chore(onda-12.2): bump vite 5 → 6.4.2 — npm audit ZERADO 🎉 by adm01-debug · Pull Request #206 · adm01-debug/Promo_Gifts

adm01-debug · 2026-05-14T21:55:56Z

🎯 Objetivo

Subir vite de 5.4.19 → 6.4.2 para fechar as 2 últimas vulnerabilidades do npm audit.

🔒 Vulnerabilidades fechadas

Severidade	Package	CVE	Status
moderate	esbuild (transitive)	GHSA-67mh-4wv8-2f99	✅ Fechado em esbuild 0.25
moderate	vite (DIRECT)	GHSA-4w7w-66w2-5vf9 (path traversal)	✅ Fechado em vite 6.0.5+

Resultado: npm audit total: 2 moderate → 0 (ZERADO) 🎉

✅ Validações locais

npm install: Exit 0 (8s, apenas 2 packages removed + 1 changed)
vite instalado: 6.4.2 ✅
esbuild instalado: 0.25.12 (era 0.21.5) ✅
npm audit: 0 vulnerabilidades (era 2 moderate)
typecheck (tsc --noEmit -p tsconfig.app.json): ZERO REGRESSÃO
- main (vite@5): 1262 erros TS baseline
- branch (vite@6): 1262 erros TS — idênticos (todos pré-existentes do baseline)
npm run build: ✓ built in 1m 21s, sem erros, todos chunks gerados corretamente

🧩 Compatibilidade verificada

Dep	Versão	Suporta vite@6?
`@vitejs/plugin-react-swc`	^4.3.0	✅ peer `vite ^4 \|\| ^5 \|\| ^6 \|\| ^7`
`vitest`	^3.2.4	✅ Sem peer com vite
`lovable-tagger`	^1.1.13	✅ peer `vite >=5 <9`
`rollup`	^4.59.0	✅ Compatível
`rollup-plugin-visualizer`	^7.0.1	✅ Compatível

🔍 Cenários adversos simulados

Simulei 15+ cenários de quebra ANTES do upgrade. Todos verdes:

✅ manualChunks API mantida
✅ esbuild { pure, drop } config mantido (B-1.1)
✅ resolve.alias mantido
✅ resolve.conditions default mudou mas não afeta nossos imports
✅ tailwind/postcss continua funcionando (build OK)
✅ import.meta.env em 27 arquivos continua funcionando
✅ Vercel: auto-detecta vite version, sem vercel.json

📊 Impacto

2 arquivos: package.json (+1/-1), package-lock.json (rebuild)
Bundle size: sem variação significativa
Build time: 1m 21s (similar a vite@5)
Zero arquivos .ts/.tsx modificados

🎯 Próximas ondas

✅ Onda 12.2 (este PR): vite 5 → 6, npm audit ZERADO
⏭️ Onda 12.3 (OPCIONAL): vite 6 → 7 (modernização, não necessária para audit zerado)
⏭️ Onda 13: B-3 RLS overly-permissive — 6 policies pendentes
⏭️ Bloco C: SSRF allowlist, zod consolidation, token revocation, etc

📚 Ref

Onda 12.2 do plano de hardening pré-prod
docs/AUDITORIA-PROFUNDA-PROMOGIFTS-PRE-PROD.md
Commit: 4bc7dd687
Sub-onda anterior: chore(onda-12.1): bump jsdom 20 → 29 (fecha 3 vulns NPM) #205 (jsdom 20→29)

Summary by cubic

Upgrade vite from 5.4.19 to 6.4.2 to close the last two npm audit issues (path traversal in vite and a transitive esbuild advisory). npm audit now shows 0 vulnerabilities; build and typecheck results are unchanged.

Dependencies
- Bumped vite to ^6.4.2; engines now ^18 || ^20 || >=22 (compatible with our setup).
- Transitive esbuild updated to 0.25.x; both advisories resolved.
- Updated package-lock.json; no .ts/.tsx changes.
- Peer checks OK: @vitejs/plugin-react-swc@^4, vitest@^3, lovable-tagger@^1.1.13, rollup@^4.
- Local checks: install OK, typecheck baseline unchanged, npm run build succeeds, npm audit → 0.

^{Written for commit 4bc7dd6. Summary will update on new commits.}

Summary by CodeRabbit

Chores
- Atualizada a dependência de desenvolvimento Vite para a versão 6.4.2, trazendo melhorias de performance e compatibilidade.

…dit ZERADO) Vite 5.4.19 → 6.4.2 fecha as 2 últimas vulnerabilidades: - esbuild GHSA-67mh-4wv8-2f99 (moderate, transitive) — fechado em esbuild 0.25 - vite GHSA-4w7w-66w2-5vf9 path traversal (moderate, direct) — fechado em vite 6.0.5+ npm audit: 2 moderate → 0 (TOTAL ZERADO) 🎉 Validações locais: - vite 6.4.2 instalado - esbuild 0.25.12 (era 0.21.5) - typecheck: zero regressão (1262 erros baseline === 1262 erros pós-upgrade) - npm run build: ✓ built in 1m 21s, sem erros, todos chunks gerados Compatibilidade verificada: - @vitejs/plugin-react-swc@4 (peer vite ^4..^7) ✅ - vitest@3 ✅ - lovable-tagger@1.1.13 (peer vite >=5 <9) ✅ - rollup@4 ✅ Ref: Onda 12.2 / docs/AUDITORIA-PROFUNDA-PROMOGIFTS-PRE-PROD.md

vercel · 2026-05-14T21:56:01Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
promo-gifts	Ready	Preview, Comment	May 14, 2026 9:56pm

supabase · 2026-05-14T21:56:02Z

This pull request has been ignored for the connected project doufsxqlfjyuvxuezpln because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

coderabbitai · 2026-05-14T21:56:09Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 9c553eb9-1dba-4f83-bc42-a55dbf7c034d

📥 Commits

Reviewing files that changed from the base of the PR and between 55285ce and 4bc7dd6.

⛔ Files ignored due to path filters (1)

package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json

📒 Files selected for processing (1)

package.json

Walkthrough

Atualização isolada da dependência de desenvolvimento Vite de versão 5.4.19 para 6.4.2. Mudança unitária em devDependencies do package.json, sem alterações visíveis em scripts, configurações ou outras dependências do projeto.

Changes

Atualização Vite v5 → v6

Layer / File(s)	Summary
Atualização de versão do Vite `package.json`	Versão do Vite em `devDependencies` atualizada de `^5.4.19` para `^6.4.2`. Trata-se de um bump de versão maior. É recomendado verificar se há breaking changes documentadas entre v5 e v6 que exijam ajustes em vite.config.ts ou em scripts de build.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~5 minutos

Nota: Esta é uma mudança simples, mas a transição Vite v5 → v6 é uma versão maior. Recomenda-se validar se a build funciona corretamente pós-merge e se não há breaking changes críticas que afetem dev experience ou produção. Verifique também se há incompatibilidades com plugins ou ferramentas relacionadas.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	O título está totalmente relacionado à mudança principal: bumpar vite de 5 para 6.4.2, resolvendo 2 vulnerabilidades críticas.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch hardening/onda-12-2-vite-6

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Copilot

Pull request overview

Updates the project’s Vite toolchain from 5.x to 6.4.2 to address remaining audit findings tied to Vite/esbuild while keeping source code unchanged.

Changes:

Bumps vite in package.json from ^5.4.19 to ^6.4.2.
Refreshes package-lock.json to resolve Vite 6 dependencies, including esbuild@0.25.x.
Removes the old nested Vite/esbuild 0.21.x lockfile entries.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
`package.json`	Updates the direct Vite dev dependency.
`package-lock.json`	Reflects the resolved Vite 6 dependency graph and removal of obsolete nested esbuild packages.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

cubic-dev-ai

No issues found across 2 files

Copilot AI review requested due to automatic review settings May 14, 2026 21:55

Copilot started reviewing on behalf of adm01-debug May 14, 2026 21:56 View session

Copilot AI reviewed May 14, 2026

View reviewed changes

cubic-dev-ai Bot reviewed May 14, 2026

View reviewed changes

adm01-debug merged commit a609d06 into main May 14, 2026
24 of 27 checks passed

adm01-debug deleted the hardening/onda-12-2-vite-6 branch May 14, 2026 22:48

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(onda-12.2): bump vite 5 → 6.4.2 — npm audit ZERADO 🎉#206

chore(onda-12.2): bump vite 5 → 6.4.2 — npm audit ZERADO 🎉#206
adm01-debug merged 1 commit into
mainfrom
hardening/onda-12-2-vite-6

adm01-debug commented May 14, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

vercel Bot commented May 14, 2026

Uh oh!

supabase Bot commented May 14, 2026

Uh oh!

coderabbitai Bot commented May 14, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

adm01-debug commented May 14, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🎯 Objetivo

🔒 Vulnerabilidades fechadas

✅ Validações locais

🧩 Compatibilidade verificada

🔍 Cenários adversos simulados

📊 Impacto

🎯 Próximas ondas

📚 Ref

Summary by cubic

Summary by CodeRabbit

Uh oh!

vercel Bot commented May 14, 2026

Uh oh!

supabase Bot commented May 14, 2026

Uh oh!

coderabbitai Bot commented May 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

adm01-debug commented May 14, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented May 14, 2026 •

edited

Loading