[cipherstash-agent]

Summary

Patches vite to 7.3.7 in the one lockfile that resolved a vulnerable version.

Advisory	Affected	Fixed in
CVE-2026-112942 / GHSA-587h-7wmj-h5pm	>= 7.0.0, <= 7.3.6	7.3.7
CVE-2026-112943 / GHSA-698v-4r3x-3vcv	>= 7.0.0, <= 7.3.6	7.3.7
CVE-2026-112944 / GHSA-r825-w8mm-5pxw	>= 7.0.0, <= 7.3.6	7.3.7

Dependabot alerts #250, #251 and #252. Linear: CIP-5099.

Change

Lockfile	Before	After
pnpm-lock.yaml	vite 7.3.6	vite 7.3.7

• Raised the existing vite@>=7.0.0 <7.3.5 override in pnpm-workspace.yaml to vite@>=7.0.0 <7.3.7: ~7.3.7. The override stays because vite is only an auto-installed peer (of vitest and @prisma/orm-toolchain), so no manifest declares it.
• pnpm update left the peer on 7.3.6. I re-resolved it by temporarily adding vite@7.3.7 as a root devDependency, then dropping it and re-running a lockfile-only install. package.json is unchanged and the lockfile diff touches only vite entries (the rest is the peer suffix on vitest and prisma entries).
• vite 7.3.7 was published 2026-10-06, so it meets the repo's 7-day minimumReleaseAge. The lockfile-only resolves ran with --config.minimumReleaseAge=0 because pnpm otherwise failed on postcss 8.5.31, already locked and released 2026-10-18. No config was weakened in the diff.

Verification

• deps.py shows pnpm-lock.yaml resolving only 7.3.7 and nothing vulnerable, with no unsupported lockfiles. The evidence gate passed for opened.
• pnpm install --frozen-lockfile --ignore-scripts succeeds.
• Changed files: pnpm-lock.yaml and pnpm-workspace.yaml only.

Not run locally: the test suites (CI runs them). No changeset added: dev-tooling lockfile change only.

---

Generated by Claude Code

Summary by CodeRabbit

• Security
  • Updated security protections for the Vite tooling to address newly identified vulnerabilities.
  • Expanded coverage across affected versions and applied the updated secure version range.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 9de955c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: ebe7250b-3a00-42d0-81bf-b17619fc4633

📥 Commits

Reviewing files that changed from the base of the PR and between d2e4299 and 9de955c.

⛔ Files ignored due to path filters: 1

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing: 1

• pnpm-workspace.yaml

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

📝 Walkthrough

The workspace updates its Vite security override to cover versions below 7.3.7, pin them to ~7.3.7, and include advisories #250–#252.

Changes: Vite security override

Layer / File(s)	Summary
Update Vite override pnpm-workspace.yaml	The override changes from a Windows-specific range below 7.3.5 to a range below 7.3.7. The pinned version changes to ~7.3.7, and the advisory list adds #250–#252.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Suggested reviewers: tobyhede

Merge Risk: ⚪ Minimal · up to 9de95

No concrete current-head merge risk was identified in the dependency update.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the Vite dependency security patch to version 7.3.7.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[cipherstash-agent]

Automated review attestation — source: /code-review medium + company-skills:cross-check-review-findings (cipherstash/skills), run against head 9de955c.

Result: no findings. No critical or blocking issues.

Checked at head:

• pnpm-workspace.yaml:98 — override raised to vite@>=7.0.0 <7.3.7: ~7.3.7, matching the three advisories (fixed in 7.3.7).
• pnpm-lock.yaml — zero 7.3.6 references remain; only vite@7.3.7 entries (base + the two @types/node variants), peer ranges updated to ~7.3.7.
• Diff is confined to pnpm-lock.yaml and pnpm-workspace.yaml; no manifest or config weakened.
• Considered and dropped: the single @vitest/coverage-v8@4.1.11(vitest@4.1.11) snapshot now links the @types/node@22.20.5 vitest variant instead of 26.2.0 (pnpm-lock.yaml:5134). This is pnpm's dedup of one shared peer entry and has no runtime effect, so not a defect.
• Missing changeset (changeset-bot) is expected for a dev-tooling lockfile change.

No existing reviewer feedback to cross-check (no review threads; only bot status comments).

---

Generated by Claude Code