vite dependency has high severity security vulnerability

[brianlenz]

• Component or Package Name: jsx-email
• Component or Package Version: 3.2.1

Expected Behavior / Situation

Transitive dependencies are free from vulnerabilities.

Actual Behavior / Situation

vite 8.0.10 is vulnerable:
GHSA-fx2h-pf6j-xcff

Modification Proposal

Upgrade vite to 8.0.16 (ideally with semver ^8.0.16 or ~8.0.16).

[shellscape]

It's a development time dependency. Are you going to attack yourself?

Please do not open these kinds of issues. Package managers are more than capable of handling these updates silently.

[brianlenz]

@shellscape I'm sorry if opening this upset you. I fully realize I can force the package manager to use unaffected versions, so truly just trying to help the ecosystem and project. I don't understand the strong response 🤷‍♂️ I'd be happy to open a PR if it helps. I'd just need guidance on how you'd like it done.

FWIW, the react-router-dom version being used also exposes seven vulnerabilities. I would have opened an issue for those, too, but I'm not sure now how you'd want to handle those.

Also, I see both vite and react-router-dom as dependencies, not devDependencies?

[shellscape]

It didn't upset me, I didn't say it did. Perhaps you're a bit too sensitive to plain language?

If you'd like to open a PR, feel free.

Also, I see both vite and react-router-dom as dependencies, not devDependencies?

Yes, due to how they're used. jsx-email is a development tool. When someone installs it, they need to have all of the dependencies to use all of the functionality. The preview functionality uses vite, hence it's a dep and not a devDep.

[brianlenz]

@shellscape #461 🙏