[marcusrbrown]

Raises the vite override floor from >=8.0.16 to >=8.3.3 for GHSA-587h-7wmj-h5pm. The advisory is rated HIGH and affects the launch-editor code bundled in vite. The vulnerable vite ranges are >=8.0.0 <=8.1.5, >=8.2.0 <=8.2.3 and >=8.3.0 <=8.3.2. A floor of 8.3.3 is the lowest one that excludes all three. We were on vite@8.0.16, so check:override-floors failed Lint on every PR and on main.

bun.lock now resolves vite to 8.3.4, published 2026-10-08, which is past the 3-day release-age floor. Everything else that moved belongs to vite's own dependency tree:

• rolldown 1.0.3 → 1.2.14, plus its platform bindings
• lightningcss 1.32.0 → 1.33.0
• @oxc-project/types 0.133.0 → 0.154.0

No other package changed.

[fro-bot]

Verdict: CONDITIONAL

The locked vite@8.3.4 is patched, but the new override does not exclude every known vulnerable release.

Blocking issues

• P2 — package.json:53: exclude the vulnerable later minor lines. >=8.1.6 also permits 8.2.0–8.2.3 and 8.3.0–8.3.2, which GHSA-587h-7wmj-h5pm explicitly marks vulnerable to Windows command injection. Raise the override to >=8.3.3 and synchronize bun.lock’s override entry. The current lockfile is safe; the defect is in the persistent resolution constraint. check:override-floors audits locked versions, not the override range, so its passing result does not establish that this constraint excludes affected versions. This follows the range-safety guidance in dependency-holds-need-lift-conditions.

Non-blocking concerns

None

Missing tests

None. This changes dependency metadata rather than application behavior. The audit gate and all 43 existing override-floor tests passed; a semver probe confirmed the vulnerable versions remain allowed. Vite’s registry integrity matches the lockfile, its MIT license is compatible, and Node 24 satisfies its engine requirement. The full suite was not run.

Risk assessment (MED)

The installed version is unaffected and the standing audit gate provides protection, but the security override still admits known vulnerable versions.

---

Run Summary

Field	Value
Event	pull_request
Repository	fro-bot/.github
Run ID	39522933196
Cache	hit
Session	ses_ea416810bffe4fj709S1Zfwzhg

[fro-bot]

Verdict: PASS

The prior blocker is resolved: package.json and bun.lock now agree on vite >=8.3.3, excluding all affected 8.x ranges in GHSA-587h-7wmj-h5pm. The lockfile retains patched vite@8.3.4. This satisfies the range-safety check documented in dependency-holds-need-lift-conditions.

Blocking issues

None

Non-blocking concerns

None

Missing tests

None. Dependency metadata only; no new application behavior requires tests. Revalidation passed the audit gate, all 43 override-floor tests, and semver checks proving the override does not intersect any affected 8.x range. The full suite was not run.

Risk assessment (LOW)

The security constraint and resolved version are both patched. The follow-up changes only the two override entries; previously reviewed transitive updates are unchanged.

---

Run Summary

Field	Value
Event	pull_request
Repository	fro-bot/.github
Run ID	39523369734
Cache	hit
Session	ses_ea416810bffe4fj709S1Zfwzhg