fix(deps): vuln major upgrades — 4 packages (major: 1 · minor: 1 · patch: 2) [single-page-app/ui]

[gh-worker-campaigns-3e9aa4]

Summary: High-severity security update — 6 packages upgraded (MAJOR changes included)

Manifests changed:

• single-page-app/ui (yarn)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
vite	5.4.0	8.0.16	major	Direct	3 HIGH, 20 MEDIUM, 4 LOW
postcss	8.4.41	8.5.15	minor	Transitive	1 MEDIUM
picocolors	1.0.0	1.1.1	minor	Transitive	-
tslib	2.4.0	2.8.1	minor	Transitive	-
picocolors	1.0.0	1.0.1	patch	Transitive	-
tslib	2.4.0	2.4.1	patch	Transitive	-

---

Warning

Major Version Upgrade

This update includes major version changes that may contain breaking changes. Please:

• Review the changelog/release notes for breaking changes
• Test thoroughly in a staging environment
• Update any code that depends on changed APIs
• Ensure all tests pass before merging

Security Details

🚨 Critical & High Severity (3 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In
vite	GHSA-c27g-q93r-2cwf	HIGH	launch-editor vulnerable to command injection via the crafted request on Windows	5.4.0	5.4.9
vite	CVE-2025-31125	high	This package is related to CVE CVE-2025-31125 which was detected by cisa.gov as actively being exploited in the wild	5.4.0	-
vite	GHSA-fx2h-pf6j-xcff	HIGH	vite: server.fs.deny bypass on Windows alternate paths	5.4.0	8.0.16

ℹ️ Other Vulnerabilities (25)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In
postcss	GHSA-qx2v-qp2m-jg93	MODERATE	PostCSS has XSS via Unescaped </style> in its CSS Stringify Output	8.4.41	8.5.10
vite	CVE-2024-45811	MODERATE	server.fs.deny bypassed when using ?import&raw in vite	5.4.0	-
vite	GHSA-vg6x-rcgg-rjx6	MODERATE	Websites were able to send any requests to the development server and read the response in vite	5.4.0	6.0.9
vite	GHSA-xcj6-pq6g-qj4x	MODERATE	Vite allows server.fs.deny to be bypassed with .svg or relative paths	5.4.0	6.2.5
vite	CVE-2025-31486	MODERATE	Vite allows server.fs.deny to be bypassed with .svg or relative paths	5.4.0	-
vite	CVE-2025-32395	MODERATE	Vite has an server.fs.deny bypass with an invalid request-target	5.4.0	-
vite	GHSA-64vr-g452-qvp3	MODERATE	Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS	5.4.0	5.4.6
vite	GHSA-v6wh-96g9-6wx3	MODERATE	launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows	5.4.0	8.0.16
vite	GHSA-4w7w-66w2-5vf9	MODERATE	Vite Vulnerable to Path Traversal in Optimized Deps .map Handling	5.4.0	8.0.5
vite	GHSA-859w-5945-r5v3	MODERATE	Vite's server.fs.deny bypassed with /. for files under project root	5.4.0	6.3.4
vite	GHSA-9cwx-2883-4wfx	MODERATE	Vite's server.fs.deny is bypassed when using ?import&raw	5.4.0	5.4.6
vite	GHSA-356w-63v5-8wf4	MODERATE	Vite has an server.fs.deny bypass with an invalid request-target	5.4.0	6.2.6
vite	CVE-2025-46565	MODERATE	Vite's server.fs.deny bypassed with /. for files under project root	5.4.0	-
vite	CVE-2025-24010	MODERATE	Vite allows any websites to send any requests to the development server and read the response	5.4.0	-
vite	CVE-2025-31125	MODERATE	Vite has a server.fs.deny bypassed for inline and raw with ?import query	5.4.0	-
vite	GHSA-4r4m-qw57-chr8	MODERATE	Vite has a server.fs.deny bypassed for inline and raw with ?import query	5.4.0	6.2.4
vite	CVE-2024-45812	MODERATE	DOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vite	5.4.0	-
vite	GHSA-x574-m823-4x7w	MODERATE	Vite bypasses server.fs.deny when using ?raw??	5.4.0	6.2.3
vite	CVE-2025-30208	MODERATE	Vite bypasses server.fs.deny when using ?raw??	5.4.0	-
vite	GHSA-93m4-6634-74q7	MODERATE	vite allows server.fs.deny bypass via backslash on Windows	5.4.0	7.1.11
vite	CVE-2025-62522	MODERATE	vite allows server.fs.deny bypass via backslash on Windows	5.4.0	-
vite	CVE-2025-58752	LOW	Vite's server.fs settings were not applied to HTML files	5.4.0	-
vite	GHSA-jqfw-vq24-v9c3	LOW	Vite's server.fs settings were not applied to HTML files	5.4.0	7.1.5
vite	CVE-2025-58751	LOW	Vite middleware may serve files starting with the same name with the public directory	5.4.0	-
vite	GHSA-g4jq-h2w9-997c	LOW	Vite middleware may serve files starting with the same name with the public directory	5.4.0	7.1.5

---

Review Checklist

Extra review is recommended for this update:

• Review changes for compatibility with your code
• Check release notes for breaking changes
• Run integration tests to verify service behavior
• Test in staging environment before production
• Monitor key metrics after deployment
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[datadog-official]

✨ Fix all issues with BitsAI

⚠️ Warnings

🚦 2 Pipeline jobs failed

Docs | docs     

Verify | verify     

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: ff6f466 | Docs | Datadog PR Page | Give us feedback!}