[brionmario]

Purpose

GHSA-587h-7wmj-h5pm (published 2026-10-21) lets launch-editor's fs.existsSync() existence check be bypassed on Windows. pnpm audit --audit-level=high now reports it for launch-editor and vite, so the Security Audit job fails on main and on every pull request (for example #127).

Package	Locked	Patched	Reached through
vite 6.x	6.4.3	6.4.4	@nuxt/test-utils, playgrounds/react
vite 7.x	7.3.6	7.3.7	nuxt > @nuxt/vite-builder
vite 8.x	8.2.1	8.2.4	@thunderid/eslint-plugin > @vitest/eslint-plugin > vitest
launch-editor	2.14.1	2.14.2	@nuxt/devtools

Approach

Following the repository's advisory workflow, try the update first and fall back to a pin:

• Updated: pnpm update -r --depth Infinity vite launch-editor moves vite 6 and 7 and launch-editor onto their patched releases, all within the ranges their parents already declare. It also raises playgrounds/react's vite floor to ^6.4.4.
• Pinned: the vite 8 line is the version pnpm auto-installs for vitest's peer range. vitest already permits 8.2.4, but pnpm keeps the peer at the locked 8.2.1 through pnpm update and pnpm dedupe. Updating it explicitly instead rewrote the React playground's range to a new major. So pnpm-workspace.yaml pins vite@8: 8.2.4 with a justification that says when to drop it, matching the existing brace-expansion@5 style pins.

Version changes in the lockfile: only vite, launch-editor, and rolldown 1.2.3 → 1.2.14 with its platform bindings and @oxc-project/types, which vite 8.2.4 requires.

Verified locally:

• Audit: pnpm audit --audit-level=high passes; only the advisories the workspace already ignores remain.
• CI-equivalent checks: pnpm install --frozen-lockfile, pnpm build (14/14), pnpm format:check, pnpm test, and the PR builder's lint all pass.
• Not run: the full pnpm lint across packages/ already fails on main (packages/express no-unsafe-* errors) and isn't part of CI.

Related Issues

• N/A

Related PRs

• Add the remaining playgrounds, fix the SDK issues they surfaced, and move the Better Auth sample #127 (blocked by this audit failure)

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified.
• Documentation provided. (Add links if there are any)
• Tests provided. (Add links if there are any)
  • Unit Tests
  • Integration Tests
• Breaking changes. (Fill if applicable)
  • Breaking changes section filled.
  • breaking change label added.
• Cross-SDK parity. Exactly one of parity/prs-raised or parity/prs-not-needed added.
  • If parity/prs-raised, the port links are posted as a reply on the parity check's comment.

Security checks

• Followed secure coding standards.
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Repository: thunder-id/javascript-sdks/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3d7e7bb7-385a-4224-a502-d53766b7c5f0

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[brionmario]

Folded into #127, which now carries the vite and launch-editor update for GHSA-587h-7wmj-h5pm.