fix(deps): vuln major upgrades — 5 packages (major: 1 · minor: 1 · patch: 3) [CTFd/themes/core-beta]

[gh-worker-campaigns-3e9aa4]

Summary: High-severity security update — 8 packages upgraded (MAJOR changes included)

Manifests changed:

• CTFd/themes/core-beta (yarn)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
vite	3.0.5	8.0.16	major	Direct	6 HIGH, 21 MEDIUM, 4 LOW
postcss	8.4.12	8.5.15	minor	Transitive	3 MEDIUM
picocolors	1.0.0	1.1.1	minor	Transitive	-
source-map-js	1.0.2	1.2.1	minor	Transitive	-
tslib	2.3.0	2.8.1	minor	Transitive	-
picocolors	1.0.0	1.0.1	patch	Transitive	-
source-map-js	1.0.2	1.0.3	patch	Transitive	-
tslib	2.3.0	2.3.1	patch	Transitive	-

---

Warning

Major Version Upgrade

This update includes major version changes that may contain breaking changes. Please:

• Review the changelog/release notes for breaking changes
• Test thoroughly in a staging environment
• Update any code that depends on changed APIs
• Ensure all tests pass before merging

Security Details

🚨 Critical & High Severity (6 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In
vite	GHSA-c27g-q93r-2cwf	HIGH	launch-editor vulnerable to command injection via the crafted request on Windows	3.0.5	5.4.9
vite	CVE-2024-23331	HIGH	Vite dev server option server.fs.deny can be bypassed when hosted on case-insensitive filesystem	3.0.5	-
vite	GHSA-c24v-8rfc-w8vw	HIGH	Vite dev server option server.fs.deny can be bypassed when hosted on case-insensitive filesystem	3.0.5	2.9.17
vite	CVE-2025-31125	high	This package is related to CVE CVE-2025-31125 which was detected by cisa.gov as actively being exploited in the wild	3.0.5	-
vite	GHSA-353f-5xf4-qw67	HIGH	Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)	3.0.5	2.9.16
vite	CVE-2023-34092	HIGH	Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)	3.0.5	-

ℹ️ Other Vulnerabilities (28)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In
postcss	CVE-2023-44270	MODERATE	-	8.4.12	-
postcss	GHSA-7fh5-64p2-3v2j	MODERATE	PostCSS line return parsing error	8.4.12	8.4.31
postcss	GHSA-qx2v-qp2m-jg93	MODERATE	PostCSS has XSS via Unescaped </style> in its CSS Stringify Output	8.4.12	8.5.10
vite	GHSA-x574-m823-4x7w	MODERATE	Vite bypasses server.fs.deny when using ?raw??	3.0.5	6.2.3
vite	CVE-2024-45812	MODERATE	DOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vite	3.0.5	-
vite	GHSA-356w-63v5-8wf4	MODERATE	Vite has an server.fs.deny bypass with an invalid request-target	3.0.5	6.2.6
vite	CVE-2025-32395	MODERATE	Vite has an server.fs.deny bypass with an invalid request-target	3.0.5	-
vite	GHSA-9cwx-2883-4wfx	MODERATE	Vite's server.fs.deny is bypassed when using ?import&raw	3.0.5	5.4.6
vite	CVE-2024-45811	MODERATE	server.fs.deny bypassed when using ?import&raw in vite	3.0.5	-
vite	GHSA-4w7w-66w2-5vf9	MODERATE	Vite Vulnerable to Path Traversal in Optimized Deps .map Handling	3.0.5	8.0.5
vite	GHSA-93m4-6634-74q7	MODERATE	vite allows server.fs.deny bypass via backslash on Windows	3.0.5	7.1.11
vite	CVE-2025-30208	MODERATE	Vite bypasses server.fs.deny when using ?raw??	3.0.5	-
vite	GHSA-xcj6-pq6g-qj4x	MODERATE	Vite allows server.fs.deny to be bypassed with .svg or relative paths	3.0.5	6.2.5
vite	CVE-2025-31486	MODERATE	Vite allows server.fs.deny to be bypassed with .svg or relative paths	3.0.5	-
vite	GHSA-4r4m-qw57-chr8	MODERATE	Vite has a server.fs.deny bypassed for inline and raw with ?import query	3.0.5	6.2.4
vite	CVE-2025-31125	MODERATE	Vite has a server.fs.deny bypassed for inline and raw with ?import query	3.0.5	-
vite	CVE-2025-62522	MODERATE	vite allows server.fs.deny bypass via backslash on Windows	3.0.5	-
vite	GHSA-859w-5945-r5v3	MODERATE	Vite's server.fs.deny bypassed with /. for files under project root	3.0.5	6.3.4
vite	CVE-2025-46565	MODERATE	Vite's server.fs.deny bypassed with /. for files under project root	3.0.5	-
vite	GHSA-8jhw-289h-jh2g	MODERATE	Vite's server.fs.deny did not deny requests for patterns with directories.	3.0.5	2.9.18
vite	CVE-2024-31207	MODERATE	Vite's server.fs.deny did not deny requests for patterns with directories	3.0.5	-
vite	GHSA-64vr-g452-qvp3	MODERATE	Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS	3.0.5	5.4.6
vite	CVE-2025-24010	MODERATE	Vite allows any websites to send any requests to the development server and read the response	3.0.5	-
vite	GHSA-vg6x-rcgg-rjx6	MODERATE	Websites were able to send any requests to the development server and read the response in vite	3.0.5	6.0.9
vite	CVE-2025-58751	LOW	Vite middleware may serve files starting with the same name with the public directory	3.0.5	-
vite	GHSA-g4jq-h2w9-997c	LOW	Vite middleware may serve files starting with the same name with the public directory	3.0.5	7.1.5
vite	CVE-2025-58752	LOW	Vite's server.fs settings were not applied to HTML files	3.0.5	-
vite	GHSA-jqfw-vq24-v9c3	LOW	Vite's server.fs settings were not applied to HTML files	3.0.5	7.1.5

---

Review Checklist

Extra review is recommended for this update:

• Review changes for compatibility with your code
• Check release notes for breaking changes
• Run integration tests to verify service behavior
• Test in staging environment before production
• Monitor key metrics after deployment
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System