fix: patch Vite arbitrary file read vulnerability (GHSA-p9ff-h696-f583) #28

Unbounded version range for security override

The new override uses >=6.4.2, which is unbounded above and will automatically resolve to any future major version of Vite (e.g. 7.x, 8.x). The other overrides in this file use caret ranges (^7.5.11, ^7.24.3) which restrict resolution to the same major version, preventing accidental adoption of breaking changes. ^6.4.2 would be the safer and more consistent choice here — it still satisfies the vulnerability fix while staying within the v6 series that is already tested with this project.

    "vite": "^6.4.2"

Prompt To Fix With AI

This is a comment left during a code review.
Path: package.json
Line: 54

Comment:
**Unbounded version range for security override**

The new override uses `>=6.4.2`, which is unbounded above and will automatically resolve to any future major version of Vite (e.g. 7.x, 8.x). The other overrides in this file use caret ranges (`^7.5.11`, `^7.24.3`) which restrict resolution to the same major version, preventing accidental adoption of breaking changes. `^6.4.2` would be the safer and more consistent choice here — it still satisfies the vulnerability fix while staying within the v6 series that is already tested with this project.

```suggestion
    "vite": "^6.4.2"
```

How can I resolve this? If you propose a fix, please make it concise.

<a href="#"><img alt="P2" src="https://greptile-static-assets.s3.amazonaws.com/badges/p2.svg?v=7" align="top"></a> **Unbounded version range for security override** The new override uses `>=6.4.2`, which is unbounded above and will automatically resolve to any future major version of Vite (e.g. 7.x, 8.x). The other overrides in this file use caret ranges (`^7.5.11`, `^7.24.3`) which restrict resolution to the same major version, preventing accidental adoption of breaking changes. `^6.4.2` would be the safer and more consistent choice here — it still satisfies the vulnerability fix while staying within the v6 series that is already tested with this project. ```suggestion "vite": "^6.4.2" ``` <details><summary>Prompt To Fix With AI</summary> `````markdown This is a comment left during a code review. Path: package.json Line: 54 Comment: **Unbounded version range for security override** The new override uses `>=6.4.2`, which is unbounded above and will automatically resolve to any future major version of Vite (e.g. 7.x, 8.x). The other overrides in this file use caret ranges (`^7.5.11`, `^7.24.3`) which restrict resolution to the same major version, preventing accidental adoption of breaking changes. `^6.4.2` would be the safer and more consistent choice here — it still satisfies the vulnerability fix while staying within the v6 series that is already tested with this project. ```suggestion "vite": "^6.4.2" ``` How can I resolve this? If you propose a fix, please make it concise. ````` </details>

@@ -50,6 +50,7 @@
   },
   "overrides": {
     "tar": "^7.5.11",
     "undici": "^7.24.3"
     "undici": "^7.24.3",
     "vite": ">=6.4.2"
   }
 }