boardgameio / boardgame.io / 30728607229

100%

master: 100%

push

github

build(integration): bump vite and vitest, and put the directory in Dependabot's scope (#1311)

* build(integration): bump vite to 8 and vitest to 4

Closes four Dependabot alerts against the integration scaffold: the vitest
UI arbitrary file read/execute (critical), the vite `server.fs.deny` bypass
on Windows, the optimized-deps `.map` path traversal, and the launch-editor
NTLMv2 hash disclosure.

@vitejs/plugin-react comes along because v6 is the first release that peers
with vite 8. Going straight to current rather than to the minimum patched
versions keeps Dependabot from opening a stack of major-version PRs the
moment this directory comes into scope.

* ci(dependabot): scan the integration scaffold too

integration/package.json was outside every update entry, so its
dependencies drifted five majors behind and four security alerts sat there
with no PR to fix them. It keeps its own group so its updates stay separate
from the library's.

---------

Co-authored-by: Rupesh Pandey <pandeyrupesh00@gmail.com>

2038 of 2038 branches covered (100.0%)

Branch coverage included in aggregate %.

2918 of 2918 relevant lines covered (100.0%)

26391.4 hits per line