[jaredwray]

Please check if the PR fulfills these requirements

• Followed the Contributing guidelines and Code of Conduct
• Tests for the changes have been added (for bug fixes/features) with 100% code coverage.

What kind of change does this PR introduce?

Bug fix. This change moves the vite pin to the patched 7.x release.

Packages

• vite 7.3.5 -> 7.3.7
  • GHSA-587h-7wmj-h5pm / CVE-2026-112942 (High). launch-editor can pass a crafted Windows path to an editor command. Vite 7.3.7 and vite 8.3.3 both include launch-editor 2.14.2.
  • GHSA-rq7h-c2jc-7f22 / CVE-2026-112946 (Moderate). A dev server can serve a host file when a project path matches that file. Vite 7.3.7 and vite 8.3.3 both fix this.
  • GHSA-9jrq-w75r-8gcw / CVE-2026-112945 (Low). Custom middleware can load a cross-origin script. Vite 7.3.7 and vite 8.3.3 both fix this.

The vite dependency on esbuild moves from 0.27.7 to 0.28.2. esbuild 0.28.2 is already in the lockfile. This resolution has no advisory.

Why vite 7.3.7

main still has vite 7.3.5. Vitest 5.0.2 accepts vite 6, vite 7, and vite 8. The peer range selects 7.3.1. The existing override selects the vite version. This change moves that pin from 7.3.5 to 7.3.7.

Vite 7.3.7 is the patched release on the vite 7 line. Vitest already accepts that line. Vite 8 uses rolldown and needs postcss ^8.5.28. The repo pins postcss 8.5.18.

Vite 7.3.7 was published on 2026-10-06. That release is older than 7 days. The cooldown accepts it. This change adds no minimumReleaseAgeExclude entry.

These packages stay on the current versions:

• braces 3.0.3
• http-cache-semantics 4.2.0
• markdown-it 15.0.2

Verification

• pnpm install passed the supply-chain policy.
• pnpm build passed.
• node scripts/test-build.mjs passed.
• pnpm test:ci passed. Each package Biome check passed. Vitest passed with Redis and mock HTTP.

Test audit

The test set is unchanged. This pull request adds no test, changes no test, and deletes no test. The change is a dependency pin. The current tests cover the public packages.

  

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T14:22:40.685597Z	360bd18	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (b8e4f2c) to head (360bd18).

Additional details and impacted files

@@            Coverage Diff            @@
##              main     #1747   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           29        29           
  Lines         3620      3620           
  Branches       812       811    -1     
=========================================
  Hits          3620      3620           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.