The CI Security Audit (npm audit --audit-level=high) started failing on all
new PRs after a critical advisory was published against vitest <4.1.0
(GHSA-5xrq-8626-4rwp — Vitest UI server arbitrary file read/exec). The
remediation chain also requires vite to move off the vulnerable esbuild range.
These are devDependencies (test/build tooling) and do not ship in the
production image, so there was no runtime exposure to deployed users — but the
audit gate blocks the pipeline, so bump them:
- vite ^5.0.11 -> ^8.0.16
- vitest ^3.0.5 -> ^4.1.8
- @vitejs/plugin-react ^4.2.1 -> ^5.2.0 (vite 8 peer compatibility)
Vite 8 ships the rolldown bundler, which requires rollupOptions.output
.manualChunks to be a function rather than an object — converted accordingly,
with explicit precedence so @xyflow/react (whose name contains the substring
"react") lands in the `flow` chunk instead of being pulled into `vendor`.
Verified locally: npm ci, npm run lint, tsc --noEmit, npm run build, and
npm test (vitest 4.1.8, 3/3 passing) all pass; npm audit reports 0
vulnerabilities.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2GT-RichandClaude Opus 4.8