Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implementation of basename and matchBase options to not match documentation #89

Open
pskfyi opened this issue Jun 6, 2021 · 1 comment · May be fixed by #106
Open

Implementation of basename and matchBase options to not match documentation #89

pskfyi opened this issue Jun 6, 2021 · 1 comment · May be fixed by #106

Comments

@pskfyi
Copy link

pskfyi commented Jun 6, 2021

The basename option description reads, with my emphasis:

If set, then patterns without slashes will be matched against the basename of the path if it contains slashes. For example, a?b would match the path /xyz/123/acb, but not /xyz/acb/123.

This description appears to be copied from minimatch, however the behavior does not match this description. Enabling the option causes patterns with slashes to also be handled in the same manner as those without slashes.

I've captured the issue with working example here: https://github.com/pskfyi/picomatch-basename-issue

I discovered this when trying to migrate from minimatch to picomatch, and it is inhibiting my ability to migrate cleanly. It seems to me that the docs are wrong, or this is a bug from your perspective, or I am missing something. If this is indeed a bug I'm willing to take a whack at submitting a PR.

@panda2134
Copy link

Confirmed on picomatch v2.3.1.

renovate bot referenced this issue in redwoodjs/redwood Apr 3, 2024
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [vite](https://vitejs.dev)
([source](https://togithub.com/vitejs/vite/tree/HEAD/packages/vite)) |
[`5.1.6` -> `5.1.7`](https://renovatebot.com/diffs/npm/vite/5.1.6/5.1.7)
|
[![age](https://developer.mend.io/api/mc/badges/age/npm/vite/5.1.7?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/vite/5.1.7?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/vite/5.1.6/5.1.7?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vite/5.1.6/5.1.7?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

### GitHub Vulnerability Alerts

####
[GHSA-8jhw-289h-jh2g](https://togithub.com/vitejs/vite/security/advisories/GHSA-8jhw-289h-jh2g)

### Summary
[Vite dev server
option](https://vitejs.dev/config/server-options.html#server-fs-deny)
`server.fs.deny` did not deny requests for patterns with directories. An
example of such a pattern is `/foo/**/*`.

### Impact
Only apps setting a custom `server.fs.deny` that includes a pattern with
directories, and explicitly exposing the Vite dev server to the network
(using `--host` or [`server.host` config
option](https://vitejs.dev/config/server-options.html#server-host)) are
affected.

### Patches
Fixed in [email protected], [email protected], [email protected], [email protected], [email protected],
[email protected]

### Details
`server.fs.deny` uses picomatch with the config of `{ matchBase: true
}`.
[matchBase](https://togithub.com/micromatch/picomatch/blob/master/README.md#options:~:text=Description-,basename,-boolean)
only matches the basename of the file, not the path due to a bug
([https://github.com/micromatch/picomatch/issues/89](https://togithub.com/micromatch/picomatch/issues/89)).
The vite config docs read like you should be able to set fs.deny to glob
with picomatch. Vite also does not set `{ dot: true }` and that causes
[dotfiles not to be
denied](https://togithub.com/micromatch/picomatch/blob/master/README.md#options:~:text=error%20is%20thrown.-,dot,-boolean)
unless they are explicitly defined.

**Reproduction**

Set fs.deny to `['**/.git/**']` and then curl for `/.git/config`.

* with `matchBase: true`, you can get any file under `.git/` (config,
HEAD, etc).
* with `matchBase: false`, you cannot get any file under `.git/`
(config, HEAD, etc).

---

### Release Notes

<details>
<summary>vitejs/vite (vite)</summary>

### [`v5.1.7`](https://togithub.com/vitejs/vite/releases/tag/v5.1.7)

[Compare
Source](https://togithub.com/vitejs/vite/compare/v5.1.6...v5.1.7)

Please refer to
[CHANGELOG.md](https://togithub.com/vitejs/vite/blob/v5.1.7/packages/vite/CHANGELOG.md)
for details.

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/redwoodjs/redwood).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4yNjkuMiIsInVwZGF0ZWRJblZlciI6IjM3LjI2OS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
elevatebart referenced this issue in vue-styleguidist/vue-styleguidist Apr 3, 2024
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [vite](https://vitejs.dev)
([source](https://togithub.com/vitejs/vite/tree/HEAD/packages/vite)) |
[`2.9.17` ->
`2.9.18`](https://renovatebot.com/diffs/npm/vite/2.9.17/2.9.18) |
[![age](https://developer.mend.io/api/mc/badges/age/npm/vite/2.9.18?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/vite/2.9.18?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/vite/2.9.17/2.9.18?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vite/2.9.17/2.9.18?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

---

> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency
Dashboard for more information.

### GitHub Vulnerability Alerts

####
[GHSA-8jhw-289h-jh2g](https://togithub.com/vitejs/vite/security/advisories/GHSA-8jhw-289h-jh2g)

### Summary
[Vite dev server
option](https://vitejs.dev/config/server-options.html#server-fs-deny)
`server.fs.deny` did not deny requests for patterns with directories. An
example of such a pattern is `/foo/**/*`.

### Impact
Only apps setting a custom `server.fs.deny` that includes a pattern with
directories, and explicitly exposing the Vite dev server to the network
(using `--host` or [`server.host` config
option](https://vitejs.dev/config/server-options.html#server-host)) are
affected.

### Patches
Fixed in [email protected], [email protected], [email protected], [email protected], [email protected],
[email protected]

### Details
`server.fs.deny` uses picomatch with the config of `{ matchBase: true
}`.
[matchBase](https://togithub.com/micromatch/picomatch/blob/master/README.md#options:~:text=Description-,basename,-boolean)
only matches the basename of the file, not the path due to a bug
([https://github.com/micromatch/picomatch/issues/89](https://togithub.com/micromatch/picomatch/issues/89)).
The vite config docs read like you should be able to set fs.deny to glob
with picomatch. Vite also does not set `{ dot: true }` and that causes
[dotfiles not to be
denied](https://togithub.com/micromatch/picomatch/blob/master/README.md#options:~:text=error%20is%20thrown.-,dot,-boolean)
unless they are explicitly defined.

**Reproduction**

Set fs.deny to `['**/.git/**']` and then curl for `/.git/config`.

* with `matchBase: true`, you can get any file under `.git/` (config,
HEAD, etc).
* with `matchBase: false`, you cannot get any file under `.git/`
(config, HEAD, etc).

---

### Release Notes

<details>
<summary>vitejs/vite (vite)</summary>

### [`v2.9.18`](https://togithub.com/vitejs/vite/releases/tag/v2.9.18)

[Compare
Source](https://togithub.com/vitejs/vite/compare/v2.9.17...v2.9.18)

Please refer to
[CHANGELOG.md](https://togithub.com/vitejs/vite/blob/v2.9.18/packages/vite/CHANGELOG.md)
for details.

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/vue-styleguidist/vue-styleguidist).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4yNjkuMiIsInVwZGF0ZWRJblZlciI6IjM3LjI2OS4yIiwidGFyZ2V0QnJhbmNoIjoiZGV2In0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
rajsite referenced this issue in ni/nimble Apr 3, 2024
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [vite](https://vitejs.dev)
([source](https://togithub.com/vitejs/vite/tree/HEAD/packages/vite)) |
[`5.1.5` -> `5.1.7`](https://renovatebot.com/diffs/npm/vite/5.1.5/5.1.7)
|
[![age](https://developer.mend.io/api/mc/badges/age/npm/vite/5.1.7?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/vite/5.1.7?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/vite/5.1.5/5.1.7?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vite/5.1.5/5.1.7?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

### GitHub Vulnerability Alerts

####
[GHSA-8jhw-289h-jh2g](https://togithub.com/vitejs/vite/security/advisories/GHSA-8jhw-289h-jh2g)

### Summary
[Vite dev server
option](https://vitejs.dev/config/server-options.html#server-fs-deny)
`server.fs.deny` did not deny requests for patterns with directories. An
example of such a pattern is `/foo/**/*`.

### Impact
Only apps setting a custom `server.fs.deny` that includes a pattern with
directories, and explicitly exposing the Vite dev server to the network
(using `--host` or [`server.host` config
option](https://vitejs.dev/config/server-options.html#server-host)) are
affected.

### Patches
Fixed in [email protected], [email protected], [email protected], [email protected], [email protected],
[email protected]

### Details
`server.fs.deny` uses picomatch with the config of `{ matchBase: true
}`.
[matchBase](https://togithub.com/micromatch/picomatch/blob/master/README.md#options:~:text=Description-,basename,-boolean)
only matches the basename of the file, not the path due to a bug
([https://github.com/micromatch/picomatch/issues/89](https://togithub.com/micromatch/picomatch/issues/89)).
The vite config docs read like you should be able to set fs.deny to glob
with picomatch. Vite also does not set `{ dot: true }` and that causes
[dotfiles not to be
denied](https://togithub.com/micromatch/picomatch/blob/master/README.md#options:~:text=error%20is%20thrown.-,dot,-boolean)
unless they are explicitly defined.

**Reproduction**

Set fs.deny to `['**/.git/**']` and then curl for `/.git/config`.

* with `matchBase: true`, you can get any file under `.git/` (config,
HEAD, etc).
* with `matchBase: false`, you cannot get any file under `.git/`
(config, HEAD, etc).

---

### Release Notes

<details>
<summary>vitejs/vite (vite)</summary>

### [`v5.1.7`](https://togithub.com/vitejs/vite/releases/tag/v5.1.7)

[Compare
Source](https://togithub.com/vitejs/vite/compare/v5.1.6...v5.1.7)

Please refer to
[CHANGELOG.md](https://togithub.com/vitejs/vite/blob/v5.1.7/packages/vite/CHANGELOG.md)
for details.

###
[`v5.1.6`](https://togithub.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small516-2024-03-11-small)

[Compare
Source](https://togithub.com/vitejs/vite/compare/v5.1.5...v5.1.6)

- chore(deps): update all non-major dependencies
([#&#8203;16131](https://togithub.com/vitejs/vite/issues/16131))
([a862ecb](https://togithub.com/vitejs/vite/commit/a862ecb)), closes
[#&#8203;16131](https://togithub.com/vitejs/vite/issues/16131)
- fix: check for publicDir before checking if it is a parent directory
([#&#8203;16046](https://togithub.com/vitejs/vite/issues/16046))
([b6fb323](https://togithub.com/vitejs/vite/commit/b6fb323)), closes
[#&#8203;16046](https://togithub.com/vitejs/vite/issues/16046)
- fix: escape single quote when relative base is used
([#&#8203;16060](https://togithub.com/vitejs/vite/issues/16060))
([8f74ce4](https://togithub.com/vitejs/vite/commit/8f74ce4)), closes
[#&#8203;16060](https://togithub.com/vitejs/vite/issues/16060)
- fix: handle function property extension in namespace import
([#&#8203;16113](https://togithub.com/vitejs/vite/issues/16113))
([f699194](https://togithub.com/vitejs/vite/commit/f699194)), closes
[#&#8203;16113](https://togithub.com/vitejs/vite/issues/16113)
- fix: server middleware mode resolve
([#&#8203;16122](https://togithub.com/vitejs/vite/issues/16122))
([8403546](https://togithub.com/vitejs/vite/commit/8403546)), closes
[#&#8203;16122](https://togithub.com/vitejs/vite/issues/16122)
- fix(esbuild): update tsconfck to fix bug that could cause a deadlock
([#&#8203;16124](https://togithub.com/vitejs/vite/issues/16124))
([fd9de04](https://togithub.com/vitejs/vite/commit/fd9de04)), closes
[#&#8203;16124](https://togithub.com/vitejs/vite/issues/16124)
- fix(worker): hide "The emitted file overwrites" warning if the content
is same ([#&#8203;16094](https://togithub.com/vitejs/vite/issues/16094))
([60dfa9e](https://togithub.com/vitejs/vite/commit/60dfa9e)), closes
[#&#8203;16094](https://togithub.com/vitejs/vite/issues/16094)
- fix(worker): throw error when circular worker import is detected and
support self referencing worker
([eef9da1](https://togithub.com/vitejs/vite/commit/eef9da1)), closes
[#&#8203;16103](https://togithub.com/vitejs/vite/issues/16103)
- style(utils): remove null check
([#&#8203;16112](https://togithub.com/vitejs/vite/issues/16112))
([0d2df52](https://togithub.com/vitejs/vite/commit/0d2df52)), closes
[#&#8203;16112](https://togithub.com/vitejs/vite/issues/16112)
- refactor(runtime): share more code between runtime and main bundle
([#&#8203;16063](https://togithub.com/vitejs/vite/issues/16063))
([93be84e](https://togithub.com/vitejs/vite/commit/93be84e)), closes
[#&#8203;16063](https://togithub.com/vitejs/vite/issues/16063)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log [here](https://developer.mend.io/github/ni/nimble).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4yNjkuMiIsInVwZGF0ZWRJblZlciI6IjM3LjI2OS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
kodiakhq bot referenced this issue in mheob/changeset-changelog Apr 4, 2024
[![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [vite](https://vitejs.dev) ([source](https://togithub.com/vitejs/vite/tree/HEAD/packages/vite)) | [`5.1.4` -> `5.1.7`](https://renovatebot.com/diffs/npm/vite/5.1.4/5.1.7) | [![age](https://developer.mend.io/api/mc/badges/age/npm/vite/5.1.7?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/vite/5.1.7?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/vite/5.1.4/5.1.7?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vite/5.1.4/5.1.7?slim=true)](https://docs.renovatebot.com/merge-confidence/) |

### GitHub Vulnerability Alerts

#### [CVE-2024-31207](https://togithub.com/vitejs/vite/security/advisories/GHSA-8jhw-289h-jh2g)

### Summary
[Vite dev server option](https://vitejs.dev/config/server-options.html#server-fs-deny) `server.fs.deny` did not deny requests for patterns with directories. An example of such a pattern is `/foo/**/*`.

### Impact
Only apps setting a custom `server.fs.deny` that includes a pattern with directories, and explicitly exposing the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) are affected.

### Patches
Fixed in [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]

### Details
`server.fs.deny` uses picomatch with the config of `{ matchBase: true }`. [matchBase](https://togithub.com/micromatch/picomatch/blob/master/README.md#options:~:text=Description-,basename,-boolean) only matches the basename of the file, not the path due to a bug ([https://github.com/micromatch/picomatch/issues/89](https://togithub.com/micromatch/picomatch/issues/89)). The vite config docs read like you should be able to set fs.deny to glob with picomatch. Vite also does not set `{ dot: true }` and that causes [dotfiles not to be denied](https://togithub.com/micromatch/picomatch/blob/master/README.md#options:~:text=error%20is%20thrown.-,dot,-boolean) unless they are explicitly defined.

**Reproduction**

Set fs.deny to `['**/.git/**']` and then curl for `/.git/config`.

* with `matchBase: true`, you can get any file under  `.git/` (config, HEAD, etc).
* with `matchBase: false`, you cannot get any file under  `.git/` (config, HEAD, etc).

---

### Release Notes

<details>
<summary>vitejs/vite (vite)</summary>

### [`v5.1.7`](https://togithub.com/vitejs/vite/releases/tag/v5.1.7)

[Compare Source](https://togithub.com/vitejs/vite/compare/v5.1.6...v5.1.7)

Please refer to [CHANGELOG.md](https://togithub.com/vitejs/vite/blob/v5.1.7/packages/vite/CHANGELOG.md) for details.

### [`v5.1.6`](https://togithub.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small516-2024-03-11-small)

[Compare Source](https://togithub.com/vitejs/vite/compare/v5.1.5...v5.1.6)

-   chore(deps): update all non-major dependencies ([#&#8203;16131](https://togithub.com/vitejs/vite/issues/16131)) ([a862ecb](https://togithub.com/vitejs/vite/commit/a862ecb)), closes [#&#8203;16131](https://togithub.com/vitejs/vite/issues/16131)
-   fix: check for publicDir before checking if it is a parent directory ([#&#8203;16046](https://togithub.com/vitejs/vite/issues/16046)) ([b6fb323](https://togithub.com/vitejs/vite/commit/b6fb323)), closes [#&#8203;16046](https://togithub.com/vitejs/vite/issues/16046)
-   fix: escape single quote when relative base is used ([#&#8203;16060](https://togithub.com/vitejs/vite/issues/16060)) ([8f74ce4](https://togithub.com/vitejs/vite/commit/8f74ce4)), closes [#&#8203;16060](https://togithub.com/vitejs/vite/issues/16060)
-   fix: handle function property extension in namespace import ([#&#8203;16113](https://togithub.com/vitejs/vite/issues/16113)) ([f699194](https://togithub.com/vitejs/vite/commit/f699194)), closes [#&#8203;16113](https://togithub.com/vitejs/vite/issues/16113)
-   fix: server middleware mode resolve ([#&#8203;16122](https://togithub.com/vitejs/vite/issues/16122)) ([8403546](https://togithub.com/vitejs/vite/commit/8403546)), closes [#&#8203;16122](https://togithub.com/vitejs/vite/issues/16122)
-   fix(esbuild): update tsconfck to fix bug that could cause a deadlock  ([#&#8203;16124](https://togithub.com/vitejs/vite/issues/16124)) ([fd9de04](https://togithub.com/vitejs/vite/commit/fd9de04)), closes [#&#8203;16124](https://togithub.com/vitejs/vite/issues/16124)
-   fix(worker): hide "The emitted file overwrites" warning if the content is same ([#&#8203;16094](https://togithub.com/vitejs/vite/issues/16094)) ([60dfa9e](https://togithub.com/vitejs/vite/commit/60dfa9e)), closes [#&#8203;16094](https://togithub.com/vitejs/vite/issues/16094)
-   fix(worker): throw error when circular worker import is detected and support self referencing worker ([eef9da1](https://togithub.com/vitejs/vite/commit/eef9da1)), closes [#&#8203;16103](https://togithub.com/vitejs/vite/issues/16103)
-   style(utils): remove null check ([#&#8203;16112](https://togithub.com/vitejs/vite/issues/16112)) ([0d2df52](https://togithub.com/vitejs/vite/commit/0d2df52)), closes [#&#8203;16112](https://togithub.com/vitejs/vite/issues/16112)
-   refactor(runtime): share more code between runtime and main bundle ([#&#8203;16063](https://togithub.com/vitejs/vite/issues/16063)) ([93be84e](https://togithub.com/vitejs/vite/commit/93be84e)), closes [#&#8203;16063](https://togithub.com/vitejs/vite/issues/16063)

### [`v5.1.5`](https://togithub.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small515-2024-03-04-small)

[Compare Source](https://togithub.com/vitejs/vite/compare/v5.1.4...v5.1.5)

-   fix: `__vite__mapDeps` code injection ([#&#8203;15732](https://togithub.com/vitejs/vite/issues/15732)) ([aff54e1](https://togithub.com/vitejs/vite/commit/aff54e1)), closes [#&#8203;15732](https://togithub.com/vitejs/vite/issues/15732)
-   fix: analysing build chunk without dependencies ([#&#8203;15469](https://togithub.com/vitejs/vite/issues/15469)) ([bd52283](https://togithub.com/vitejs/vite/commit/bd52283)), closes [#&#8203;15469](https://togithub.com/vitejs/vite/issues/15469)
-   fix: import with query with imports field ([#&#8203;16085](https://togithub.com/vitejs/vite/issues/16085)) ([ab823ab](https://togithub.com/vitejs/vite/commit/ab823ab)), closes [#&#8203;16085](https://togithub.com/vitejs/vite/issues/16085)
-   fix: normalize literal-only entry pattern ([#&#8203;16010](https://togithub.com/vitejs/vite/issues/16010)) ([1dccc37](https://togithub.com/vitejs/vite/commit/1dccc37)), closes [#&#8203;16010](https://togithub.com/vitejs/vite/issues/16010)
-   fix: optimizeDeps.entries with literal-only pattern(s) ([#&#8203;15853](https://togithub.com/vitejs/vite/issues/15853)) ([49300b3](https://togithub.com/vitejs/vite/commit/49300b3)), closes [#&#8203;15853](https://togithub.com/vitejs/vite/issues/15853)
-   fix: output correct error for empty import specifier ([#&#8203;16055](https://togithub.com/vitejs/vite/issues/16055)) ([a9112eb](https://togithub.com/vitejs/vite/commit/a9112eb)), closes [#&#8203;16055](https://togithub.com/vitejs/vite/issues/16055)
-   fix: upgrade esbuild to 0.20.x ([#&#8203;16062](https://togithub.com/vitejs/vite/issues/16062)) ([899d9b1](https://togithub.com/vitejs/vite/commit/899d9b1)), closes [#&#8203;16062](https://togithub.com/vitejs/vite/issues/16062)
-   fix(runtime): runtime HMR affects only imported files ([#&#8203;15898](https://togithub.com/vitejs/vite/issues/15898)) ([57463fc](https://togithub.com/vitejs/vite/commit/57463fc)), closes [#&#8203;15898](https://togithub.com/vitejs/vite/issues/15898)
-   fix(scanner): respect  `experimentalDecorators: true` ([#&#8203;15206](https://togithub.com/vitejs/vite/issues/15206)) ([4144781](https://togithub.com/vitejs/vite/commit/4144781)), closes [#&#8203;15206](https://togithub.com/vitejs/vite/issues/15206)
-   revert: "fix: upgrade esbuild to 0.20.x" ([#&#8203;16072](https://togithub.com/vitejs/vite/issues/16072)) ([11cceea](https://togithub.com/vitejs/vite/commit/11cceea)), closes [#&#8203;16072](https://togithub.com/vitejs/vite/issues/16072)
-   refactor: share code with vite runtime ([#&#8203;15907](https://togithub.com/vitejs/vite/issues/15907)) ([b20d542](https://togithub.com/vitejs/vite/commit/b20d542)), closes [#&#8203;15907](https://togithub.com/vitejs/vite/issues/15907)
-   refactor(runtime): use functions from `pathe` ([#&#8203;16061](https://togithub.com/vitejs/vite/issues/16061)) ([aac2ef7](https://togithub.com/vitejs/vite/commit/aac2ef7)), closes [#&#8203;16061](https://togithub.com/vitejs/vite/issues/16061)
-   chore(deps): update all non-major dependencies ([#&#8203;16028](https://togithub.com/vitejs/vite/issues/16028)) ([7cfe80d](https://togithub.com/vitejs/vite/commit/7cfe80d)), closes [#&#8203;16028](https://togithub.com/vitejs/vite/issues/16028)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" in timezone Europe/Berlin, Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/mheob/changeset-changelog).
Brooooooklyn referenced this issue in toeverything/AFFiNE Apr 8, 2024
[![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [vite](https://vitejs.dev) ([source](https://togithub.com/vitejs/vite/tree/HEAD/packages/vite)) | [`5.0.12` -> `5.0.13`](https://renovatebot.com/diffs/npm/vite/5.0.12/5.0.13) | [![age](https://developer.mend.io/api/mc/badges/age/npm/vite/5.0.13?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/vite/5.0.13?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/vite/5.0.12/5.0.13?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vite/5.0.12/5.0.13?slim=true)](https://docs.renovatebot.com/merge-confidence/) |

### GitHub Vulnerability Alerts

#### [CVE-2024-31207](https://togithub.com/vitejs/vite/security/advisories/GHSA-8jhw-289h-jh2g)

### Summary
[Vite dev server option](https://vitejs.dev/config/server-options.html#server-fs-deny) `server.fs.deny` did not deny requests for patterns with directories. An example of such a pattern is `/foo/**/*`.

### Impact
Only apps setting a custom `server.fs.deny` that includes a pattern with directories, and explicitly exposing the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) are affected.

### Patches
Fixed in [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]

### Details
`server.fs.deny` uses picomatch with the config of `{ matchBase: true }`. [matchBase](https://togithub.com/micromatch/picomatch/blob/master/README.md#options:~:text=Description-,basename,-boolean) only matches the basename of the file, not the path due to a bug ([https://github.com/micromatch/picomatch/issues/89](https://togithub.com/micromatch/picomatch/issues/89)). The vite config docs read like you should be able to set fs.deny to glob with picomatch. Vite also does not set `{ dot: true }` and that causes [dotfiles not to be denied](https://togithub.com/micromatch/picomatch/blob/master/README.md#options:~:text=error%20is%20thrown.-,dot,-boolean) unless they are explicitly defined.

**Reproduction**

Set fs.deny to `['**/.git/**']` and then curl for `/.git/config`.

* with `matchBase: true`, you can get any file under  `.git/` (config, HEAD, etc).
* with `matchBase: false`, you cannot get any file under  `.git/` (config, HEAD, etc).

---

### Release Notes

<details>
<summary>vitejs/vite (vite)</summary>

### [`v5.0.13`](https://togithub.com/vitejs/vite/releases/tag/v5.0.13)

[Compare Source](https://togithub.com/vitejs/vite/compare/v5.0.12...v5.0.13)

Please refer to [CHANGELOG.md](https://togithub.com/vitejs/vite/blob/v5.0.13/packages/vite/CHANGELOG.md) for details.

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/toeverything/AFFiNE).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4yNjkuMiIsInVwZGF0ZWRJblZlciI6IjM3LjI2OS4yIiwidGFyZ2V0QnJhbmNoIjoiY2FuYXJ5In0=-->
Brooooooklyn referenced this issue in toeverything/AFFiNE Apr 8, 2024
[![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [vite](https://vitejs.dev) ([source](https://togithub.com/vitejs/vite/tree/HEAD/packages/vite)) | [`5.0.12` -> `5.0.13`](https://renovatebot.com/diffs/npm/vite/5.0.12/5.0.13) | [![age](https://developer.mend.io/api/mc/badges/age/npm/vite/5.0.13?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/vite/5.0.13?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/vite/5.0.12/5.0.13?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vite/5.0.12/5.0.13?slim=true)](https://docs.renovatebot.com/merge-confidence/) |

### GitHub Vulnerability Alerts

#### [CVE-2024-31207](https://togithub.com/vitejs/vite/security/advisories/GHSA-8jhw-289h-jh2g)

### Summary
[Vite dev server option](https://vitejs.dev/config/server-options.html#server-fs-deny) `server.fs.deny` did not deny requests for patterns with directories. An example of such a pattern is `/foo/**/*`.

### Impact
Only apps setting a custom `server.fs.deny` that includes a pattern with directories, and explicitly exposing the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) are affected.

### Patches
Fixed in [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]

### Details
`server.fs.deny` uses picomatch with the config of `{ matchBase: true }`. [matchBase](https://togithub.com/micromatch/picomatch/blob/master/README.md#options:~:text=Description-,basename,-boolean) only matches the basename of the file, not the path due to a bug ([https://github.com/micromatch/picomatch/issues/89](https://togithub.com/micromatch/picomatch/issues/89)). The vite config docs read like you should be able to set fs.deny to glob with picomatch. Vite also does not set `{ dot: true }` and that causes [dotfiles not to be denied](https://togithub.com/micromatch/picomatch/blob/master/README.md#options:~:text=error%20is%20thrown.-,dot,-boolean) unless they are explicitly defined.

**Reproduction**

Set fs.deny to `['**/.git/**']` and then curl for `/.git/config`.

* with `matchBase: true`, you can get any file under  `.git/` (config, HEAD, etc).
* with `matchBase: false`, you cannot get any file under  `.git/` (config, HEAD, etc).

---

### Release Notes

<details>
<summary>vitejs/vite (vite)</summary>

### [`v5.0.13`](https://togithub.com/vitejs/vite/releases/tag/v5.0.13)

[Compare Source](https://togithub.com/vitejs/vite/compare/v5.0.12...v5.0.13)

Please refer to [CHANGELOG.md](https://togithub.com/vitejs/vite/blob/v5.0.13/packages/vite/CHANGELOG.md) for details.

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/toeverything/AFFiNE).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4yNjkuMiIsInVwZGF0ZWRJblZlciI6IjM3LjI2OS4yIiwidGFyZ2V0QnJhbmNoIjoiY2FuYXJ5In0=-->
DeiranLv pushed a commit to DeiranLv/DatZ1000 that referenced this issue May 27, 2024
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [vite](https://vitejs.dev) ([source](https://github.com/vitejs/vite/tree/HEAD/packages/vite)) | devDependencies | patch | [`5.0.12` -> `5.0.13`](https://renovatebot.com/diffs/npm/vite/5.0.12/5.0.13) |

---

### Vite's `server.fs.deny` did not deny requests for patterns with directories.
[GHSA-8jhw-289h-jh2g](GHSA-8jhw-289h-jh2g)

<details>
<summary>More information</summary>

#### Details
##### Summary
[Vite dev server option](https://vitejs.dev/config/server-options.html#server-fs-deny) `server.fs.deny` did not deny requests for patterns with directories. An example of such a pattern is `/foo/**/*`.

##### Impact
Only apps setting a custom `server.fs.deny` that includes a pattern with directories, and explicitly exposing the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) are affected.

##### Patches
Fixed in [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]

##### Details
`server.fs.deny` uses picomatch with the config of `{ matchBase: true }`. [matchBase](https://github.com/micromatch/picomatch/blob/master/README.md#options:~:text=Description-,basename,-boolean) only matches the basename of the file, not the path due to a bug (micromatch/picomatch#89). The vite config docs read like you should be able to set fs.deny to glob with picomatch. Vite also does not set `{ dot: true }` and that causes [dotfiles not to be denied](https://github.com/micromatch/picomatch/blob/master/README.md#options:~:text=error%20is%20thrown.-,dot,-boolean) unless they are explicitly defined.

**Reproduction**

Set fs.deny to `['**/.git/**']` and then curl for `/.git/config`.

* with `matchBase: true`, you can get any file under  `.git/` (config, HEAD, etc).
* with `matchBase: false`, you cannot get any file under  `.git/` (config, HEAD, etc).

#### Severity
- CVSS Score: 5.9 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N`

#### References
- [https://github.com/vitejs/vite/security/advisories/GHSA-8jhw-289h-jh2g](https://github.com/vitejs/vite/security/advisories/GHSA-8jhw-289h-jh2g)
- [https://github.com/vitejs/vite/commit/011bbca350e447d1b499d242804ce62738c12bc0](https://github.com/vitejs/vite/commit/011bbca350e447d1b499d242804ce62738c12bc0)
- [https://github.com/vitejs/vite/commit/5a056dd2fc80dbafed033062fe6aaf4717309f48](https://github.com/vitejs/vite/commit/5a056dd2fc80dbafed033062fe6aaf4717309f48)
- [https://github.com/vitejs/vite/commit/89c7c645f09d16a38f146ef4a1528f218e844d67](https://github.com/vitejs/vite/commit/89c7c645f09d16a38f146ef4a1528f218e844d67)
- [https://github.com/vitejs/vite/commit/96a7f3a41ef2f9351c46f3ab12489bb4efa03cc9](https://github.com/vitejs/vite/commit/96a7f3a41ef2f9351c46f3ab12489bb4efa03cc9)
- [https://github.com/vitejs/vite/commit/ba5269cca81de3f5fbb0f49d58a1c55688043258](https://github.com/vitejs/vite/commit/ba5269cca81de3f5fbb0f49d58a1c55688043258)
- [https://github.com/vitejs/vite/commit/d2db33f7d4b96750b35370c70dd2c35ec3b9b649](https://github.com/vitejs/vite/commit/d2db33f7d4b96750b35370c70dd2c35ec3b9b649)
- [https://github.com/vitejs/vite](https://github.com/vitejs/vite)

This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-8jhw-289h-jh2g) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>vitejs/vite (vite)</summary>

### [`v5.0.13`](https://github.com/vitejs/vite/releases/tag/v5.0.13)

[Compare Source](vitejs/vite@v5.0.12...v5.0.13)

Please refer to [CHANGELOG.md](https://github.com/vitejs/vite/blob/v5.0.13/packages/vite/CHANGELOG.md) for details.

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4xODIuMCIsInVwZGF0ZWRJblZlciI6IjM3LjE4Mi4wIiwidGFyZ2V0QnJhbmNoIjoiZGV2ZWxvcCJ9-->

Reviewed-on: https://git.zzdats.lv/lx/demo/pulls/273
Co-authored-by: Renovate Bot <[email protected]>
Co-committed-by: Renovate Bot <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants