * chore(deps): update dependency better-auth to v1.1.16 [security] (#130) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update dependency vitest to v3.0.5 [security] (#133) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * fix(deps): update dependency @sentry/node to v8.49.0 [security] (#132) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * fix(deps): update dependency vite to v5.4.12 [security] (#131) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): pin node.js (#136) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * fix(deps): pin dependencies (#137) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: soumame <[email protected]> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

* 🗃️ 🚧 💥 change to uuid-based session management system as preparation of v2.0.0 * 🚧 🗃️ 💥 Using nanoid instead of UUID for session management * 🐛 Fix error handling in session creation by removing session data from IndexedDB * 🗑️ Remove CodeInput component and its dependencies from the project * 🐛 Fix middleware to await next() for proper request handling * 🛂 🚧 Implementing better-auth for auth / add auth for users / support anonymous(guest) login / set up pnpm catalogs * 📦 Update hono dependency to use catalog reference in package.json * 🚑 🐛 Fix type extraction for OpenAPI response content in jsonBody * 🚧 ✨ Implementing better-auth system * 🐛 Fix import path for Input component and adjust max-width in EditPassword component * ✨ Add admin access button and styling for admin users in UserAccount component * 🛂 🚧 Better-auth user lists for admin * 🐛 Fix sign-out functionality to use authClient and redirect to login * ✨ Add role selection for users in admin table with role change functionality * 🚧 🏗️ ✨ Session viewer with user information * 🚧 ✨ Implement user / user setting and enhance Popup component usage across various components * 🔥 ✨ Refactor CreateFromAnonymous component to remove session prop and update BlockHighlight event handling * 🚧 Add Session viewer by users / using path-based functions with tanstack instead of popup feature * ✨ Enhance session management by adding user info navigation and improving back navigation functionality * ✨ Improve session user info handling and add stats popup functionality in session tables * ✨ Add user editing functionality and improve navigation with breadcrumbs in user and tutorial routes * ✨ Add toast notifications for user and session actions in admin features * 🐛 ✨ change avatar name assignment in UserCard component * 🚑 Add functionality to delete all sessions by user ID in admin session management to avoid db relations error * ✨ Remove unnecessary query invalidation and ensure toast notification displays correctly in user column actions * 💄 ✨ Improve layout and padding in admin routes for better user experience * 🚧 Tutorial Editor with Tanstack * 🚧 🎨 💄 Building new design system with tailwind/shadcn * 🐛 ✨ Add custom tag management with API integration in TutorialEditor * 🔧 ✨ Update dependencies for better performance and security * ➕ 🚧 🔧 Update zod to version 3.24.1 and adjust package references in pnpm workspace to prevent error for react-hook-form * 🔥 🔧 Refactor frontend to simplify error handling and remove unused code to avoid tsc error * 🔥 🔧 ✨ Refactor ExampleCode component to simplify session management and improve toolbox functionality / implement Blockly editor in tutorial editor * 🔧 ✨ Remove unused loading spinner styles and simplify viewport meta tag in index.html * 💄 ✨ Refactor components for improved styling and accessibility; remove unused overlay and popup components #80 * ✨ Add toast notifications for user info and password updates; integrate Toaster component in root and remove redundant Toaster from admin route * 💄 ✨ Refactor button variants for consistency and improve UI components across the application * 💄 ✨ Update highlight animation duration for improved visual effect in Blockly styles * 💄 ✨ Refactor language selection to use custom Select component for improved consistency and styling * 💄 ✨ Add warning color and foreground variables to Tailwind configuration for enhanced styling options * 🚧 💄 ✨ Update UI components with new color schemes based on custom CSS and styling adjustments for improved consistency and aesthetics * 🚧 💄 ✨ Update styling of text for improved consistency across components and enhance visual elements * ⚡️ 💄 ✨ Refactor admin layout components for improved structure and styling consistency * 🚧 Update maximum file size for caching in Workbox configuration to improve performance * 🚧 Update docker-compose to use environment variables for backend URL configuration * 🚑 🚧 Update TypeScript compilation command and blockly dependency version in package.json files * 🚧 update dependency with catalog (pnpm) * 🐛 🔧 Rename joinCode to joinSessionId to follow the changes in backend * ➕ 🚧 🚀 Add Playwright accessibility tests and update .gitignore for frontend * 🚧 Update VSCode settings for i18n ally configuration and enable TypeScript project diagnostics * 🐛 Update name and paths for i18n config * 🚧 🌐 🐛 i18n: Updating text for all components to use translation keys with i18n (machine-translated) machine-translated i18n #92 * 🌐 🚧 Replace alert with toast notifications for error handling in various components and update translations / machine-translated i18n #92 / Replacing alert by toast component #91 * 🚧 🌐 i18n: Clean up unused translation keys / machine-translated i18n #92 * 💄 🌐 🚧 Refactor toast notifications to use ErrorToastContent and SuccessToastContent components for consistent error handling across various components * 🔥 🚧 🌐 i18n: Delete machine-translated languages / machine-translated i18n #92 * 🌐 Update i18n for zod validator in form * ♻️ Add getUserSessions API and related hooks for user session management instead of local session storage * 🌐 Update quick reply translations in English and Japanese * 🎨 💄 Improve dialog component styles for better layout and responsiveness / Fix tutorial selector's ui #88 * 🚚 🔄 Rename logout function to signout for consistency in user account component * 🌐 Update Japanese translations for login and account management terms * 🔧 Fix tutorial tags display in admin table by mapping tag names * 🔥 🎨 Remove join code references from editor tour and navbar components * 🎉 ✨ Add session name functionality with database migration and API updates and add context to tanstack router for usequery client * 💄 🔧 Increase z-index of ToastViewport for improved stacking context * 🚑 Add 'name' field to initial data in ExampleCode component * 🔥 🎨 Remove session data handling functions from IndexedDB and clean up Navbar component * 🌐 🔧 Update session i18n translations * ✨ Improve session display by adding session name and loading state handling * ✨ Add project name column to session tables and update translations * ✨ Fix translation rendering in SessionTable component * 🚑 ✨ Refactor route handling of tutorials / users path and breadCrumbs component * 🚚 ✨ Refactor import of useMutation to use custom hook * 🐛 ✨ Add user creating page in admin console, fix camel case typo of confirmPassword field * 💄 ✨ Update TutorialEditor layout for improved responsiveness and remove unnecessary margin in toolbar * 💄 ✨ Update button variants in ExecSwitch and Navbar components from 'ghost' to 'outline' * 💄 ✨ Update ExecSwitch and Navbar components for improved layout and responsiveness * 🐛 ✨ Remove unused state variables from state management * 🎨 🔥 Remove isCodeRunning atom and use useState instead / Avoid using useAtom for workspace state #85 * 🎨 🔥 Remove isWorkspaceConnected atom and use useState instead / Avoid using useAtom for workspace state #85 * 🔥 Remove unused sessionValue structure from handleExit function in Navbar component * 🎨 🔥 Remove socketIoInstance atom and use useState instead / Avoid using useAtom for workspace state #85 * ➕ 🌐 ⚡️ Using cookie-based i18n setup instead of globalstate with jotai / Avoid using useAtom for workspace state #85 * 🎨 🔥 Replacing currentSession and prevSession atom by useState / Avoid using useAtom for workspace state #85 * 💄 🎨 🔧 Update button styles for improved appearance and consistency * 💄 🎨 ✨ Update button styles to prevent text overflow and improve layout * 🎨 🔧 Update Switch component to use flex-shrink for better layout handling * 💄 🎨 Update session overlay layout for improved alignment and spacing * 💄 🎨 Update layout and styling for improved responsiveness and alignment in profile and login components * ⬆️ Update packages and delete old pnpm lock file * 🔧 Update TypeScript configuration to enable JSX import source and exclude node_modules and dist * 🔧 Fix type extraction for OpenAPI responses to allow unknown content type * ⬆️ 🔧 Add react-scan package and enable scanning in development mode * 🔧 Remove experimental project diagnostics setting from VSCode configuration * ⚡️ 🚧 Implementing new Blockly component strategy Co-authored-by: Yuta Kobayashi <[email protected]> * 🔧 Update ExampleCode component to manage workspace session state and integrate language support * 🔥 delete unused file * 🧪 Configure Vitest with React and JSDOM for testing * 🧹 Clean up unused imports and variables #96 * 🔒️ Enable cross-subdomain cookies for authentication * 🔒️ Configure secure cross-origin cookie settings * 🔒️ Remove explicit secure cookie settings * 🔥 Remove debug console logs in Blockly component * 🚧 ✨ Conditionally render workspace content based on connection status #100 * 🎨 Improve audio recording UI and functionality in dialogue component #99 * 🚀 Increase code execution memory limits in default configuration * 🚑 🔒 Add HTTPS check for audio recording button visibility * 💄 ✨ Enhance saved sessions UI with improved layout and empty state handling #86 * 🐛 ✨ Improve session exit handling with query invalidation * 💄 Replace min-h-screen with min-h-svh for better viewport height handling * 💄 ✨ Add login button submission state handling * docs(readme): image and youtube link * docs: open collective link * fix * docs(llm): editor instructions * 💄 Add whitespace-nowrap to form label * 📝 ✨ Replace Swagger UI with Scalar API Reference and enhance OpenAPI documentation with suppoting auth API(better-auth) * 🚧 Error handling of better-auth * ♻️ Refactor login screen: suppoting error messages with full translation from better-auth, replacing form with component * ⚡️ 🔧 Configure OpenAPI plugin with default reference disabled * ♻️ Refactor sessionlist api for admin to reduce loading time in table #107 * 🐛 Fix type error from tsc on sessionlist api #107 * 🔧 Configure TypeScript to improve error reporting * 🚧 🚑 ✨ Implement query invalidation for admin tables after delete operations #103 * 🔧 Adjust session query stale time to always fetch latest data * 🔧 Replace useRouteContext with useQueryClient for consistent query management #103 * 🔧 Update better-auth package version to 1.1.15 * 🧹 Remove unused / broken import statements across multiple frontend components * 🔧 Disable sorting for action and stats columns in admin tables #87 * ✅ Add e2e tests for guest authentication flow * feat: install renovate * chore: save-exact * Renovate Updates * refactor: add route comment (#111) * fix: spell (#112) * wip: spell check * fix: spell * 🔧 update dev dependencies in package.json and add js-yaml from pnpm catalog * 🚨 update cspell word list and add British English language settings * 🚨 rename serializednodes to serializedNodes across project * 🔧 Add 'sessionvalue' to cspell ignore word list * 🚨 Rename 'isuser' to 'isUser' across project * 💄 Fix spelling of 'dialogue' in system templates * 🔧 Fix variable naming in session updator * 🔧 Ignore Playwright report directories in cspell config * 🚨 Rename 'nodetype' to 'nodeType' * 🚨 Fix LangPicker import casing * 🚨 Fix 'easymode' variable naming to 'easyMode' * 🚨 Fix typo in warning text classes * 🚨 Fix 'beforeinstallprompt' event name casing * 🚨 Fix 'typecodeMsg' to 'typeCodeMsg' in translation files * 🚨 Rename 'Customnode' to 'CustomNode' in TutorialEditor * 🚨 Fix 'laston...' cookie naming to 'lastOn...' * 🚨 Fix 'debuginfo' to 'debugInfo' in translation and import files * 🚨 Fix 'pixeldensity' to 'pixelDensity' in workspaceToPng * 🚨 Fix 'typesafety' to 'type safety' in comment * 🚨 Update cspell ignore paths for extensions package * 🚨 Fix 'quickreply' to 'quickReply' in import path * 🚨 Remove empty 'logbuffer' translation key * 🚨 Update cspell ignore paths for artifacts and docker-compose * 🚨 Rename 'serializednodes' to 'serializedNodes' in tutorials table(migration from drizzle) --------- Co-authored-by: soumame <[email protected]> * Fix/pre commit (#117) * 💚 update pre-commit hooks and package scripts for type checking * chore(package.json): implementing commit formatter (commitlint / commitzen) * fix: rename nodeType import to correct casing (#118) * fix: rename nodeType import to correct casing * fix: correct debugInfo import casing * fix: correct LangPicker import casing * chore: remove unnecessary TypeScript compilation in build script * feat: add LangPicker and QuickReply components to frontend * chore: move docs repo (#113) * chore: move docs repo * chore: remove unnecessary daily webhook workflow * fix: update docs project configuration and formatting * chore: update docs project version to 2.0.0 * chore: add Astro Tailwind integration * refactor: migrate Contributers component to Tailwind CSS * chore: remove DemoStatus component from docs pages * feat: refactor OpenAPI documentation for exporting schema * fix: updating frontend's package.json * refactor: simplify OpenAPI documentation routes by loading URL from .env and remove api-schema.yaml * refactor: simplify OpenAPI documentation routes by loading URL from .env and remove api-schema.yaml Integrate docs into monorepo #109 * docs: add Japanese README and update language link --------- Co-authored-by: soumame <[email protected]> * fix: skip corepack signature verification (#119) Resolves nodejs/corepack#612 temporality * chore: wireit monorepo (#122) * chore: wireit monorepo * fix: type check * fix: files * chore: remove extensions type check from wireit configuration --------- Co-authored-by: soumame <[email protected]> * Vitest-setup (#123) * 🚧 🧪 Add Vitest configuration and component tests for frontend (seems not working on vscode's extension) * chore: update testing library dependencies in package.json * test: add comprehensive tests for ExecSwitch and Navbar components * fix: update letter case to resolve build error * refactor: implement dependency injection middleware and update context types Co-authored-by: Yuta Kobayashi <[email protected]> * chore: export default app from backend index * chore: add testcontainers as a dev dependency for backend testing * chore: add Vitest configuration for backend testing * test: add database and tutorial module tests with test helpers * test(vitest configurations): implement backend testing - Add .env.test file for backend testing- Modify Vitest configs to load test environment variables- Update database utility functions to use new environment variable names- Adjust database setup and truncate functions for testing * refactor: update dependency injection middleware to accept database parameter * test: add comprehensive tests for tutorial routes and endpoints * refactor: simplify dependency injection middleware and remove explicit database parameter * test: update session handling of backend testing with improved setup Co-authored-by: Yuta Kobayashi <[email protected]> * test: remove navbar component tests * refactor: reorganize route handling and enforce session validation middleware * docs: add server URL configuration to auth reference in OpenAPI specification * refactor: remove session renaming functionality and simplify session update logic * test: enhance session tests with structured operations and improved setup * refactor: streamline route handling and reintroduce session validation middleware * feat: add middleware for dependency injection and session management * refactor: remove unused socket.io middleware from session module * refactor: update import path for dependency injection middleware * feat: add authentication middleware for session routes * refactor: remove unnecessary console logging statements * docs: add comprehensive testing guidelines for backend development * test: add health check endpoint test for backend status route * test: add comprehensive test suite for admin session management and fix unsuitable db query * test: modify database truncate method to reset identity sequence * test: add comprehensive test suite for admin tutorial management * test: enhance tutorial test assertions with specific expected values * Merge branch 'dev' into vitest-setup * test: remove unnecessary tutorial test assertions * test: setup MSW and enhance frontend testing infrastructure --------- Co-authored-by: Yuta Kobayashi <[email protected]> * chore: remove unused reset-credential command from docker-compose startup script * feat: add CLI commands for user registration and initialization * chore: update GitHub Actions deployment workflows (#125) - Add environment configurations for dev and production deployments - Remove explicit release names in GitHub release creation steps * fix: update GitHub actions to refer OPENAPI_DOCS_URL for build /docs repo (#126) * fix: add OPENAPI_DOCS_URL build argument for Docker and GitHub Actions (#127) - Update Dockerfile and Dockerfile.dev to include OPENAPI_DOCS_URL build argument - Modify GitHub Actions workflows (deploy.yaml and dev_deploy.yaml) to pass OPENAPI_DOCS_URL - Add .env.example in docs package with default OpenAPI documentation URL * Deploy workflow fix 4 (#129) * chore: remove OPENAPI_DOCS_URL references from Docker and GitHub Actions - Remove OPENAPI_DOCS_URL environment variable and build arguments from Dockerfiles - Update GitHub Actions workflows to remove OPENAPI_DOCS_URL configuration - Delete .env.example file in docs package * chore: restore .env.example with OPENAPI_DOCS_URL for docs package * Renovate Updates (#115) * Renovate Updates * chore(deps): update dependency better-auth to v1.1.16 [security] (#130) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update dependency vitest to v3.0.5 [security] (#133) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * fix(deps): update dependency @sentry/node to v8.49.0 [security] (#132) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * fix(deps): update dependency vite to v5.4.12 [security] (#131) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): pin node.js (#136) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * fix(deps): pin dependencies (#137) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: soumame <[email protected]> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * Bugfix 2.0.1 (#144) * chore: update project version to 2.0.1 * fix: make user creation CLI command await role setting Unable to add "admin" role for created user from cli #134 * chore: remove server telemetry configuration file * feat: add session-based WebSocket proxy upgrade handling Implement WebSocket upgrade handling with session-based validation: - Extract sessionId from the request URL - Check if sessionId exists and has a corresponding proxy - Return 404 if session is invalid - Proceed with proxy upgrade for valid sessions Server crashes when Minecraft has connected #135 * Revert "Bugfix 2.0.1 (#144)" (#149) This reverts commit d96f9f7. --------- Co-authored-by: Yuta Kobayashi <[email protected]> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

* 🗃️ 🚧 💥 change to uuid-based session management system as preparation of v2.0.0 * 🚧 🗃️ 💥 Using nanoid instead of UUID for session management * 🐛 Fix error handling in session creation by removing session data from IndexedDB * 🗑️ Remove CodeInput component and its dependencies from the project * 🐛 Fix middleware to await next() for proper request handling * 🛂 🚧 Implementing better-auth for auth / add auth for users / support anonymous(guest) login / set up pnpm catalogs * 📦 Update hono dependency to use catalog reference in package.json * 🚑 🐛 Fix type extraction for OpenAPI response content in jsonBody * 🚧 ✨ Implementing better-auth system * 🐛 Fix import path for Input component and adjust max-width in EditPassword component * ✨ Add admin access button and styling for admin users in UserAccount component * 🛂 🚧 Better-auth user lists for admin * 🐛 Fix sign-out functionality to use authClient and redirect to login * ✨ Add role selection for users in admin table with role change functionality * 🚧 🏗️ ✨ Session viewer with user information * 🚧 ✨ Implement user / user setting and enhance Popup component usage across various components * 🔥 ✨ Refactor CreateFromAnonymous component to remove session prop and update BlockHighlight event handling * 🚧 Add Session viewer by users / using path-based functions with tanstack instead of popup feature * ✨ Enhance session management by adding user info navigation and improving back navigation functionality * ✨ Improve session user info handling and add stats popup functionality in session tables * ✨ Add user editing functionality and improve navigation with breadcrumbs in user and tutorial routes * ✨ Add toast notifications for user and session actions in admin features * 🐛 ✨ change avatar name assignment in UserCard component * 🚑 Add functionality to delete all sessions by user ID in admin session management to avoid db relations error * ✨ Remove unnecessary query invalidation and ensure toast notification displays correctly in user column actions * 💄 ✨ Improve layout and padding in admin routes for better user experience * 🚧 Tutorial Editor with Tanstack * 🚧 🎨 💄 Building new design system with tailwind/shadcn * 🐛 ✨ Add custom tag management with API integration in TutorialEditor * 🔧 ✨ Update dependencies for better performance and security * ➕ 🚧 🔧 Update zod to version 3.24.1 and adjust package references in pnpm workspace to prevent error for react-hook-form * 🔥 🔧 Refactor frontend to simplify error handling and remove unused code to avoid tsc error * 🔥 🔧 ✨ Refactor ExampleCode component to simplify session management and improve toolbox functionality / implement Blockly editor in tutorial editor * 🔧 ✨ Remove unused loading spinner styles and simplify viewport meta tag in index.html * 💄 ✨ Refactor components for improved styling and accessibility; remove unused overlay and popup components #80 * ✨ Add toast notifications for user info and password updates; integrate Toaster component in root and remove redundant Toaster from admin route * 💄 ✨ Refactor button variants for consistency and improve UI components across the application * 💄 ✨ Update highlight animation duration for improved visual effect in Blockly styles * 💄 ✨ Refactor language selection to use custom Select component for improved consistency and styling * 💄 ✨ Add warning color and foreground variables to Tailwind configuration for enhanced styling options * 🚧 💄 ✨ Update UI components with new color schemes based on custom CSS and styling adjustments for improved consistency and aesthetics * 🚧 💄 ✨ Update styling of text for improved consistency across components and enhance visual elements * ⚡️ 💄 ✨ Refactor admin layout components for improved structure and styling consistency * 🚧 Update maximum file size for caching in Workbox configuration to improve performance * 🚧 Update docker-compose to use environment variables for backend URL configuration * 🚑 🚧 Update TypeScript compilation command and blockly dependency version in package.json files * 🚧 update dependency with catalog (pnpm) * 🐛 🔧 Rename joinCode to joinSessionId to follow the changes in backend * ➕ 🚧 🚀 Add Playwright accessibility tests and update .gitignore for frontend * 🚧 Update VSCode settings for i18n ally configuration and enable TypeScript project diagnostics * 🐛 Update name and paths for i18n config * 🚧 🌐 🐛 i18n: Updating text for all components to use translation keys with i18n (machine-translated) machine-translated i18n #92 * 🌐 🚧 Replace alert with toast notifications for error handling in various components and update translations / machine-translated i18n #92 / Replacing alert by toast component #91 * 🚧 🌐 i18n: Clean up unused translation keys / machine-translated i18n #92 * 💄 🌐 🚧 Refactor toast notifications to use ErrorToastContent and SuccessToastContent components for consistent error handling across various components * 🔥 🚧 🌐 i18n: Delete machine-translated languages / machine-translated i18n #92 * 🌐 Update i18n for zod validator in form * ♻️ Add getUserSessions API and related hooks for user session management instead of local session storage * 🌐 Update quick reply translations in English and Japanese * 🎨 💄 Improve dialog component styles for better layout and responsiveness / Fix tutorial selector's ui #88 * 🚚 🔄 Rename logout function to signout for consistency in user account component * 🌐 Update Japanese translations for login and account management terms * 🔧 Fix tutorial tags display in admin table by mapping tag names * 🔥 🎨 Remove join code references from editor tour and navbar components * 🎉 ✨ Add session name functionality with database migration and API updates and add context to tanstack router for usequery client * 💄 🔧 Increase z-index of ToastViewport for improved stacking context * 🚑 Add 'name' field to initial data in ExampleCode component * 🔥 🎨 Remove session data handling functions from IndexedDB and clean up Navbar component * 🌐 🔧 Update session i18n translations * ✨ Improve session display by adding session name and loading state handling * ✨ Add project name column to session tables and update translations * ✨ Fix translation rendering in SessionTable component * 🚑 ✨ Refactor route handling of tutorials / users path and breadCrumbs component * 🚚 ✨ Refactor import of useMutation to use custom hook * 🐛 ✨ Add user creating page in admin console, fix camel case typo of confirmPassword field * 💄 ✨ Update TutorialEditor layout for improved responsiveness and remove unnecessary margin in toolbar * 💄 ✨ Update button variants in ExecSwitch and Navbar components from 'ghost' to 'outline' * 💄 ✨ Update ExecSwitch and Navbar components for improved layout and responsiveness * 🐛 ✨ Remove unused state variables from state management * 🎨 🔥 Remove isCodeRunning atom and use useState instead / Avoid using useAtom for workspace state #85 * 🎨 🔥 Remove isWorkspaceConnected atom and use useState instead / Avoid using useAtom for workspace state #85 * 🔥 Remove unused sessionValue structure from handleExit function in Navbar component * 🎨 🔥 Remove socketIoInstance atom and use useState instead / Avoid using useAtom for workspace state #85 * ➕ 🌐 ⚡️ Using cookie-based i18n setup instead of globalstate with jotai / Avoid using useAtom for workspace state #85 * 🎨 🔥 Replacing currentSession and prevSession atom by useState / Avoid using useAtom for workspace state #85 * 💄 🎨 🔧 Update button styles for improved appearance and consistency * 💄 🎨 ✨ Update button styles to prevent text overflow and improve layout * 🎨 🔧 Update Switch component to use flex-shrink for better layout handling * 💄 🎨 Update session overlay layout for improved alignment and spacing * 💄 🎨 Update layout and styling for improved responsiveness and alignment in profile and login components * ⬆️ Update packages and delete old pnpm lock file * 🔧 Update TypeScript configuration to enable JSX import source and exclude node_modules and dist * 🔧 Fix type extraction for OpenAPI responses to allow unknown content type * ⬆️ 🔧 Add react-scan package and enable scanning in development mode * 🔧 Remove experimental project diagnostics setting from VSCode configuration * ⚡️ 🚧 Implementing new Blockly component strategy Co-authored-by: Yuta Kobayashi <[email protected]> * 🔧 Update ExampleCode component to manage workspace session state and integrate language support * 🔥 delete unused file * 🧪 Configure Vitest with React and JSDOM for testing * 🧹 Clean up unused imports and variables #96 * 🔒️ Enable cross-subdomain cookies for authentication * 🔒️ Configure secure cross-origin cookie settings * 🔒️ Remove explicit secure cookie settings * 🔥 Remove debug console logs in Blockly component * 🚧 ✨ Conditionally render workspace content based on connection status #100 * 🎨 Improve audio recording UI and functionality in dialogue component #99 * 🚀 Increase code execution memory limits in default configuration * 🚑 🔒 Add HTTPS check for audio recording button visibility * 💄 ✨ Enhance saved sessions UI with improved layout and empty state handling #86 * 🐛 ✨ Improve session exit handling with query invalidation * 💄 Replace min-h-screen with min-h-svh for better viewport height handling * 💄 ✨ Add login button submission state handling * docs(readme): image and youtube link * docs: open collective link * fix * docs(llm): editor instructions * 💄 Add whitespace-nowrap to form label * 📝 ✨ Replace Swagger UI with Scalar API Reference and enhance OpenAPI documentation with suppoting auth API(better-auth) * 🚧 Error handling of better-auth * ♻️ Refactor login screen: suppoting error messages with full translation from better-auth, replacing form with component * ⚡️ 🔧 Configure OpenAPI plugin with default reference disabled * ♻️ Refactor sessionlist api for admin to reduce loading time in table #107 * 🐛 Fix type error from tsc on sessionlist api #107 * 🔧 Configure TypeScript to improve error reporting * 🚧 🚑 ✨ Implement query invalidation for admin tables after delete operations #103 * 🔧 Adjust session query stale time to always fetch latest data * 🔧 Replace useRouteContext with useQueryClient for consistent query management #103 * 🔧 Update better-auth package version to 1.1.15 * 🧹 Remove unused / broken import statements across multiple frontend components * 🔧 Disable sorting for action and stats columns in admin tables #87 * ✅ Add e2e tests for guest authentication flow * feat: install renovate * chore: save-exact * Renovate Updates * refactor: add route comment (#111) * fix: spell (#112) * wip: spell check * fix: spell * 🔧 update dev dependencies in package.json and add js-yaml from pnpm catalog * 🚨 update cspell word list and add British English language settings * 🚨 rename serializednodes to serializedNodes across project * 🔧 Add 'sessionvalue' to cspell ignore word list * 🚨 Rename 'isuser' to 'isUser' across project * 💄 Fix spelling of 'dialogue' in system templates * 🔧 Fix variable naming in session updator * 🔧 Ignore Playwright report directories in cspell config * 🚨 Rename 'nodetype' to 'nodeType' * 🚨 Fix LangPicker import casing * 🚨 Fix 'easymode' variable naming to 'easyMode' * 🚨 Fix typo in warning text classes * 🚨 Fix 'beforeinstallprompt' event name casing * 🚨 Fix 'typecodeMsg' to 'typeCodeMsg' in translation files * 🚨 Rename 'Customnode' to 'CustomNode' in TutorialEditor * 🚨 Fix 'laston...' cookie naming to 'lastOn...' * 🚨 Fix 'debuginfo' to 'debugInfo' in translation and import files * 🚨 Fix 'pixeldensity' to 'pixelDensity' in workspaceToPng * 🚨 Fix 'typesafety' to 'type safety' in comment * 🚨 Update cspell ignore paths for extensions package * 🚨 Fix 'quickreply' to 'quickReply' in import path * 🚨 Remove empty 'logbuffer' translation key * 🚨 Update cspell ignore paths for artifacts and docker-compose * 🚨 Rename 'serializednodes' to 'serializedNodes' in tutorials table(migration from drizzle) --------- Co-authored-by: soumame <[email protected]> * Fix/pre commit (#117) * 💚 update pre-commit hooks and package scripts for type checking * chore(package.json): implementing commit formatter (commitlint / commitzen) * fix: rename nodeType import to correct casing (#118) * fix: rename nodeType import to correct casing * fix: correct debugInfo import casing * fix: correct LangPicker import casing * chore: remove unnecessary TypeScript compilation in build script * feat: add LangPicker and QuickReply components to frontend * chore: move docs repo (#113) * chore: move docs repo * chore: remove unnecessary daily webhook workflow * fix: update docs project configuration and formatting * chore: update docs project version to 2.0.0 * chore: add Astro Tailwind integration * refactor: migrate Contributers component to Tailwind CSS * chore: remove DemoStatus component from docs pages * feat: refactor OpenAPI documentation for exporting schema * fix: updating frontend's package.json * refactor: simplify OpenAPI documentation routes by loading URL from .env and remove api-schema.yaml * refactor: simplify OpenAPI documentation routes by loading URL from .env and remove api-schema.yaml Integrate docs into monorepo #109 * docs: add Japanese README and update language link --------- Co-authored-by: soumame <[email protected]> * fix: skip corepack signature verification (#119) Resolves nodejs/corepack#612 temporality * chore: wireit monorepo (#122) * chore: wireit monorepo * fix: type check * fix: files * chore: remove extensions type check from wireit configuration --------- Co-authored-by: soumame <[email protected]> * Vitest-setup (#123) * 🚧 🧪 Add Vitest configuration and component tests for frontend (seems not working on vscode's extension) * chore: update testing library dependencies in package.json * test: add comprehensive tests for ExecSwitch and Navbar components * fix: update letter case to resolve build error * refactor: implement dependency injection middleware and update context types Co-authored-by: Yuta Kobayashi <[email protected]> * chore: export default app from backend index * chore: add testcontainers as a dev dependency for backend testing * chore: add Vitest configuration for backend testing * test: add database and tutorial module tests with test helpers * test(vitest configurations): implement backend testing - Add .env.test file for backend testing- Modify Vitest configs to load test environment variables- Update database utility functions to use new environment variable names- Adjust database setup and truncate functions for testing * refactor: update dependency injection middleware to accept database parameter * test: add comprehensive tests for tutorial routes and endpoints * refactor: simplify dependency injection middleware and remove explicit database parameter * test: update session handling of backend testing with improved setup Co-authored-by: Yuta Kobayashi <[email protected]> * test: remove navbar component tests * refactor: reorganize route handling and enforce session validation middleware * docs: add server URL configuration to auth reference in OpenAPI specification * refactor: remove session renaming functionality and simplify session update logic * test: enhance session tests with structured operations and improved setup * refactor: streamline route handling and reintroduce session validation middleware * feat: add middleware for dependency injection and session management * refactor: remove unused socket.io middleware from session module * refactor: update import path for dependency injection middleware * feat: add authentication middleware for session routes * refactor: remove unnecessary console logging statements * docs: add comprehensive testing guidelines for backend development * test: add health check endpoint test for backend status route * test: add comprehensive test suite for admin session management and fix unsuitable db query * test: modify database truncate method to reset identity sequence * test: add comprehensive test suite for admin tutorial management * test: enhance tutorial test assertions with specific expected values * Merge branch 'dev' into vitest-setup * test: remove unnecessary tutorial test assertions * test: setup MSW and enhance frontend testing infrastructure --------- Co-authored-by: Yuta Kobayashi <[email protected]> * chore: remove unused reset-credential command from docker-compose startup script * feat: add CLI commands for user registration and initialization * chore: update GitHub Actions deployment workflows (#125) - Add environment configurations for dev and production deployments - Remove explicit release names in GitHub release creation steps * fix: update GitHub actions to refer OPENAPI_DOCS_URL for build /docs repo (#126) * fix: add OPENAPI_DOCS_URL build argument for Docker and GitHub Actions (#127) - Update Dockerfile and Dockerfile.dev to include OPENAPI_DOCS_URL build argument - Modify GitHub Actions workflows (deploy.yaml and dev_deploy.yaml) to pass OPENAPI_DOCS_URL - Add .env.example in docs package with default OpenAPI documentation URL * Deploy workflow fix 4 (#129) * chore: remove OPENAPI_DOCS_URL references from Docker and GitHub Actions - Remove OPENAPI_DOCS_URL environment variable and build arguments from Dockerfiles - Update GitHub Actions workflows to remove OPENAPI_DOCS_URL configuration - Delete .env.example file in docs package * chore: restore .env.example with OPENAPI_DOCS_URL for docs package * Renovate Updates (#115) * Renovate Updates * chore(deps): update dependency better-auth to v1.1.16 [security] (#130) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update dependency vitest to v3.0.5 [security] (#133) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * fix(deps): update dependency @sentry/node to v8.49.0 [security] (#132) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * fix(deps): update dependency vite to v5.4.12 [security] (#131) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): pin node.js (#136) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * fix(deps): pin dependencies (#137) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: soumame <[email protected]> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * Bugfix 2.0.1 (#144) * chore: update project version to 2.0.1 * fix: make user creation CLI command await role setting Unable to add "admin" role for created user from cli #134 * chore: remove server telemetry configuration file * feat: add session-based WebSocket proxy upgrade handling Implement WebSocket upgrade handling with session-based validation: - Extract sessionId from the request URL - Check if sessionId exists and has a corresponding proxy - Return 404 if session is invalid - Proceed with proxy upgrade for valid sessions Server crashes when Minecraft has connected #135 * Revert "Bugfix 2.0.1 (#144)" (#149) This reverts commit d96f9f7. * Bugfix-2.0.1 (#154) * chore: update project version to 2.0.1 * fix: make user creation CLI command await role setting Unable to add "admin" role for created user from cli #134 * chore: remove server telemetry configuration file * feat: add session-based WebSocket proxy upgrade handling Implement WebSocket upgrade handling with session-based validation: - Extract sessionId from the request URL - Check if sessionId exists and has a corresponding proxy - Return 404 if session is invalid - Proceed with proxy upgrade for valid sessions Server crashes when Minecraft has connected #135 --------- Co-authored-by: Yuta Kobayashi <[email protected]> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate bot added the security label Feb 17, 2025

renovate bot force-pushed the renovate/npm-vite-vulnerability branch from 7f45b31 to 1ac9572 Compare February 17, 2025 09:44

fix(deps): update dependency vite to v5.4.12 [security]

b391a84

renovate bot force-pushed the renovate/npm-vite-vulnerability branch from 2adbe9a to b391a84 Compare February 17, 2025 10:15

soumame merged commit 1f67eab into renovate-pr Feb 17, 2025
3 checks passed

soumame deleted the renovate/npm-vite-vulnerability branch February 17, 2025 10:28

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update dependency vite to v5.4.12 [security] #131

fix(deps): update dependency vite to v5.4.12 [security] #131

renovate bot commented Feb 17, 2025 •

edited

Loading

cloudflare-workers-and-pages bot commented Feb 17, 2025 •

edited

Loading

cloudflare-workers-and-pages bot commented Feb 17, 2025 •

edited

Loading

fix(deps): update dependency vite to v5.4.12 [security] #131

fix(deps): update dependency vite to v5.4.12 [security] #131

Conversation

renovate bot commented Feb 17, 2025 • edited Loading

GitHub Vulnerability Alerts

CVE-2025-24010

Summary

Upgrade Path

Using the backend integration feature

Using a reverse proxy in front of Vite

Accessing the development server via a domain other than localhost or *.localhost

Using a plugin / framework that connects to the WebSocket server on their own from the browser

Mitigation without upgrading Vite

[1]: Permissive default CORS settings

[2]: Lack of validation on the Origin header for WebSocket connections

[3]: Lack of validation on the Host header for HTTP requests

Details

[1]: Permissive default CORS settings

[2]: Lack of validation on the Origin header for WebSocket connections

[3]: Lack of validation on the Host header for HTTP requests

Impact

[1]: Permissive default CORS settings

[2]: Lack of validation on the Origin header for WebSocket connections

[3]: Lack of validation on the Host header for HTTP requests

Related Information

PoC

[2]: Lack of validation on the Origin header for WebSocket connections

Release Notes

v5.4.12

v5.4.11

v5.4.10

Configuration

cloudflare-workers-and-pages bot commented Feb 17, 2025 • edited Loading

Deploying tutoriallm-demo with Cloudflare Pages

cloudflare-workers-and-pages bot commented Feb 17, 2025 • edited Loading

Deploying tutoriallm with Cloudflare Pages

renovate bot commented Feb 17, 2025 •

edited

Loading

Accessing the development server via a domain other than `localhost` or `*.localhost`

`v5.4.12`

`v5.4.11`

`v5.4.10`

cloudflare-workers-and-pages bot commented Feb 17, 2025 •

edited

Loading

cloudflare-workers-and-pages bot commented Feb 17, 2025 •

edited

Loading