Upgrade to VitePress 2.x to clear remaining vite/esbuild advisories (blocked on 2.0 stable)

[dnndev]

Remaining dev-toolchain advisories — blocked on VitePress 2.x

After npm audit fix (commit 751523d) cleared 10 of 13 toolchain vulns on v.5.x, 3 remain, all in one chain and all fixAvailable: false:

Package	Severity	Advisory (summary)
vite	high	Path traversal in optimized-deps .map handling; server.fs.deny bypass on Windows; launch-editor NTLM hash disclosure
esbuild	moderate	Dev server allows any website to send requests and read the response
vitepress	moderate	Inherited via its vite dependency

Why they can't be fixed on VitePress 1.x

vitepress@1.6.4 (current latest) pins Vite 5. The patched Vite line is 7.x, and only VitePress 2.x depends on Vite ^7.3.1. So the only real fix is a VitePress major upgrade.

VitePress 2.x status (checked 2026-07-06)

• Alpha only. npm dist-tag: latest = 1.6.4, next = 2.0.0-alpha.17 (last alpha released 2026-03-19 — no newer alpha since). Not production-ready.
• VitePress 2 depends on Vite ^7.3.1 (resolves the esbuild/vite advisories).
• Node: Vite 7 requires Node 20.19+ / 22.12+. Local dev is on Node 24 — fine.
• Per the VitePress changelog/migration notes, the 2.x upgrade is largely non-breaking for content — "for most users no change is required"; the main friction is TypeScript type mismatches with third-party plugins. Our config is a single .vitepress/config.mts with no third-party VitePress plugins, so risk is low.

Risk assessment (why deferring is acceptable)

All 3 are dev/build-time only. The deployed docs are static HTML — none of these packages run for a site visitor. The realistic attack surface is a developer running vitepress dev while simultaneously visiting a malicious page. For a docs build, that's negligible.

Recommendation

Defer until VitePress 2.0 reaches stable (or a late beta/RC). When it does:

1. npm i vitepress@^2 (+ align Vue if needed).
2. Run docs:build + help:build smoke tests.
3. Skim .vitepress/config.mts against the 2.x migration notes (removed/renamed options).
4. Re-run npm audit to confirm the 3 clear.

Until then, these are known, accepted, dev-only. Revisit at GA and again when 2.0 stabilizes.

Filed during GA-prep security triage. Related: the 5 original Dependabot alerts were VuePress-branch stale (4 dismissed, js-yaml fixed in 91ee05c).