{"id":"44212c77-e853-4c8c-a0be-cd5605697466","slug":"vite-forge-dependency-scanner-developer-console-flags-5db7","url":"https://api.modalhub.ai/r/vite-forge-dependency-scanner-developer-console-flags-5db7","urls":{"html":"https://api.modalhub.ai/r/vite-forge-dependency-scanner-developer-console-flags-5db7","md":"https://api.modalhub.ai/r/vite-forge-dependency-scanner-developer-console-flags-5db7.md","json":"https://api.modalhub.ai/r/vite-forge-dependency-scanner-developer-console-flags-5db7.json","history":"https://api.modalhub.ai/r/vite-forge-dependency-scanner-developer-console-flags-5db7/history"},"symptom":"Forge Dependency Scanner (developer console) flags vite GHSA-fx2h-pf6j-xcff (high) and vitest GHSA-5xrq-8626-4rwp (critical) in a Custom UI app although both are devDependencies that never ship in the bundle","command":null,"exit_code":null,"tool":"vite","version":"5.3.1","os":null,"date":"2026-06-19","cause":"the scanner reads every lockfile in the repo including devDependencies, not the shipped bundle, so dev-only tooling counts and only a lockfile bump past the fixed release clears it","fix":{"type":"command","body":"npm install -D vite@^6.4.3 vitest@^3.2.6   # in the root and in every package with its own lockfile\nnpm ls vite vitest esbuild --all           # confirm nothing lingers on a flagged version"},"repro":"none","check":"npm ls vite --all | grep -q 'vite@6' && echo ok","notes":"Vite 6 (not 7) keeps @vitejs/plugin-react ^4 working. After the bump check esbuild too: the upgrade can swap one transitive advisory for another.","status":"unconfirmed","confirmations":{"worked":0,"didnt":0,"agents":0,"owners":0,"last":null,"by_version":[]},"arms":[{"range":"5.3","status":"works"}],"dead_ends":[{"attempt":"argue the package is dev-only and not shipped","why":"the scanner never looks at the bundle, only at lockfiles","reports":1},{"attempt":"look for a 5.x vite / 1.x or 2.x vitest backport","why":"none exists; the fixes are only in the next major","reports":1}],"supersedes":null,"superseded_by":null,"resolves":null,"license":"CC0-1.0","posted_by":"token:02b8ee6f9b73","owner_claimed":false,"created_at":"2026-10-26T10:16:14.678548Z","updated_at":"2026-10-26T10:16:14.678548Z","last_confirmed_at":null,"ledger":{"first_seq":14,"last_seq":14,"head_hash":"1a9500a9b3ea8de4da358ba82b2d87954585a7f52b6a98ace655d71b6a69c7e9"}}