Skip to content

Node warns of esbuild vulnerabilities #4730

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
4 tasks done
DANser-freelancer opened this issue May 3, 2025 · 1 comment
Closed
4 tasks done

Node warns of esbuild vulnerabilities #4730

DANser-freelancer opened this issue May 3, 2025 · 1 comment
Labels
bug: pending triage Maybe a bug, waiting for confirmation

Comments

@DANser-freelancer
Copy link

Describe the bug

Node says I got vulneribilities after installing vitepress v1.6.3.

# npm audit report

esbuild  <=0.24.2
Severity: moderate
esbuild enables any website to send any requests to the development server and read the response - https://github.com/advisories/GHSA-67mh-4wv8-2f99
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/esbuild
  vite  0.11.0 - 6.1.6
  Depends on vulnerable versions of esbuild
  node_modules/vite
    vitepress  0.2.0 - 1.6.3
    Depends on vulnerable versions of vite
    node_modules/vitepress

Reproduction

Install as recommended with npm add -D vitepress.

Expected behavior

I expected to not get vulnerabilities...

System Info

System:
    OS: Windows 11 10.0.26100
    CPU: (12) x64 AMD Ryzen 5 3600 6-Core Processor
    Memory: 19.83 GB / 31.91 GB
  Binaries:
    Node: 23.6.0 - C:\nvm4w\nodejs\node.EXE
    npm: 11.3.0 - C:\nvm4w\nodejs\npm.CMD
  Browsers:
    Edge: Chromium (131.0.2903.70)
    Internet Explorer: 11.0.26100.1882
  npmPackages:
    vitepress: ^1.6.3 => 1.6.3

Additional context

No response

Validations

@DANser-freelancer DANser-freelancer added the bug: pending triage Maybe a bug, waiting for confirmation label May 3, 2025
@brc-dd
Copy link
Member

brc-dd commented May 3, 2025

Ignore it. It doesn't affect vitepress. vitepress and vite don't use esbuild dev server.

@brc-dd brc-dd closed this as not planned Won't fix, can't repro, duplicate, stale May 3, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug: pending triage Maybe a bug, waiting for confirmation
Projects
None yet
Development

No branches or pull requests

2 participants