Security: @vanilla-extract/integration pins esbuild ≤0.24.2 and vite ≤6.4.1 (GHSA-67mh-4wv8-2f99)

[adisapphire]

Summary

@vanilla-extract/integration@6 pins esbuild to versions ≤0.24.2 and brings in vite ≤6.4.1, both flagged by npm audit with security advisories.

Vulnerabilities

Package	Advisory	Severity	Fix version
esbuild ≤0.24.2	GHSA-67mh-4wv8-2f99	Moderate	0.25.0+
vite ≤6.4.1	(via esbuild dependency)	Moderate	6.4.2+

GHSA-67mh-4wv8-2f99: esbuild's dev server allows any website to send requests to it and read the response. Fixed in esbuild@0.25.0.

Impact

Any project using @remix-run/dev@2.x (which pins @vanilla-extract/integration@6) receives these as transitive dependencies with no available fix via npm audit.

Steps to reproduce

npm install @remix-run/dev
npm audit

Expected

@vanilla-extract/integration should upgrade esbuild to >=0.25.0 and vite to >=6.4.2.

Environment

• @vanilla-extract/integration: 6.5.0
• esbuild (nested): 0.21.5
• Node.js: 24