[superagent-security]

Superagent dependency review

Dependency change

Package	Change	Age
vite	8.2.1 → 8.2.4	19 days

Question	Result
Is the update vulnerable or malicious?	✅ No issues found
Is this dependency used?	🛠️ Yes, development/CI only — No direct dependency: vite is installed only as the vitest 4.1.11 peer that every package and app runs through `test` scripts (vitest run), and pnpm-workspace.yaml overrides vite 8.2.0-8.2.3 to 8.2.4. No source imports vite, no vite.config exists, web builds with next and the image runs api/worker on node, so scope is development only.

Why this update matters

The current version's repository impact could not be confirmed. See the candidate assessment and its limitations below.

Issue details

• Current version: GHSA-587h-7wmj-h5pm — Not yet confirmed. No supported repository applicability evidence was provided for this advisory.
• Current version: GHSA-698v-4r3x-3vcv — Not yet confirmed. No supported repository applicability evidence was provided for this advisory.
• Current version: GHSA-9jrq-w75r-8gcw — Not yet confirmed. No supported repository applicability evidence was provided for this advisory.
• Current version: GHSA-r825-w8mm-5pxw — Not yet confirmed. No supported repository applicability evidence was provided for this advisory.
• Current version: GHSA-rq7h-c2jc-7f22 — Not yet confirmed. No supported repository applicability evidence was provided for this advisory.
• Current version: GHSA-vfpm-58rq-9qcg — Not yet confirmed. No supported repository applicability evidence was provided for this advisory.

What we checked

Static review of the shipped npm artifact npm:vite@8.2.4 (sha256 1d132a84f4980b2cbb15e1c1c78728aed90f5eb81c70791ed0cf133a1211139a) against npm:vite@8.2.1. Both tarball trees contain the same 36 regular files (no symlinks, no extra paths) and the extracted trees match their tarballs exactly. 26 files are byte-identical; the 10 differing files (package.json, dist/node/chunks/{node,build,dist,postcss-import}.js, dist/client/{client,bundledDevClient}.mjs, dist/node/{module-runner.js,index.d.ts,module-runner.d.ts}) were compared line-by-line via per-line SHA-256 alignment and were read hunk by hunk. All differences are consistent with the published 8.2.4 release: a version constant injected instead of reading package.json at import time, rolldown/oxc rebuild formatting changes, dependency version strings (postcss ^8.5.26, rolldown ~1.2.4, launch-editor-middleware ^2.14.2, ws ^8.21.3, magic-string ^1.2.0, postcss-import ^16.2.0), and the fixes for the four advisories (cleanUrl in getHtmlFilename and a leading-multiple-slash guard, safeModulePaths storing cleanUrl(resolvedId), wasm-instance access check, Windows short-name path rejection, launch-editor 2.14.2 %/UNC/flag hardening). No new files, no new bundled third-party packages, no new lifecycle or install hooks, no package scripts, no new outbound endpoints or credential access, no encoded/native payloads, no obfuscation and no environment-, time- or platform-gated behaviour were observed. No malware or suspicious behaviour found. The version-renamed bundled copies inside node.js (ws 8.21.3, magic-string 1.2.0, shell-quote 1.12.0, @vercel/detect-agent 1.2.5, postcss-load-config with postcss 8.5.26, launch-editor 2.14.2) were aligned region by region against their base counterparts and every delta read: only upstream-style changes (ws brace reformatting plus a client_max_window_bits comparison fix, magic-string MagicStringError refactor, shell-quote ANSI-C quoting and glob/operator regex updates, launch-editor UNC/'%'/flag hardening). A token scan for eval/new Function/atob/fromCharCode/base64 decoding, os.homedir/.npmrc/token names, http.request/execSync/spawnSync found no unexplained additions, and the package contains no native, WASM or other non-text files.

• vite@8.2.4: reviewed files — done; checked installation — not confirmed; ran the package — not confirmed; compared with the current version — done.
  • Static review only; the package was not installed and no package code was executed (installTested/runtimeTested false).
  • Diffs were reconstructed from helper command output (per-line SHA-256 alignment plus bounded reads), so conclusions rest on hashed line alignment plus full reads of every differing hunk.
  • Bundled third-party copies (launch-editor 2.14.2, ws 8.21.3, shell-quote 1.12.0, magic-string 1.2.0, postcss family) were reviewed as they appear inside dist bundles, not as separate packages.
  • Platform-specific Windows/WSL code paths were reviewed statically only; no Windows runtime was available.
  • Advisory disposition uses the supplied advisory ranges plus observed bundled versions and source lines; it was not verified by running exploits.
    Additional detail was omitted to keep this review readable.

Release notes

v8.2.4

Compare Source

Please refer to CHANGELOG.md for details.

v8.2.2

Compare Source

Please refer to CHANGELOG.md for details.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
openmetal	Ready	Preview	Oct 26, 2026 3:06am UTC

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.