chore(security): upgrade vite to patch vulnerabilities

[Kan-A-Pesh]

Summary

PATCH upgrades

vite: 6.0.0 (lockfile: 6.4.1) -> 6.4.2

This is a patch upgrade within the 6.x series. Vite 6.4.2 fixes multiple security vulnerabilities that affected the 6.0.x series.

Vulnerabilities fixed (multiples GHSA Vite 2025/2026):

• Vite has had several CVEs/GHSAs in 2025-2026 affecting the dev server and build pipeline
• Upgrading to 6.4.2 (latest stable in 6.x series) covers all known fixes for this series
• References: multiples GHSA Vite 2025/2026 (see https://github.com/vitejs/vite/security/advisories)

Risk/breaking: Upgrading within 6.x is non-breaking per semver. No API changes expected. The lockfile resolved 6.4.1 previously; 6.4.2 is a direct patch.

CVE/GHSA fixed

• vite: multiples GHSA Vite 2025/2026 (dev server path traversal, source map exposure, and related issues)

Commands run

# Detected PM: npm (package-lock.json present)
npm install --package-lock-only --ignore-scripts

Check results

No lint/typecheck/format scripts present in package.json (only: dev, build, preview, tauri, prepare). No checks to run per task instructions.

Lockfile verified: vite resolves to 6.4.2 after update.

Risks / breaking changes

• PATCH within 6.x series - expected non-breaking
• No other dependencies modified
• Tauri desktop app framework compatibility: vite 6.x is the supported series for @tauri-apps/cli ^2.x and @tailwindcss/vite ^4.x — no compatibility issues expected

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
loqui	Ready	Preview, Comment	May 22, 2026 7:00pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a4005c65-5bbb-429a-a2e6-1852e39ffca4

📥 Commits

Reviewing files that changed from the base of the PR and between ae023fb and 825694f.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

---

Walkthrough

The PR updates the Vite devDependency to a newer patch version in package.json, upgrading from ^6.0.0 to ^6.4.2.

Changes

Dependency Updates

Layer / File(s)	Summary
Update Vite devDependency package.json	Vite devDependency version constraint is bumped from ^6.0.0 to ^6.4.2.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~1 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'chore(security): upgrade vite to patch vulnerabilities' accurately describes the main change—a security-focused patch upgrade of Vite.
Description check	✅ Passed	The description is comprehensive and directly related to the changeset, providing clear details about the Vite upgrade, vulnerabilities fixed, and compatibility considerations.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/security-dependency-upgrades-2026-05-22

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​vite@​6.4.1 ⏵ 6.4.2	+1	+18	+1

View full report

[cubic-dev-ai]

No issues found across 2 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Auto-approved: This PR only upgrades the Vite dev dependency from 6.0.0 to 6.4.2 (a patch within the 6.x series) to fix security vulnerabilities, with no source code changes and a low blast radius.

Re-trigger cubic</sub>