chore(deps): update dependency vite to v6.4.1 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
vite (source)	6.3.6 -> 6.4.1

GitHub Vulnerability Alerts

CVE-2025-62522

Summary

Files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows.

Impact

Only apps that match the following conditions are affected:

• explicitly exposes the Vite dev server to the network (using --host or server.host config option)
• running the dev server on Windows

Details

server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass by using a back slash(\). The root cause is that fs.readFile('/foo.png/') loads /foo.png.

PoC

npm create vite@latest
cd vite-project/
cat "secret" > .env
npm install
npm run dev
curl --request-target /.env\ http://localhost:5173

---

Release Notes

vitejs/vite (vite)

v6.4.1

Compare Source

Please refer to CHANGELOG.md for details.

v6.4.0

Compare Source

Please refer to CHANGELOG.md for details.

v6.3.7

Compare Source

Please refer to CHANGELOG.md for details.

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[nx-cloud]

View your CI Pipeline Execution ↗ for commit f354d98

Command	Status	Duration	Result
nx affected --targets=test:sherif,test:knip,tes...	✅ Succeeded	1m 5s	View ↗
nx run-many --target=build --exclude=examples/**	✅ Succeeded	14s	View ↗

---

☁️ Nx Cloud last updated this comment at 2025-10-21 06:06:50 UTC

[pkg-pr-new]

@tanstack/angular-store

npm i https://pkg.pr.new/@tanstack/angular-store@249

@tanstack/react-store

npm i https://pkg.pr.new/@tanstack/react-store@249

@tanstack/solid-store

npm i https://pkg.pr.new/@tanstack/solid-store@249

@tanstack/store

npm i https://pkg.pr.new/@tanstack/store@249

@tanstack/svelte-store

npm i https://pkg.pr.new/@tanstack/svelte-store@249

@tanstack/vue-store

npm i https://pkg.pr.new/@tanstack/vue-store@249

commit: f354d98