chore(deps): update dependency vite to v6.1.4 [security] (#3939)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [vite](https://vite.dev)
([source](https://redirect.github.com/vitejs/vite/tree/HEAD/packages/vite))
| [`6.1.3` ->
`6.1.4`](https://renovatebot.com/diffs/npm/vite/6.1.3/6.1.4) |
[![age](https://developer.mend.io/api/mc/badges/age/npm/vite/6.1.4?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/vite/6.1.4?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/vite/6.1.3/6.1.4?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vite/6.1.3/6.1.4?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

### GitHub Vulnerability Alerts

####
[CVE-2025-31486](https://redirect.github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x)

### Summary

The contents of arbitrary files can be returned to the browser.

### Impact

Only apps explicitly exposing the Vite dev server to the network (using
--host or [server.host config
option](https://vitejs.dev/config/server-options.html#server-host)) are
affected..

### Details

#### `.svg`

Requests ending with `.svg` are loaded at this line.

https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290
By adding `?.svg` with `?.wasm?init` or with `sec-fetch-dest: script`
header, the restriction was able to bypass.

This bypass is only possible if the file is smaller than
[`build.assetsInlineLimit`](https://vite.dev/config/build-options.html#build-assetsinlinelimit)
(default: 4kB) and when using Vite 6.0+.

#### relative paths

The check was applied before the id normalization. This allowed requests
to bypass with relative paths (e.g. `../../`).

### PoC

```bash
npm create vite@latest
cd vite-project/
npm install
npm run dev
```

send request to read `etc/passwd`

```bash
curl 'http://127.0.0.1:5173/etc/passwd?.svg?.wasm?init'
```

```bash
curl 'http://127.0.0.1:5173/@​fs/x/x/x/vite-project/?/../../../../../etc/passwd?import&?raw'
```

---

### Release Notes

<details>
<summary>vitejs/vite (vite)</summary>

###
[`v6.1.4`](https://redirect.github.com/vitejs/vite/releases/tag/v6.1.4)

[Compare
Source](https://redirect.github.com/vitejs/vite/compare/v6.1.3...v6.1.4)

Please refer to
[CHANGELOG.md](https://redirect.github.com/vitejs/vite/blob/v6.1.4/packages/vite/CHANGELOG.md)
for details.

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/TanStack/router).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yMjcuMyIsInVwZGF0ZWRJblZlciI6IjM5LjIyNy4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Author: renovate[bot]

Diff for: examples/react/start-large/package.json

@@ -30,7 +30,7 @@
     "autoprefixer": "^10.4.20",
     "tailwindcss": "^3.4.17",
     "typescript": "^5.7.2",
-    "vite": "6.1.3",
+    "vite": "6.1.4",
     "vite-tsconfig-paths": "^5.1.4"
   },
   "keywords": [],

Diff for: examples/solid/start-basic/package.json

@@ -15,7 +15,7 @@
     "solid-js": "^1.9.5",
     "redaxios": "^0.5.1",
     "tailwind-merge": "^2.6.0",
-    "vite": "6.1.3",
+    "vite": "6.1.4",
     "vinxi": "0.5.3"
   },
   "devDependencies": {

Diff for: package.json

@@ -57,7 +57,7 @@
     "rimraf": "^6.0.1",
     "tinyglobby": "^0.2.12",
     "typescript": "^5.8.2",
-    "vite": "6.1.3",
+    "vite": "6.1.4",
     "vitest": "^3.0.6",
     "typescript53": "npm:typescript@5.3",
     "typescript54": "npm:typescript@5.4",

Diff for: packages/directive-functions-plugin/package.json

@@ -76,7 +76,7 @@
     "babel-dead-code-elimination": "^1.0.10",
     "dedent": "^1.5.3",
     "tiny-invariant": "^1.3.3",
-    "vite": "6.1.3"
+    "vite": "6.1.4"
   },
   "devDependencies": {
     "@types/babel__code-frame": "^7.0.6",

Diff for: packages/react-start-plugin/package.json

@@ -75,7 +75,7 @@
     "@tanstack/router-utils": "workspace:^",
     "babel-dead-code-elimination": "^1.0.10",
     "tiny-invariant": "^1.3.3",
-    "vite": "6.1.3"
+    "vite": "6.1.4"
   },
   "devDependencies": {
     "@types/babel__code-frame": "^7.0.6",

Diff for: packages/solid-start-plugin/package.json

@@ -75,7 +75,7 @@
     "@tanstack/router-utils": "workspace:^",
     "babel-dead-code-elimination": "^1.0.9",
     "tiny-invariant": "^1.3.3",
-    "vite": "6.1.3"
+    "vite": "6.1.4"
   },
   "devDependencies": {
     "@types/babel__code-frame": "^7.0.6",