chore(deps): update dependency vite-plugin-static-copy to v3.1.2 [security]

[renovate]

Coming soon: The Renovate bot (GitHub App) will be renamed to Mend. PRs from Renovate will soon appear from 'Mend'. Learn more here.

This PR contains the following updates:

Package	Change	Age	Confidence
vite-plugin-static-copy	3.0.0 -> 3.1.2

GitHub Vulnerability Alerts

CVE-2025-57753

Summary

Files not included in src was possible to access with a crafted request.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Arbitrary files can be disclosed by exploiting this vulnerability.

Details

Consider the following configuration in used by vite.config.ts:

import { defineConfig } from 'vite'
import { viteStaticCopy } from 'vite-plugin-static-copy'

export default defineConfig({
    plugins: [
      viteStaticCopy({
        targets: [
          {
            src: "./public/images",
            dest: "./",
          },
        ],
      }),
    ],
  });

The files under the ./public/images is only expected to be served. Abusing this vulnerability, an attacker can access arbitrary files on the filesystem.

PoC

I've attached a demo app to showcase the bug.

Run it with npm run dev and issue the following HTTP request

GET /static/images/../../../../../../../etc/passwd HTTP/1.1
Host: localhost:3001
Content-Length: 2

OR

curl --path-as-is -i -s -k -X $'GET' \
    -H $'Host: localhost:3001' -H $'Content-Length: 2' \
    --data-binary $'\x0d\x0a' \
    $'http://localhost:3001/static/images/../../../../../../../etc/passwd'

Observe that the /etc/passwd file is included in the response.

---

Release Notes

sapphi-red/vite-plugin-static-copy (vite-plugin-static-copy)

v3.1.2

Compare Source

Patch Changes

• #​195 0bc6b49 Thanks @​sapphi-red! - Files not included in src was possible to acess with a crafted request. See GHSA-pp7p-q8fx-2968 for more details.

v3.1.1

Compare Source

Patch Changes

• #​186 fc84156 Thanks @​sapphi-red! - fix a bug that the content was not sent when multiple vite-plugin-static-copy instance was used

v3.1.0

Compare Source

Minor Changes

• #​171 9c7cf2e Thanks @​MrRefactoring! - add Vite 7 to peer dep range

v3.0.2

Compare Source

Patch Changes

• #​167 89458b2 Thanks @​sapphi-red! - improved file grouping algorithm for better performance

v3.0.1

Compare Source

Patch Changes

• #​166 60409c5 Thanks @​sapphi-red! - fix absolute destination paths in copy targets incorrectly returning contents in dev

• #​164 337f976 Thanks @​sapphi-red! - fixes case-insensitive path conflicts causing copy failures (EEXIST error)

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

PR-Codex overview

This PR updates several dependencies in the yarn.lock file, including new versions for chokidar, fdir, picomatch, tinyglobby, and vite-plugin-static-copy. It also modifies some checksums and peer dependencies to ensure compatibility with the latest versions.

Detailed summary

• Added chokidar@3.6.0
• Updated fdir from 6.4.4 to 6.5.0
• Updated picomatch to 4.0.3
• Updated tinyglobby from 0.2.13 to 0.2.14
• Updated vite-plugin-static-copy from 3.0.0 to 3.1.2
• Adjusted peer dependencies for vite to include ^7.0.0

✨ Ask PR-Codex anything about this PR by commenting with /codex {your question}

[netlify]

✅ Deploy Preview for kleros-v2-neo canceled.

Name	Link
🔨 Latest commit	bc256a1
🔍 Latest deploy log	https://app.netlify.com/projects/kleros-v2-neo/deploys/68caa398259e310008639f90

[netlify]

❌ Deploy Preview for kleros-v2-university failed. Why did it fail? →

Name	Link
🔨 Latest commit	01a38f6
🔍 Latest deploy log	https://app.netlify.com/projects/kleros-v2-university/deploys/68c9a433fa4a780008fe97a2

[netlify]

✅ Deploy Preview for kleros-v2-testnet canceled.

Name	Link
🔨 Latest commit	bc256a1
🔍 Latest deploy log	https://app.netlify.com/projects/kleros-v2-testnet/deploys/68caa398be1464000861f4d8

[coderabbitai]

Important

Review skipped

Ignore keyword(s) in the title.

⛔ Ignored keywords (1)

• chore(deps):

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[netlify]

✅ Deploy Preview for kleros-v2-testnet-devtools canceled.

Name	Link
🔨 Latest commit	bc256a1
🔍 Latest deploy log	https://app.netlify.com/projects/kleros-v2-testnet-devtools/deploys/68caa3982d2cda00088fbe4d

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud