[dependabot]

Bumps vite from 6.4.3 to 6.4.5.

Release notes

Sourced from vite's releases.

v6.4.5

Please refer to CHANGELOG.md for details.

v6.4.4

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.4.5 (2026-10-21)

• fix: check server.fs after stripping query as well (#22160) (#23855) (91e40d7), closes #22160 #23855

6.4.4 (2026-10-06)

• fix(deps): update launch-editor to v2.14.2 (#23654) (8afec69), closes #23654
• fix(html): filename passed to transformIndexHtml should not include queries (#23653) (19902cf), closes #23653
• fix(server): check resolved ids for transform access (#20410) (eec6464), closes #20410
• fix(server): store ids to safeModulePaths rather than URLs (#23656) (e570d8d), closes #23656

Commits

• 83ab40b release: v6.4.5
• 91e40d7 fix: check server.fs after stripping query as well (#22160) (#23855)
• 5f0d9a4 release: v6.4.4
• eec6464 fix(server): check resolved ids for transform access (#20410)
• e570d8d fix(server): store ids to safeModulePaths rather than URLs (#23656)
• 8afec69 fix(deps): update launch-editor to v2.14.2 (#23654)
• 19902cf fix(html): filename passed to transformIndexHtml should not include queries (...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[ecc-tools]

ECC Tools / Security Evidence

Commit: f1d459c570831a915a4de094780eb397e5f02602

Security evidence gate passed (success)

No security-sensitive scanner-evidence gap detected.

Mode: enforce

Scanned 2 changed file(s). No missing scanner-evidence signal was detected.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[ecc-tools]

ECC Tools / PR Risk Taxonomy

Commit: f1d459c570831a915a4de094780eb397e5f02602

PR taxonomy review recommended (neutral)

Detected 2 PR taxonomy bucket(s): Install Manifest Integrity, CI/CD Recommendation.

Scanned 2 changed file(s).

Roadmap taxonomy buckets:

Install Manifest Integrity

Install manifests, plugin metadata, and shipped skills should stay synchronized with user-facing setup guidance.

Signals:

• 1 install or manifest path(s) changed

Paths:

• dashboard/package-lock.json

CI/CD Recommendation

CI, dependency, coverage, and contract signals should be routed into follow-up checks or verification work.

Signals:

• 1 CI or workflow path(s) changed

Paths:

• dashboard/package-lock.json

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[ecc-tools]

ECC Tools / Reference Set Readiness

Commit: f1d459c570831a915a4de094780eb397e5f02602

Reference set readiness gaps detected (neutral)

Reference evidence present for 0/7 areas (0%) across 2 changed file(s).

This check is based on files changed in this PR. Repository-level readiness is still reported by /ecc-tools analyze comments and generated manifests.

Area	Status	Evidence / Next Step
Deep analyzer corpus	Missing	Add analyzer fixture, golden, benchmark, or reference-set files that can catch analyzer regressions.
RAG/evaluator comparison	Missing	Add retrieval or evaluator reference-set comparison fixtures with expected ranking behavior.
PR salvage/review corpus	Missing	Add stale-PR, review-thread, reopen-flow, or salvage reference cases for queue cleanup automation.
Discussion triage corpus	Missing	Add public discussion triage fixtures, golden cases, or reference sets for informational, answered, and no-response classifications.
Harness compatibility	Missing	Add cross-harness, adapter-compliance, or harness-audit evidence for Claude, Codex, OpenCode, Zed, dmux, and agent surfaces.
Security evidence	Missing	Attach security evidence such as SBOMs, SARIF, audit reports, or AgentShield evidence packs.
CI failure-mode evidence	Missing	Add captured CI failure logs, dry-run fixtures, or troubleshooting docs for common workflow failure modes.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[ecc-tools]

ECC Tools / Hosted Promotion Readiness

Commit: f1d459c570831a915a4de094780eb397e5f02602

Hosted promotion readiness passed (success)

No hosted promotion evidence gaps detected across 2 changed file(s); 0 corpus scenarios had matching evidence.

This check compares PR file changes against the evaluator/RAG promotion corpus in src/analyzers/fixtures/evaluator-rag-corpus.ts.
Hosted output scoring inspected 0 completed cached hosted job results.

No evaluator corpus scenarios matched this PR.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​vite@​6.4.3 ⏵ 6.4.5		+21	+1

View full report