chore(deps): update dependency vite to v6.1.6 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
vite (source)	6.0.1 -> 6.1.6

GitHub Vulnerability Alerts

CVE-2025-24010

Summary

Vite allowed any websites to send any requests to the development server and read the response due to default CORS settings and lack of validation on the Origin header for WebSocket connections.

Warning

This vulnerability even applies to users that only run the Vite dev server on the local machine and does not expose the dev server to the network.

Upgrade Path

Users that does not match either of the following conditions should be able to upgrade to a newer version of Vite that fixes the vulnerability without any additional configuration.

• Using the backend integration feature
• Using a reverse proxy in front of Vite
• Accessing the development server via a domain other than localhost or *.localhost
• Using a plugin / framework that connects to the WebSocket server on their own from the browser

Using the backend integration feature

If you are using the backend integration feature and not setting server.origin, you need to add the origin of the backend server to the server.cors.origin option. Make sure to set a specific origin rather than *, otherwise any origin can access your development server.

Using a reverse proxy in front of Vite

If you are using a reverse proxy in front of Vite and sending requests to Vite with a hostname other than localhost or *.localhost, you need to add the hostname to the new server.allowedHosts option. For example, if the reverse proxy is sending requests to http://vite:5173, you need to add vite to the server.allowedHosts option.

Accessing the development server via a domain other than localhost or *.localhost

You need to add the hostname to the new server.allowedHosts option. For example, if you are accessing the development server via http://foo.example.com:8080, you need to add foo.example.com to the server.allowedHosts option.

Using a plugin / framework that connects to the WebSocket server on their own from the browser

If you are using a plugin / framework, try upgrading to a newer version of Vite that fixes the vulnerability. If the WebSocket connection appears not to be working, the plugin / framework may have a code that connects to the WebSocket server on their own from the browser.

In that case, you can either:

• fix the plugin / framework code to the make it compatible with the new version of Vite
• set legacy.skipWebSocketTokenCheck: true to opt-out the fix for [2] while the plugin / framework is incompatible with the new version of Vite
  • When enabling this option, make sure that you are aware of the security implications described in the impact section of [2] above.

Mitigation without upgrading Vite

[1]: Permissive default CORS settings

Set server.cors to false or limit server.cors.origin to trusted origins.

[2]: Lack of validation on the Origin header for WebSocket connections

There aren't any mitigations for this.

[3]: Lack of validation on the Host header for HTTP requests

Use Chrome 94+ or use HTTPS for the development server.

Details

There are three causes that allowed malicious websites to send any requests to the development server:

[1]: Permissive default CORS settings

Vite sets the Access-Control-Allow-Origin header depending on server.cors option. The default value was true which sets Access-Control-Allow-Origin: *. This allows websites on any origin to fetch contents served on the development server.

Attack scenario:

1. The attacker serves a malicious web page (http://malicious.example.com).
2. The user accesses the malicious web page.
3. The attacker sends a fetch('http://127.0.0.1:5173/main.js') request by JS in that malicious web page. This request is normally blocked by same-origin policy, but that's not the case for the reasons above.
4. The attacker gets the content of http://127.0.0.1:5173/main.js.

[2]: Lack of validation on the Origin header for WebSocket connections

Vite starts a WebSocket server to handle HMR and other functionalities. This WebSocket server did not perform validation on the Origin header and was vulnerable to Cross-Site WebSocket Hijacking (CSWSH) attacks. With that attack, an attacker can read and write messages on the WebSocket connection. Vite only sends some information over the WebSocket connection (list of the file paths that changed, the file content where the errored happened, etc.), but plugins can send arbitrary messages and may include more sensitive information.

Attack scenario:

1. The attacker serves a malicious web page (http://malicious.example.com).
2. The user accesses the malicious web page.
3. The attacker runs new WebSocket('http://127.0.0.1:5173', 'vite-hmr') by JS in that malicious web page.
4. The user edits some files.
5. Vite sends some HMR messages over WebSocket.
6. The attacker gets the content of the HMR messages.

[3]: Lack of validation on the Host header for HTTP requests

Unless server.https is set, Vite starts the development server on HTTP. Non-HTTPS servers are vulnerable to DNS rebinding attacks without validation on the Host header. But Vite did not perform validation on the Host header. By exploiting this vulnerability, an attacker can send arbitrary requests to the development server bypassing the same-origin policy.

1. The attacker serves a malicious web page that is served on HTTP (http://malicious.example.com:5173) (HTTPS won't work).
2. The user accesses the malicious web page.
3. The attacker changes the DNS to point to 127.0.0.1 (or other private addresses).
4. The attacker sends a fetch('/main.js') request by JS in that malicious web page.
5. The attacker gets the content of http://127.0.0.1:5173/main.js bypassing the same origin policy.

Impact

[1]: Permissive default CORS settings

Users with the default server.cors option may:

• get the source code stolen by malicious websites
• give the attacker access to functionalities that are not supposed to be exposed externally
  • Vite core does not have any functionality that causes changes somewhere else when receiving a request, but plugins may implement those functionalities and servers behind server.proxy may have those functionalities.

[2]: Lack of validation on the Origin header for WebSocket connections

All users may get the file paths of the files that changed and the file content where the error happened be stolen by malicious websites.

For users that is using a plugin that sends messages over WebSocket, that content may be stolen by malicious websites.

For users that is using a plugin that has a functionality that is triggered by messages over WebSocket, that functionality may be exploited by malicious websites.

[3]: Lack of validation on the Host header for HTTP requests

Users using HTTP for the development server and using a browser that is not Chrome 94+ may:

• get the source code stolen by malicious websites
• give the attacker access to functionalities that are not supposed to be exposed externally
  • Vite core does not have any functionality that causes changes somewhere else when receiving a request, but plugins may implement those functionalities and servers behind server.proxy may have those functionalities.

Chrome 94+ users are not affected for [3], because sending a request to a private network page from public non-HTTPS page is forbidden since Chrome 94.

Related Information

Safari has a bug that blocks requests to loopback addresses from HTTPS origins. This means when the user is using Safari and Vite is listening on lookback addresses, there's another condition of "the malicious web page is served on HTTP" to make [1] and [2] to work.

PoC

[2]: Lack of validation on the Origin header for WebSocket connections

1. I used the react template which utilizes HMR functionality.

npm create vite@latest my-vue-app-react -- --template react

2. Then on a malicious server, serve the following POC html:

<!doctype html>
<html lang="en">
    <head>
        <meta charset="utf-8" />
        <title>vite CSWSH</title>
    </head>
    <body>
        <div id="logs"></div>
        <script>
            const div = document.querySelectorAll('#logs')[0];
            const ws = new WebSocket('ws://localhost:5173','vite-hmr');
            ws.onmessage = event => {
                const logLine = document.createElement('p');
                logLine.innerHTML = event.data;
                div.append(logLine);
            };
        </script>
    </body>
</html>

3. Kick off Vite

npm run dev

4. Load the development server (open http://localhost:5173/) as well as the malicious page in the browser.
5. Edit src/App.jsx file and intentionally place a syntax error
6. Notice how the malicious page can view the websocket messages and a snippet of the source code is exposed

Here's a video demonstrating the POC:

vite-cswsh.mov

CVE-2025-30208

Summary

The contents of arbitrary files can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Details

@fs denies access to files outside of Vite serving allow list. Adding ?raw?? or ?import&raw?? to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as ? are removed in several places, but are not accounted for in query string regexes.

PoC

$ npm create vite@latest
$ cd vite-project/
$ npm install
$ npm run dev

$ echo "top secret content" > /tmp/secret.txt

# expected behaviour
$ curl "http://localhost:5173/@​fs/tmp/secret.txt"

    <body>
      <h1>403 Restricted</h1>
      <p>The request url &quot;/tmp/secret.txt&quot; is outside of Vite serving allow list.

# security bypassed
$ curl "http://localhost:5173/@&#8203;fs/tmp/secret.txt?import&raw??"
export default "top secret content\n"
//# sourceMappingURL=data:application/json;base64,eyJ2...

CVE-2025-31125

Summary

The contents of arbitrary files can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Details

• base64 encoded content of non-allowed files is exposed using ?inline&import (originally reported as ?import&?inline=1.wasm?init)
• content of non-allowed files is exposed using ?raw?import

/@​fs/ isn't needed to reproduce the issue for files inside the project root.

PoC

Original report (check details above for simplified cases):

The ?import&?inline=1.wasm?init ending allows attackers to read arbitrary files and returns the file content if it exists. Base64 decoding needs to be performed twice

$ npm create vite@latest
$ cd vite-project/
$ npm install
$ npm run dev

Example full URL http://localhost:5173/@​fs/C:/windows/win.ini?import&?inline=1.wasm?init

CVE-2025-31486

Summary

The contents of arbitrary files can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Details

.svg

Requests ending with .svg are loaded at this line.
https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290
By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the restriction was able to bypass.

This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+.

relative paths

The check was applied before the id normalization. This allowed requests to bypass with relative paths (e.g. ../../).

PoC

npm create vite@latest
cd vite-project/
npm install
npm run dev

send request to read etc/passwd

curl 'http://127.0.0.1:5173/etc/passwd?.svg?.wasm?init'

curl 'http://127.0.0.1:5173/@​fs/x/x/x/vite-project/?/../../../../../etc/passwd?import&?raw'

CVE-2025-32395

Summary

The contents of arbitrary files can be returned to the browser if the dev server is running on Node or Bun.

Impact

Only apps with the following conditions are affected.

• explicitly exposing the Vite dev server to the network (using --host or server.host config option)
• running the Vite dev server on runtimes that are not Deno (e.g. Node, Bun)

Details

HTTP 1.1 spec (RFC 9112) does not allow # in request-target. Although an attacker can send such a request. For those requests with an invalid request-line (it includes request-target), the spec recommends to reject them with 400 or 301. The same can be said for HTTP 2 (ref1, ref2, ref3).

On Node and Bun, those requests are not rejected internally and is passed to the user land. For those requests, the value of http.IncomingMessage.url contains #. Vite assumed req.url won't contain # when checking server.fs.deny, allowing those kinds of requests to bypass the check.

On Deno, those requests are not rejected internally and is passed to the user land as well. But for those requests, the value of http.IncomingMessage.url did not contain #.

PoC

npm create vite@latest
cd vite-project/
npm install
npm run dev

send request to read /etc/passwd

curl --request-target /@​fs/Users/doggy/Desktop/vite-project/#/../../../../../etc/passwd http://127.0.0.1:5173

CVE-2025-46565

Summary

The contents of files in the project root that are denied by a file matching pattern can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
Only files that are under project root and are denied by a file matching pattern can be bypassed.

• Examples of file matching patterns: .env, .env.*, *.{crt,pem}, **/.env
• Examples of other patterns: **/.git/**, .git/**, .git/**/*

Details

server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns).
These patterns were able to bypass for files under root by using a combination of slash and dot (/.).

PoC

npm create vite@latest
cd vite-project/
cat "secret" > .env
npm install
npm run dev
curl --request-target /.env/. http://localhost:5173

---

Release Notes

vitejs/vite (vite)

v6.1.6

Compare Source

Please refer to CHANGELOG.md for details.

v6.1.5

Compare Source

Please refer to CHANGELOG.md for details.

v6.1.4

Compare Source

Please refer to CHANGELOG.md for details.

v6.1.3

Compare Source

Please refer to CHANGELOG.md for details.

v6.1.2

Compare Source

Please refer to CHANGELOG.md for details.

v6.1.1

Compare Source

• fix: ensure .[cm]?[tj]sx? static assets are JS mime (#​19453) (e7ba55e), closes #​19453
• fix: ignore *.ipv4 address in cert (#​19416) (973283b), closes #​19416
• fix(css): run rewrite plugin if postcss plugin exists (#​19371) (bcdb51a), closes #​19371
• fix(deps): bump tsconfck (#​19375) (746a583), closes #​19375
• fix(deps): update all non-major dependencies (#​19392) (60456a5), closes #​19392
• fix(deps): update all non-major dependencies (#​19440) (ccac73d), closes #​19440
• fix(html): ignore malformed src attrs (#​19397) (aff7812), closes #​19397
• fix(worker): fix web worker type detection (#​19462) (edc65ea), closes #​19462
• refactor: remove custom .jxl mime (#​19457) (0c85464), closes #​19457
• feat: add support for injecting debug IDs (#​18763) (0ff556a), closes #​18763
• chore: update 6.1.0 changelog (#​19363) (fa7c211), closes #​19363

v6.1.0

Compare Source

Features

• feat: show hosts in cert in CLI (#​19317) (a5e306f), closes #​19317
• feat: support for env var for defining allowed hosts (#​19325) (4d88f6c), closes #​19325
• feat: use native runtime to import the config (#​19178) (7c2a794), closes #​19178
• feat: print port in the logged error message after failed WS connection with EADDRINUSE (#​19212) (14027b0), closes #​19212
• perf(css): only run postcss when needed (#​19061) (30194fa), closes #​19061
• feat: add support for .jxl (#​18855) (57b397c), closes #​18855
• feat: add the builtins environment resolve (#​18584) (2c2d521), closes #​18584
• feat: call Logger for plugin logs in build (#​13757) (bf3e410), closes #​13757
• feat: export defaultAllowedOrigins for user-land config and 3rd party plugins (#​19259) (dc8946b), closes #​19259
• feat: expose createServerModuleRunnerTransport (#​18730) (8c24ee4), closes #​18730
• feat: support async for proxy.bypass (#​18940) (a6b9587), closes #​18940
• feat: support log related functions in dev (#​18922) (3766004), closes #​18922
• feat: use module runner to import the config (#​18637) (b7e0e42), closes #​18637
• feat(css): add friendly errors for IE hacks that are not supported by lightningcss (#​19072) (caad985), closes #​19072
• feat(optimizer): support bun text lockfile (#​18403) (05b005f), closes #​18403
• feat(reporter): add wasm to the compressible assets regex (#​19085) (ce84142), closes #​19085
• feat(worker): support dynamic worker option fields (#​19010) (d0c3523), closes #​19010

Fixes

• fix: avoid builtStart during vite optimize (#​19356) (fdb36e0), closes #​19356
• fix(build): fix stale build manifest on watch rebuild (#​19361) (fcd5785), closes #​19361
• fix: allow expanding env vars in reverse order (#​19352) (3f5f2bd), closes #​19352
• fix: avoid packageJson without name in resolveLibCssFilename (#​19324) (f183bdf), closes #​19324
• fix(html): fix css disorder when building multiple entry html (#​19143) (e7b4ba3), closes #​19143
• fix: don't call buildStart hooks for vite optimize (#​19347) (19ffad0), closes #​19347
• fix: don't call next middleware if user sent response in proxy.bypass (#​19318) (7e6364d), closes #​19318
• fix: respect top-level server.preTransformRequests (#​19272) (12aaa58), closes #​19272
• fix: use nodeLikeBuiltins for ssr.target: 'webworker' without noExternal: true (#​19313) (9fc31b6), closes #​19313
• fix(css): less @plugin imports of JS files treated as CSS and rebased (fix #​19268) (#​19269) (602b373), closes #​19268 #​19269
• fix(deps): update all non-major dependencies (#​19296) (2bea7ce), closes #​19296
• fix(resolve): preserve hash/search of file url (#​19300) (d1e1b24), closes #​19300
• fix(resolve): warn if node-like builtin was imported when resolve.builtin is empty (#​19312) (b7aba0b), closes #​19312
• fix(ssr): fix transform error due to export all id scope (#​19331) (e28bce2), closes #​19331
• fix(ssr): pretty print plugin error in ssrLoadModule (#​19290) (353c467), closes #​19290
• fix: change ResolvedConfig type to interface to allow extending it (#​19210) (bc851e3), closes #​19210
• fix: correctly resolve hmr dep ids and fallback to url (#​18840) (b84498b), closes #​18840
• fix: make --force work for all environments (#​18901) (51a42c6), closes #​18901
• fix: use loc.file from rollup errors if available (#​19222) (ce3fe23), closes #​19222
• fix(deps): update all non-major dependencies (#​19190) (f2c07db), closes #​19190
• fix(hmr): register inlined assets as a dependency of CSS file (#​18979) (eb22a74), closes #​18979
• fix(resolve): support resolving TS files by JS extension specifiers in JS files (#​18889) (612332b), closes #​18889
• fix(ssr): combine empty source mappings (#​19226) (ba03da2), closes #​19226
• fix(utils): clone RegExp values with new RegExp instead of structuredClone (fix #​19245, fix #​1 (56ad2be), closes #​19245 #​18875 #​19247

Chore

• refactor: deprecate vite optimize command (#​19348) (6e0e3c0), closes #​19348
• chore: update deprecate links domain (#​19353) (2b2299c), closes #​19353
• docs: rephrase browser range and features relation (#​19286) (97569ef), closes #​19286
• docs: update build.manifest jsdocs (#​19332) (4583781), closes #​19332
• chore: remove outdated code comment about scanImports not being used in ssr (#​19285) (fbbc6da), closes #​19285
• chore: unneeded name in lockfileFormats (#​19275) (96092cb), closes #​19275
• chore(deps): update dependency strip-literal to v3 (#​19231) (1172d65), closes #​19231

Beta Changelogs

6.1.0-beta.2 (2025-02-04)

See 6.1.0-beta.2 changelog

6.1.0-beta.1 (2025-02-04)

See 6.1.0-beta.1 changelog

6.1.0-beta.0 (2025-01-24)

See 6.1.0-beta.0 changelog

v6.0.15

Compare Source

Please refer to CHANGELOG.md for details.

v6.0.14

Compare Source

Please refer to CHANGELOG.md for details.

v6.0.13

Compare Source

Please refer to CHANGELOG.md for details.

v6.0.12

Compare Source

Please refer to CHANGELOG.md for details.

v6.0.11

Compare Source

• fix: preview.allowedHosts with specific values was not respected (#​19246) (aeb3ec8), closes #​19246
• fix: allow CORS from loopback addresses by default (#​19249) (3d03899), closes #​19249

v6.0.10

Compare Source

• fix: try parse server.origin URL (#​19241) (2495022), closes #​19241

v6.0.9

Compare Source

• fix!: check host header to prevent DNS rebinding attacks and introduce server.allowedHosts (bd896fb)
• fix!: default server.cors: false to disallow fetching from untrusted origins (b09572a)
• fix: verify token for HMR WebSocket connection (029dcd6)

v6.0.8

Compare Source

• fix: avoid SSR HMR for HTML files (#​19193) (3bd55bc), closes #​19193
• fix: build time display 7m 60s (#​19108) (cf0d2c8), closes #​19108
• fix: don't resolve URL starting with double slash (#​19059) (35942cd), closes #​19059
• fix: ensure server.close() only called once (#​19204) (db81c2d), closes #​19204
• fix: resolve.conditions in ResolvedConfig was defaultServerConditions (#​19174) (ad75c56), closes #​19174
• fix: tree shake stringified JSON imports (#​19189) (f2aed62), closes #​19189
• fix: use shared sigterm callback (#​19203) (47039f4), closes #​19203
• fix(deps): update all non-major dependencies (#​19098) (8639538), closes #​19098
• fix(optimizer): use correct default install state path for yarn PnP (#​19119) (e690d8b), closes #​19119
• fix(types): improve ESBuildOptions.include / exclude type to allow readonly (string | RegExp)[] (ea53e70), closes #​19146
• chore(deps): update dependency pathe to v2 (#​19139) (71506f0), closes #​19139

v6.0.7

Compare Source

• fix: fix minify when builder.sharedPlugins: true (#​19025) (f7b1964), closes #​19025
• fix: skip the plugin if it has been called before with the same id and importer (#​19016) (b178c90), closes #​19016
• fix(html): error while removing vite-ignore attribute for inline script (#​19062) (a492253), closes #​19062
• fix(ssr): fix semicolon injection by ssr transform (#​19097) (1c102d5), closes #​19097
• perf: skip globbing for static path in warmup (#​19107) (677508b), closes #​19107
• feat(css): show lightningcss warnings (#​19076) (b07c036), closes #​19076

v6.0.6

Compare Source

• fix: replace runner-side path normalization with fetchModule-side resolve (#​18361) (9f10261), closes #​18361
• fix(css): resolve style tags in HTML files correctly for lightningcss (#​19001) (afff05c), closes #​19001
• fix(css): show correct error when unknown placeholder is used for CSS modules pattern in lightningcs (9290d85), closes #​19070
• fix(resolve): handle package.json with UTF-8 BOM (#​19000) (902567a), closes #​19000
• fix(ssrTransform): preserve line offset when transforming imports (#​19004) (1aa434e), closes #​19004
• chore: fix typo in comment (#​19067) (eb06ec3), closes #​19067
• chore: update comment about build.target (#​19047) (0e9e81f), closes #​19047
• revert: unpin esbuild version (#​19043) (8bfe247), closes #​19043
• test(ssr): test virtual module with query (#​19044) (a1f4b46), closes #​19044

v6.0.5

Compare Source

• fix: esbuild regression (pin to 0.24.0) (#​19027) (4359e0d), closes #​19027

v6.0.4

Compare Source

• fix: this.resolve skipSelf should not skip for different id or import (#​18903) (4727320), closes #​18903
• fix: fallback terser to main thread when function options are used (#​18987) (12b612d), closes #​18987
• fix: merge client and ssr values for pluginContainer.getModuleInfo (#​18895) (258cdd6), closes #​18895
• fix(css): escape double quotes in url() when lightningcss is used (#​18997) (3734f80), closes #​18997
• fix(css): root relative import in sass modern API on Windows (#​18945) (c4b532c), closes #​18945
• fix(css): skip non css in custom sass importer (#​18970) (21680bd), closes #​18970
• fix(deps): update all non-major dependencies (#​18967) (d88d000), closes #​18967
• fix(deps): update all non-major dependencies (#​18996) (2b4f115), closes #​18996
• fix(optimizer): keep NODE_ENV as-is when keepProcessEnv is true (#​18899) (8a6bb4e), closes #​18899
• fix(ssr): recreate ssrCompatModuleRunner on restart (#​18973) (7d6dd5d), closes #​18973
• chore: better validation error message for dts build (#​18948) (63b82f1), closes #​18948
• chore(deps): update all non-major dependencies (#​18916) (ef7a6a3), closes #​18916
• chore(deps): update dependency @​rollup/plugin-node-resolve to v16 (#​18968) (62fad6d), closes #​18968
• refactor: make internal invoke event to use the same interface with handleInvoke (#​18902) (27f691b), closes #​18902
• refactor: simplify manifest plugin code (#​18890) (1bfe21b), closes #​18890
• test: test ModuleRunnerTransport invoke API (#​18865) (e5f5301), closes #​18865
• test: test output hash changes (#​18898) (bfbb130), closes #​18898

v6.0.3

Compare Source

• fix: handle postcss load unhandled rejections (#​18886) (d5fb653), closes #​18886
• fix: make handleInvoke interface compatible with invoke (#​18876) (a1dd396), closes #​18876
• fix: make result interfaces for ModuleRunnerTransport#invoke more explicit (#​18851) (a75fc31), closes #​18851
• fix: merge environments.ssr.resolve with root ssr config (#​18857) (3104331), closes #​18857
• fix: no permission to create vite config file (#​18844) (ff47778), closes #​18844
• fix: remove CSS import in CJS correctly in some cases (#​18885) (690a36f), closes #​18885
• fix(config): bundle files referenced with imports field (#​18887) (2b5926a), closes #​18887

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.