npmpackage.info

Gathering detailed insights and metrics for vite

Other packages similar to vite

@unocss/vite

65.4.2

The Vite plugin for UnoCSS

vite-node

3.0.2

Vite as Node.js runtime

vite-plugin-inspect

10.0.6

Inspect the intermediate state of Vite plugins

vite-plugin-mock

3.0.2

A mock plugin for vite

vite

Next generation frontend tooling. It's fast!

6.0.7

70,043

MIT

TypeScript

2.69 MB

1,084,787,463 5.9

Installations

npm install vite

Developer Guide

BETA

Typescript

Yes

Module System

ESM

Min. Node Version

^18.0.0 || ^20.0.0 || >=22.0.0

Node Version

20.18.1

NPM Version

10.8.2 Score

70.8

Supply Chain

66.8

Quality

96.7

Maintenance

100

Vulnerability

88.5

License

Pull Requests

Open

174

Total

6,593

Closed

1,418

Merged

5,001

Issues

Open

467

Total

7,645

Closed

7,178

Releases

504

v6.0.7

Published on 02 Jan 2025

v6.0.6

Published on 26 Dec 2024

create-vite@6.1.1

Published on 24 Dec 2024

v6.0.5

Published on 20 Dec 2024

v6.0.4

Published on 19 Dec 2024

create-vite@6.1.0

Published on 19 Dec 2024

View all 504 releases

Contributors

1,063

View all 1,063 contributors

Languages

TypeScript

JavaScript

HTML

CSS

Vue

AppleScript

Svelte

SCSS

Less

Stylus

Shell

Pug

Sass

SugarSS

Astro

TypeScript (83.03%)

JavaScript (9.96%)

HTML (5.13%)

CSS (1.31%)

Vue (0.15%)

AppleScript (0.12%)

Svelte (0.11%)

SCSS (0.08%)

Less (0.04%)

Stylus (0.02%)

Shell (0.01%)

Pug (0.01%)

Sass (0.01%)

SugarSS (0.01%)

Developer

vitejs

Download Statistics

Total Downloads

1,084,787,463

Last Day

3,621,146

Last Week

18,653,114

Last Month

60,165,967

Last Year

700,190,809

GitHub Statistics

70,043 Stars

7,438 Commits

6,357 Forks

433 Watching

50 Branches

1,063 Contributors

Sponsor this package

https://github.com/vitejs/vite?sponsor=1

Maintainers

Package Meta Information

Latest Version

6.0.7

Package Id

vite@6.0.7

Unpacked Size

2.69 MB

Size

655.59 kB

File Count

NPM Version

10.8.2

Node Version

20.18.1

Publised On

02 Jan 2025

Total Downloads

Cumulative downloads

Total Downloads

1,084,787,463

Last day

8.9%

3,621,146

Compared to previous day

Last week

14.3%

18,653,114

Compared to previous week

Last month

-19.3%

60,165,967

Compared to previous month

Last year

132.5%

700,190,809

Compared to previous year

Daily Downloads

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

esbuild postcss rollup

Peer Dependencies

@types/node jiti less lightningcss sass sass-embedded stylus sugarss terser tsx yaml

Dev Dependencies

Optional Dependencies

fsevents

Versions

vite ⚡

Next Generation Frontend Tooling

💡 Instant Server Start
⚡️ Lightning Fast HMR
🛠️ Rich Features
📦 Optimized Build
🔩 Universal Plugin Interface
🔑 Fully Typed APIs

Vite (French word for "fast", pronounced /vit/) is a new breed of frontend build tool that significantly improves the frontend development experience. It consists of two major parts:

A dev server that serves your source files over native ES modules, with rich built-in features and astonishingly fast Hot Module Replacement (HMR).
A build command that bundles your code with Rollup, pre-configured to output highly optimized static assets for production.

In addition, Vite is highly extensible via its Plugin API and JavaScript API with full typing support.

Read the Docs to Learn More.

Stable Version

6.0.7

HIGH

8.6/10

Summary

Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service

Affected Versions

>= 3.0.0-alpha.0, < 3.0.0-beta.4

Patched Versions

3.0.0-beta.4

HIGH

8.6/10

Summary

Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service

Affected Versions

< 2.9.13

Patched Versions

2.9.13

HIGH

7.5/10

Summary

Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem

Affected Versions

>= 5.0.0, <= 5.0.11

Patched Versions

5.0.12

HIGH

7.5/10

Summary

Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem

Affected Versions

>= 4.0.0, <= 4.5.1

Patched Versions

4.5.2

HIGH

7.5/10

Summary

Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem

Affected Versions

>= 3.0.0, <= 3.2.7

Patched Versions

3.2.8

HIGH

7.5/10

Summary

Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem

Affected Versions

>= 2.7.0, <= 2.9.16

Patched Versions

2.9.17

HIGH

7.5/10

Summary

Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)

Affected Versions

>= 4.3.0, < 4.3.9

Patched Versions

4.3.9

HIGH

7.5/10

Summary

Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)

Affected Versions

>= 4.2.0, < 4.2.3

Patched Versions

4.2.3

HIGH

7.5/10

Summary

Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)

Affected Versions

>= 4.1.0, < 4.1.5

Patched Versions

4.1.5

HIGH

7.5/10

Summary

Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)

Affected Versions

>= 4.0.0, < 4.0.5

Patched Versions

4.0.5

HIGH

7.5/10

Summary

Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)

Affected Versions

>= 3.0.2, < 3.2.7

Patched Versions

3.2.7

HIGH

7.5/10

Summary

Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)

Affected Versions

< 2.9.16

Patched Versions

2.9.16

MODERATE

5.3/10

Summary

Vite's `server.fs.deny` is bypassed when using `?import&raw`

Affected Versions

>= 5.0.0, <= 5.1.7

Patched Versions

5.1.8

MODERATE

5.3/10

Summary

Vite's `server.fs.deny` is bypassed when using `?import&raw`

Affected Versions

>= 5.2.0, < 5.2.14

Patched Versions

5.2.14

MODERATE

6.4/10

Summary

Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS

Affected Versions

>= 5.0.0, < 5.1.8

Patched Versions

5.1.8

MODERATE

6.4/10

Summary

Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS

Affected Versions

< 3.2.11

Patched Versions

3.2.11

MODERATE

6.4/10

Summary

Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS

Affected Versions

>= 5.2.0, < 5.2.14

Patched Versions

5.2.14

MODERATE

6.4/10

Summary

Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS

Affected Versions

>= 5.3.0, < 5.3.6

Patched Versions

5.3.6

MODERATE

6.4/10

Summary

Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS

Affected Versions

>= 5.4.0, < 5.4.6

Patched Versions

5.4.6

MODERATE

6.4/10

Summary

Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS

Affected Versions

>= 4.0.0, < 4.5.4

Patched Versions

4.5.4

MODERATE

5.3/10

Summary

Vite's `server.fs.deny` is bypassed when using `?import&raw`

Affected Versions

<= 3.2.10

Patched Versions

3.2.11

MODERATE

5.3/10

Summary

Vite's `server.fs.deny` is bypassed when using `?import&raw`

Affected Versions

>= 4.0.0, <= 4.5.3

Patched Versions

4.5.4

MODERATE

5.3/10

Summary

Vite's `server.fs.deny` is bypassed when using `?import&raw`

Affected Versions

>= 5.3.0, <= 5.3.5

Patched Versions

5.3.6

MODERATE

5.3/10

Summary

Vite's `server.fs.deny` is bypassed when using `?import&raw`

Affected Versions

>= 5.4.0, <= 5.4.5

Patched Versions

5.4.6

MODERATE

5.9/10

Summary

Vite's `server.fs.deny` did not deny requests for patterns with directories.

Affected Versions

>= 5.2.0, <= 5.2.5

Patched Versions

5.2.6

MODERATE

5.9/10

Summary

Vite's `server.fs.deny` did not deny requests for patterns with directories.

Affected Versions

>= 5.1.0, <= 5.1.6

Patched Versions

5.1.7

MODERATE

5.9/10

Summary

Vite's `server.fs.deny` did not deny requests for patterns with directories.

Affected Versions

>= 5.0.0, <= 5.0.12

Patched Versions

5.0.13

MODERATE

5.9/10

Summary

Vite's `server.fs.deny` did not deny requests for patterns with directories.

Affected Versions

>= 4.0.0, <= 4.5.2

Patched Versions

4.5.3

MODERATE

5.9/10

Summary

Vite's `server.fs.deny` did not deny requests for patterns with directories.

Affected Versions

>= 3.0.0, <= 3.2.8

Patched Versions

3.2.10

MODERATE

5.9/10

Summary

Vite's `server.fs.deny` did not deny requests for patterns with directories.

Affected Versions

>= 2.7.0, <= 2.9.17

Patched Versions

2.9.18

MODERATE

6.1/10

Summary

Vite XSS vulnerability in `server.transformIndexHtml` via URL payload

Affected Versions

>= 5.0.0, < 5.0.5

Patched Versions

5.0.5

MODERATE

6.1/10

Summary

Vite XSS vulnerability in `server.transformIndexHtml` via URL payload

Affected Versions

= 4.5.0

Patched Versions

4.5.1

MODERATE

6.1/10

Summary

Vite XSS vulnerability in `server.transformIndexHtml` via URL payload

Affected Versions

>= 4.4.0, < 4.4.12

Patched Versions

4.4.12

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

Maintained

Determines if the project is "actively maintained".

10

License

Determines if the project has defined a license.

10

Security-Policy

Determines if the project has published a security policy.

9

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

8

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

7

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

Reason

dependency not pinned by hash detected -- score normalized to 0

Details

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:153: update your workflow using https://app.stepsecurity.io/secureworkflow/vitejs/vite/ci.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:156: update your workflow using https://app.stepsecurity.io/secureworkflow/vitejs/vite/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:159: update your workflow using https://app.stepsecurity.io/secureworkflow/vitejs/vite/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/vitejs/vite/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:80: update your workflow using https://app.stepsecurity.io/secureworkflow/vitejs/vite/ci.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:83: update your workflow using https://app.stepsecurity.io/secureworkflow/vitejs/vite/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:86: update your workflow using https://app.stepsecurity.io/secureworkflow/vitejs/vite/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:109: update your workflow using https://app.stepsecurity.io/secureworkflow/vitejs/vite/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ecosystem-ci-trigger.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/vitejs/vite/ecosystem-ci-trigger.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ecosystem-ci-trigger.yml:54: update your workflow using https://app.stepsecurity.io/secureworkflow/vitejs/vite/ecosystem-ci-trigger.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ecosystem-ci-trigger.yml:73: update your workflow using https://app.stepsecurity.io/secureworkflow/vitejs/vite/ecosystem-ci-trigger.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/ecosystem-ci-trigger.yml:97: update your workflow using https://app.stepsecurity.io/secureworkflow/vitejs/vite/ecosystem-ci-trigger.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ecosystem-ci-trigger.yml:105: update your workflow using https://app.stepsecurity.io/secureworkflow/vitejs/vite/ecosystem-ci-trigger.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ecosystem-ci-trigger.yml:124: update your workflow using https://app.stepsecurity.io/secureworkflow/vitejs/vite/ecosystem-ci-trigger.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ecosystem-ci-trigger.yml:191: update your workflow using https://app.stepsecurity.io/secureworkflow/vitejs/vite/ecosystem-ci-trigger.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ecosystem-ci-trigger.yml:210: update your workflow using https://app.stepsecurity.io/secureworkflow/vitejs/vite/ecosystem-ci-trigger.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/issue-close-require.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/vitejs/vite/issue-close-require.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/issue-labeled.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/vitejs/vite/issue-labeled.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/issue-labeled.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/vitejs/vite/issue-labeled.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/issue-labeled.yml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/vitejs/vite/issue-labeled.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/issue-labeled.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/vitejs/vite/issue-labeled.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/lock-closed-issues.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/vitejs/vite/lock-closed-issues.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/preview-release.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/vitejs/vite/preview-release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/preview-release.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/vitejs/vite/preview-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/vitejs/vite/publish.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/vitejs/vite/publish.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/vitejs/vite/publish.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-tag.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/vitejs/vite/release-tag.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-tag.yml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/vitejs/vite/release-tag.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/semantic-pull-request.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/vitejs/vite/semantic-pull-request.yml/main?enable=pin
Warn: downloadThenRun not pinned by hash: .github/workflows/ci.yml:185
Info: 0 out of 17 GitHub-owned GitHubAction dependencies pinned
Info: 1 out of 14 third-party GitHubAction dependencies pinned
Info: 0 out of 1 downloadThenRun dependencies pinned

0

Fuzzing

Determines if the project uses fuzzing.

0

SAST

Determines if the project uses static code analysis.

Score

5.9

/10

Last Scanned on 2025-01-06

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More