fix(security): raise vite 8.x floor to >=8.0.16 across scenario workspaces

[langwatch-agent]

Floors the vite 8.x line to >=8.0.16 across the workspaces whose locks had landed on a vulnerable 8.0.x (docs 8.0.10, javascript 8.0.14, template 8.0.10). The existing overrides only floored the 6.x (docs) and 7.x (javascript) lines, leaving the 8.x alerts open. Resolves to 8.1.0 (the current 8.x; the consumer ranges are ^8, and 8.1.0 is past the 8.0.15 vulnerable ceiling).

Alerts resolved

• HIGH vite >=8.0.0 <=8.0.15 -> 8.0.16: fix(security): patch langchain serialization injection vulnerability #420 (docs), feat(voice): Gemini Live interruption end-to-end (judge inconclusive on truncated reply transcripts) #446 (javascript), fix(security): patch flatted prototype pollution via parse() #421 (template pnpm), chore(deps): remove unused nanoid-cli devDep from vitest examples #422 (template npm)
• MODERATE vite (same range): fix(security): upgrade aiohttp to fix zip bomb and other CVEs #417, chore(deps): bump gitpython from 3.1.49 to 3.1.50 in /python #447, fix(security): patch react-router XSS and open redirect CVEs #418, fix(security): patch vite server.fs.deny bypass and WebSocket file read CVEs #419

Changes

• docs/pnpm-workspace.yaml, javascript/package.json (pnpm.overrides), template/package.json (npm + pnpm overrides): added vite@>=8.0.0 <8.0.16 -> >=8.0.16. Template direct dep vite ^8.0.10 -> ^8.0.16.
• Locks regenerated; the only non-vite additions are vite 8.1.0's rolldown bundler subtree (rolldown/@rolldown/@oxc/@emnapi/tinyglobby). No unrelated drift.

Verification

• javascript: tsc --noEmit clean, tsup build clean, 150 unit tests pass on vite 8.1.0.
• pnpm install --frozen-lockfile clean in docs/javascript/template; npm ci clean for the template.
• scenario has no cooldown; no committed policy touched.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 099bc23b-7adf-4c5e-b108-7715107cc07b

📥 Commits

Reviewing files that changed from the base of the PR and between 0e12e59 and 98839cf.

⛔ Files ignored due to path filters (4)

• docs/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
• javascript/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
• python/examples/lovable_clone/template/package-lock.json is excluded by !**/package-lock.json
• python/examples/lovable_clone/template/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (3)

• docs/pnpm-workspace.yaml
• javascript/package.json
• python/examples/lovable_clone/template/package.json

---

Walkthrough

The PR updates Vite version constraints in the docs workspace, JavaScript package, and Python example template. The template also bumps its Vite devDependency to ^8.0.16 and adds matching override rules.

Changes

Vite override alignment

Layer / File(s)	Summary
Shared workspace overrides docs/pnpm-workspace.yaml, javascript/package.json	Both manifests add or update the vite@>=8.0.0 <8.0.16 override to resolve to >=8.0.16.
Example template package python/examples/lovable_clone/template/package.json	The template bumps the Vite devDependency to ^8.0.16 and adds matching override rules in both overrides and pnpm.overrides.

Suggested reviewers

• sergioestebance

Poem

I nibbled the Vite carrots bright,
And nudged the versions up just right.
Workspace hops, templates align,
Now every manifest's in line. 🐇
Thump-thump!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly states the main change: raising the Vite 8.x floor across scenario workspaces for security.
Description check	✅ Passed	The description matches the changeset and accurately summarizes the Vite override and dependency updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch security/scenario-vite-8.0.16

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Automated low-risk assessment

This PR was evaluated against the repository's Low-Risk Pull Requests procedure and does not qualify as low risk.

This PR's diff could not be evaluated automatically: Diff too large for automated evaluation (102041 chars exceeds 100000-char limit). Manual review required.

This PR requires a manual review before merging.

[langwatch-agent]

CI is green across the board (typecheck, tsup build, vitest, frozen installs, template npm ci). Ready for human review and merge.