Skip to content

chore(deps-dev): bump vite from 8.3.2 to 8.3.4 in the development-dependencies group - #6

Merged
veillette merged 1 commit into
mainfrom
dependabot/npm_and_yarn/development-dependencies-63f9813d79
Oct 14, 2026
Merged

veillette merged 1 commit into
mainfrom
dependabot/npm_and_yarn/development-dependencies-63f9813d79

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 13, 2026

Copy link
Copy Markdown
Contributor

Bumps the development-dependencies group with 1 update: vite.

Updates vite from 8.3.2 to 8.3.4

Release notes

Sourced from vite's releases.

v8.3.4

Features

  • bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

  • avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)
  • build: correct preloads when chunkImportMap is enabled with non-root base (#23698) (2a8c0f0)
  • build: wait for in-flight stylesheets in preload helper (fix #23652) (#23662) (036b745)
  • bundled-dev: serve /@vite/client and stub @vite/env (#23664) (5afc5a8)
  • client: skip rewriting unchanged adopted styles (#23697) (fa71469)
  • css: resolve imported preprocessors from their file path with lightningcss (#23688) (cf52011)
  • deps: update all non-major dependencies (#23648) (8a4c19c)
  • deps: update rolldown-related dependencies (#23649) (794516d)
  • dev: a restart requested during a restart used to be dropped (fix #23392) (#23484) (70d56ea)
  • don't treat modules ending with js-like query as js (#23687) (fcb6f12)
  • html: avoid adding filesystem root to watcher (#23689) (3a7f2ae)
  • html: skip caching CSS of chunks in a cycle (fix #23628) (#23636) (15d82f7)
  • optimizer: scan deep imports with custom extensions (#23678) (8579189)
  • remove input option unescaping for now (#23694) (facc2fb)
  • server: match static aliases on path boundaries (#23643) (b28db28)
  • watcher: normalize file before root check in ensureWatchedFile (#23673) (12bb28c)

Performance Improvements

  • module-runner: skip cloning call sites that have no source map (#23646) (3d67486)

Code Refactoring

  • bundled-dev: import CSS HMR helpers from /@vite/client (#23674) (182f5b2)

v8.3.3

Bug Fixes

  • deps: update launch-editor to v2.14.2 (#23654) (22fd1d5)
  • html: filename passed to transformIndexHtml should not include queries (#23653) (7dafd8e)
  • server: check fs.serve for ?vite-wasm-instance (#23655) (ba8b7ab)
  • server: store ids to safeModulePaths rather than URLs (#23656) (c3e06f9)
Changelog

Sourced from vite's changelog.

8.3.4 (2026-10-08)

Features

  • bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

  • avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)
  • build: correct preloads when chunkImportMap is enabled with non-root base (#23698) (2a8c0f0)
  • build: wait for in-flight stylesheets in preload helper (fix #23652) (#23662) (036b745)
  • bundled-dev: serve /@vite/client and stub @vite/env (#23664) (5afc5a8)
  • client: skip rewriting unchanged adopted styles (#23697) (fa71469)
  • css: resolve imported preprocessors from their file path with lightningcss (#23688) (cf52011)
  • deps: update all non-major dependencies (#23648) (8a4c19c)
  • deps: update rolldown-related dependencies (#23649) (794516d)
  • dev: a restart requested during a restart used to be dropped (fix #23392) (#23484) (70d56ea)
  • don't treat modules ending with js-like query as js (#23687) (fcb6f12)
  • html: avoid adding filesystem root to watcher (#23689) (3a7f2ae)
  • html: skip caching CSS of chunks in a cycle (fix #23628) (#23636) (15d82f7)
  • optimizer: scan deep imports with custom extensions (#23678) (8579189)
  • remove input option unescaping for now (#23694) (facc2fb)
  • server: match static aliases on path boundaries (#23643) (b28db28)
  • watcher: normalize file before root check in ensureWatchedFile (#23673) (12bb28c)

Performance Improvements

  • module-runner: skip cloning call sites that have no source map (#23646) (3d67486)

Code Refactoring

  • bundled-dev: import CSS HMR helpers from /@vite/client (#23674) (182f5b2)

8.3.3 (2026-10-06)

Bug Fixes

  • deps: update launch-editor to v2.14.2 (#23654) (22fd1d5)
  • html: filename passed to transformIndexHtml should not include queries (#23653) (7dafd8e)
  • server: check fs.serve for ?vite-wasm-instance (#23655) (ba8b7ab)
  • server: store ids to safeModulePaths rather than URLs (#23656) (c3e06f9)
Commits
  • b6c20f6 release: v8.3.4 (#23702)
  • b28db28 fix(server): match static aliases on path boundaries (#23643)
  • bc0f21c feat(bundled-dev): support import.meta.hot.acceptExports (#23463)
  • fa71469 fix(client): skip rewriting unchanged adopted styles (#23697)
  • 2a8c0f0 fix(build): correct preloads when chunkImportMap is enabled with non-root bas...
  • 3a7f2ae fix(html): avoid adding filesystem root to watcher (#23689)
  • facc2fb fix: remove input option unescaping for now (#23694)
  • 70d56ea fix(dev): a restart requested during a restart used to be dropped (fix #23392...
  • cf52011 fix(css): resolve imported preprocessors from their file path with lightningc...
  • fcb6f12 fix: don't treat modules ending with js-like query as js (#23687)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the development-dependencies group with 1 update: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).


Updates `vite` from 8.3.2 to 8.3.4
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.4/packages/vite)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 8.3.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 13, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 13, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: automated. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@github-actions

Copy link
Copy Markdown

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
npm/@oxc-project/types 0.153.0 UnknownUnknown
npm/@rolldown/binding-android-arm-eabi 1.2.13 UnknownUnknown
npm/@rolldown/binding-android-arm64 1.2.13 UnknownUnknown
npm/@rolldown/binding-darwin-arm64 1.2.13 UnknownUnknown
npm/@rolldown/binding-darwin-x64 1.2.13 UnknownUnknown
npm/@rolldown/binding-freebsd-x64 1.2.13 UnknownUnknown
npm/@rolldown/binding-linux-arm-gnueabihf 1.2.13 UnknownUnknown
npm/@rolldown/binding-linux-arm64-gnu 1.2.13 UnknownUnknown
npm/@rolldown/binding-linux-arm64-musl 1.2.13 UnknownUnknown
npm/@rolldown/binding-linux-ppc64-gnu 1.2.13 UnknownUnknown
npm/@rolldown/binding-linux-s390x-gnu 1.2.13 UnknownUnknown
npm/@rolldown/binding-linux-x64-gnu 1.2.13 UnknownUnknown
npm/@rolldown/binding-linux-x64-musl 1.2.13 UnknownUnknown
npm/@rolldown/binding-openharmony-arm64 1.2.13 UnknownUnknown
npm/@rolldown/binding-win32-arm64-msvc 1.2.13 UnknownUnknown
npm/@rolldown/binding-win32-x64-msvc 1.2.13 UnknownUnknown
npm/nanoid 3.3.20 🟢 6.4
Details
CheckScoreReason
Code-Review⚠️ 2Found 7/30 approved changesets -- score normalized to 2
Maintained🟢 1028 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ -1no releases found
SAST⚠️ 1SAST tool is not run on all commits -- score normalized to 1
npm/postcss 8.5.29 🟢 7.4
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 3Found 10/30 approved changesets -- score normalized to 3
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy🟢 10security policy file detected
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/rolldown 1.2.13 UnknownUnknown
npm/source-map-js 1.2.2 🟢 3.1
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 3Found 9/30 approved changesets -- score normalized to 3
Dangerous-Workflow⚠️ -1no workflows found
Token-Permissions⚠️ -1No tokens found
Maintained🟢 54 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 5
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies⚠️ -1no dependencies found
Security-Policy⚠️ 0security policy file not detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
npm/vite 8.3.4 🟢 6.7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review🟢 7Found 19/25 approved changesets -- score normalized to 7
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Token-Permissions🟢 7detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts⚠️ 1binaries present in source code
Pinned-Dependencies🟢 9dependency not pinned by hash detected -- score normalized to 9
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
SAST🟢 9SAST tool is not run on all commits -- score normalized to 9

Scanned Files

  • package-lock.json

@veillette veillette left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dev-only vite patch 8.3.2 → 8.3.4. package.json change is that pin plus the lockfile. Build, dependency review, and CodeQL passed.

@veillette
veillette merged commit cdc0998 into main Oct 14, 2026
4 checks passed
@veillette
veillette deleted the dependabot/npm_and_yarn/development-dependencies-63f9813d79 branch October 14, 2026 19:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant