What

vite reaches this repo transitively through vitest, pinned at 4.0.4 since early 2023. osv-scanner reports 18 advisories against that version. A pnpm.overrides pin to the latest 4.x clears 11, including CVE-2025-31125, which CISA added to the Known Exploited Vulnerabilities catalogue on 2026-01-22.

vite advisories:   18 → 7
whole lockfile:    94 → 74
newly introduced:  0

NOT URGENT

0/18 reachable in satori. They're all Vite dev server issues.
— CVE-2025-31125's text reads "Only apps explicitly exposing the Vite dev server to the network (using --host or server.host) are affected."

satori has no vite.config.*, no --host or server.host anywhere, (dev is tsup --watch; playground is Next.js). vite is absent from dependencies.

So: hygiene and scanner surface, not an incident. Worth doing mainly because anyone pointing an SCA scanner at satori currently gets a KEV-flagged hit, and the 4.5.x parser fixes are nice to have regardless.

The one non-obvious change

vite@4.5.14 resolves module ids more strictly than 4.0.4, which surfaces something latent in test/jsx-runtime.test.tsx.

src/jsx/ has no jsx-dev-runtime.ts — only jsx-runtime.ts. The imports field maps both #satori/jsx/jsx-runtime and #satori/jsx/jsx-dev-runtime onto that one file, which is what makes the automatic runtime work. But the test uses a relative @jsxImportSource ../src/jsx, which bypasses the imports map, so the dev variant has nothing to resolve to. (The file's own // TODO: use #satori/jsx as import source after upgradine vitest looks like it's about exactly this.)

Setting esbuild.jsxDev = false keeps the transform on the production runtime. Happy to do it another way if you'd prefer — adding the missing jsx-dev-runtime.ts, or moving the test onto #satori/jsx - I went for lowest touch.

What this deliberately leaves

Seven advisories remain, as none has a fix in the 4.x line: CVE-2025-58751, CVE-2025-58752 (<5.4.20), CVE-2024-52011 (<5.4.9), CVE-2025-62522 (<5.4.21), CVE-2026-39365 (<6.4.2), CVE-2026-53571, CVE-2026-53632 (<6.4.3). Four are Windows-only. Reaching them needs vite ≥ 6.4.3, outside vitest@0.32's peer range — so it means upgrading vitest too. I've put that on a separate branch and opened it as #793, but I don't recommend merging it as-is and that PR explains why. The same non-exploitability applies to all seven.

Verification

• pnpm install / pnpm test / pnpm build:default — all clean; 55 suites, 512 tests
• The 498 image snapshots match with zero rewrites
• Sanity-checked that they're genuinely being compared: corrupting one baseline fails the suite, as it should

Node floor, dependencies, files and the published artefact are unchanged. Since nothing shipped changes I used chore(deps): so it shouldn't cut a release — say the word if you'd rather it were fix:.