Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.

...

5 commits
7 files changed
2 contributors

Commits on Apr 7, 2025

chore(deps): lock file maintenance (#383 )

This PR contains the following updates:

| Update | Change |
|---|---|
| lockFileMaintenance | All locks refreshed |

🔧 This Pull Request updates lock files to use the latest dependency
versions.

---

### Configuration

📅 **Schedule**: Branch creation - "before 3am on tuesday" in timezone
Asia/Shanghai, Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/eslint-plugin-oxlint).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yMjcuMyIsInVwZGF0ZWRJblZlciI6IjM5LjIyNy4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate[bot] authored Apr 7, 2025

Commits on Apr 11, 2025

chore(deps): update dependency vite to v6.2.6 [security] (#384 )

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [vite](https://vite.dev)
([source](https://redirect.github.com/vitejs/vite/tree/HEAD/packages/vite))
| [`6.2.5` ->
`6.2.6`](https://renovatebot.com/diffs/npm/vite/6.2.5/6.2.6) |
[![age](https://developer.mend.io/api/mc/badges/age/npm/vite/6.2.6?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/vite/6.2.6?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/vite/6.2.5/6.2.6?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vite/6.2.5/6.2.6?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

### GitHub Vulnerability Alerts

####
[CVE-2025-32395](https://redirect.github.com/vitejs/vite/security/advisories/GHSA-356w-63v5-8wf4)

### Summary
The contents of arbitrary files can be returned to the browser if the
dev server is running on Node or Bun.

### Impact
Only apps with the following conditions are affected.

- explicitly exposing the Vite dev server to the network (using --host
or [server.host config
option](https://vitejs.dev/config/server-options.html#server-host))
- running the Vite dev server on runtimes that are not Deno (e.g. Node,
Bun)

### Details

[HTTP 1.1 spec (RFC 9112) does not allow `#` in
`request-target`](https://datatracker.ietf.org/doc/html/rfc9112#section-3.2).
Although an attacker can send such a request. For those requests with an
invalid `request-line` (it includes `request-target`), the spec
[recommends to reject them with 400 or
301](https://datatracker.ietf.org/doc/html/rfc9112#section-3.2-4). The
same can be said for HTTP 2
([ref1](https://datatracker.ietf.org/doc/html/rfc9113#section-8.3.1-2.4.1),
[ref2](https://datatracker.ietf.org/doc/html/rfc9113#section-8.3.1-3),
[ref3](https://datatracker.ietf.org/doc/html/rfc9113#section-8.1.1-3)).

On Node and Bun, those requests are not rejected internally and is
passed to the user land. For those requests, the value of
[`http.IncomingMessage.url`](https://nodejs.org/docs/latest-v22.x/api/http.html#messageurl)
contains `#`. Vite assumed `req.url` won't contain `#` when checking
`server.fs.deny`, allowing those kinds of requests to bypass the check.

On Deno, those requests are not rejected internally and is passed to the
user land as well. But for those requests, the value of
`http.IncomingMessage.url` did not contain `#`.

### PoC
```
npm create vite@latest
cd vite-project/
npm install
npm run dev
```
send request to read `/etc/passwd`
```
curl --request-target /@&#8203;fs/Users/doggy/Desktop/vite-project/#/../../../../../etc/passwd http://127.0.0.1:5173
```

---

### Release Notes

<details>
<summary>vitejs/vite (vite)</summary>

###
[`v6.2.6`](https://redirect.github.com/vitejs/vite/releases/tag/v6.2.6)

[Compare
Source](https://redirect.github.com/vitejs/vite/compare/v6.2.5...v6.2.6)

Please refer to
[CHANGELOG.md](https://redirect.github.com/vitejs/vite/blob/v6.2.6/packages/vite/CHANGELOG.md)
for details.

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" in timezone Asia/Shanghai,
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/eslint-plugin-oxlint).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yMzguMCIsInVwZGF0ZWRJblZlciI6IjM5LjIzOC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate[bot] authored Apr 11, 2025

Commits on Apr 13, 2025

chore(deps): update dependency pnpm to v10.8.0 (#388 )

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [pnpm](https://pnpm.io)
([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm)) |
`10.7.1` -> `10.8.0` |
[![age](https://developer.mend.io/api/mc/badges/age/npm/pnpm/10.8.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/pnpm/10.8.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/pnpm/10.7.1/10.8.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/pnpm/10.7.1/10.8.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

---

### Release Notes

<details>
<summary>pnpm/pnpm (pnpm)</summary>

###
[`v10.8.0`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1080)

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v10.7.1...v10.8.0)

##### Minor Changes

- **Experimental.** A new hook is supported for updating configuration
settings. The hook can be provided via `.pnpmfile.cjs`. For example:

    ```js
    module.exports = {
      hooks: {
        updateConfig: (config) => ({
          ...config,
          nodeLinker: "hoisted",
        }),
      },
    };
    ```
- Now you can use the `pnpm add` command with the `--config` flag to
install new configurational dependencies
[#&#8203;9377](https://redirect.github.com/pnpm/pnpm/pull/9377).

##### Patch Changes

- Do not hang indefinitely, when there is a glob that starts with `!/`
in `pnpm-workspace.yaml`. This fixes a regression introduced by
[#&#8203;9169](https://redirect.github.com/pnpm/pnpm/pull/9169).
- `pnpm audit --fix` should update the overrides in
`pnpm-workspace.yaml`.
- `pnpm link` should update overrides in `pnpm-workspace.yaml`, not in
`package.json`
[#&#8203;9365](https://redirect.github.com/pnpm/pnpm/pull/9365).

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "before 8am on monday" in timezone
Asia/Shanghai, Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/eslint-plugin-oxlint).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yMzguMCIsInVwZGF0ZWRJblZlciI6IjM5LjIzOC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate[bot] authored Apr 13, 2025

Commits on Apr 14, 2025

release: v0.16.6 (#389 )

oxc-bot authored Apr 14, 2025
Configuration menu
View commit details

Copy full SHA for c37bc37

Browse repository at this point
Copy the full SHA

c37bc37 View commit details

Browse the repository at this point in the history