Skip to content

chore(deps-dev): bump vite, @vitest/coverage-v8, @vitest/ui and vitest - #770

Merged
chmaltsp merged 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-d24897c0b6
Nov 9, 2026
Merged

chore(deps-dev): bump vite, @vitest/coverage-v8, @vitest/ui and vitest#770
chmaltsp merged 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-d24897c0b6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps vite, @vitest/coverage-v8, @vitest/ui and vitest. These dependencies needed to be updated together.
Updates vite from 5.4.19 to 8.3.7

Release notes

Sourced from vite's releases.

v8.3.7

Bug Fixes

Miscellaneous Chores

Tests

Build System

v8.3.6

Bug Fixes

  • await overlapping plugin container close calls (#23935) (175bbeb)
  • build: resolve dynamic imports with queries appended when collecting CSS dependencies (#23909) (df36558)
  • build: use stable module ids in chunk import map hash signatures (fix #23975) (#23976) (8069835)
  • bundled-dev: allow named imports from Node built-ins (#23858) (4260c75)
  • bundled-dev: reload when hmr cannot run an entry again (#23849) (a236886)
  • deps: update @rollup/plugin-alias to v6.0.1 (#23862) (67c965b)
  • deps: update all non-major dependencies (#23896) (46b91c5)
  • deps: update all non-major dependencies (#23966) (b3cb057)
  • deps: update rolldown-related dependencies (#23868) (a63eb87)
  • deps: update rolldown-related dependencies (#23967) (0105733)
  • dev: escape ANSI escape sequence for server.forwardConsole (#23933) (4f340fd)
  • html: remove adjacent module tags on the first line (#23823) (eab1dc2)
  • ignore pnpm's .modules.yaml as a Vite Task input (#23634) (95c2daf)
  • optimizer: detect cache dir precisely (#23912) (cc9bc21)
  • optimizer: resolve subpath imports (#) with Vite's resolver (#23959) (0fdd81e)
  • respect build.sourcemap from environment (#23879) (82e7aa0)
  • server: escape HTML attributes (#23995) (a270391)
  • server: preserve $ patterns in static alias replacements (#23703) (1b6ed05)
  • ssr: convert external require against built-in modules to import for ssr.target=webworker (#23759) (a711f1c)
  • use top-level input for SSR build when build.ssr: true (#23898) (90bc034)
  • wasm: reject .wasm outside server.fs (#23914) (64e2467)
  • watch files that have a query or hash referenced with new URL(..., import.meta.url) (#23780) (e954a9c)
  • worker: keep chunks conflicted with unused workers that are still used by a live worker (#23956) (7139ef3)

Performance Improvements

Miscellaneous Chores

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.7 (2026-11-09)

Bug Fixes

Miscellaneous Chores

Tests

Build System

8.3.6 (2026-11-05)

Bug Fixes

  • await overlapping plugin container close calls (#23935) (175bbeb)
  • build: resolve dynamic imports with queries appended when collecting CSS dependencies (#23909) (df36558)
  • build: use stable module ids in chunk import map hash signatures (fix #23975) (#23976) (8069835)
  • bundled-dev: allow named imports from Node built-ins (#23858) (4260c75)
  • bundled-dev: reload when hmr cannot run an entry again (#23849) (a236886)
  • deps: update @rollup/plugin-alias to v6.0.1 (#23862) (67c965b)
  • deps: update all non-major dependencies (#23896) (46b91c5)
  • deps: update all non-major dependencies (#23966) (b3cb057)
  • deps: update rolldown-related dependencies (#23868) (a63eb87)
  • deps: update rolldown-related dependencies (#23967) (0105733)
  • dev: escape ANSI escape sequence for server.forwardConsole (#23933) (4f340fd)
  • html: remove adjacent module tags on the first line (#23823) (eab1dc2)
  • ignore pnpm's .modules.yaml as a Vite Task input (#23634) (95c2daf)
  • optimizer: detect cache dir precisely (#23912) (cc9bc21)
  • optimizer: resolve subpath imports (#) with Vite's resolver (#23959) (0fdd81e)
  • respect build.sourcemap from environment (#23879) (82e7aa0)
  • server: escape HTML attributes (#23995) (a270391)
  • server: preserve $ patterns in static alias replacements (#23703) (1b6ed05)
  • ssr: convert external require against built-in modules to import for ssr.target=webworker (#23759) (a711f1c)
  • use top-level input for SSR build when build.ssr: true (#23898) (90bc034)
  • wasm: reject .wasm outside server.fs (#23914) (64e2467)
  • watch files that have a query or hash referenced with new URL(..., import.meta.url) (#23780) (e954a9c)
  • worker: keep chunks conflicted with unused workers that are still used by a live worker (#23956) (7139ef3)

Performance Improvements

Miscellaneous Chores

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vite since your current version.


Updates @vitest/coverage-v8 from 0.34.6 to 5.1.0

Release notes

Sourced from @​vitest/coverage-v8's releases.

v5.1.0

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​vitest/coverage-v8 since your current version.


Updates @vitest/ui from 0.34.7 to 5.1.0

Release notes

Sourced from @​vitest/ui's releases.

v5.1.0

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​vitest/ui since your current version.


Updates vitest from 0.34.6 to 5.1.0

Release notes

Sourced from vitest's releases.

v5.1.0

   🚀 Features

@dependabot
dependabot Bot requested a review from razor-x as a code owner November 6, 2026 17:17
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 6, 2026
@chmaltsp chmaltsp added the needs-human-merge Sweep: major bump or code change, needs human label Nov 7, 2026
@chmaltsp

chmaltsp commented Nov 7, 2026

Copy link
Copy Markdown
Contributor

Security sweep: red. This bumps vite 5 → 8 and vitest 0.34 → 5 (majors). npm ci fails with ERESOLVE: @vitejs/plugin-react@4.6.0 does not accept vite 8 (see failing 'Install' log). Fixing needs a plugin-react upgrade and likely vitest config/test changes, which is beyond a mechanical fix. Needs a human; consider a smaller vite/vitest bump that clears the advisory.

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-d24897c0b6 branch from ccd03ab to 30ee210 Compare November 9, 2026 18:34
@chmaltsp chmaltsp added ready-for-human-merge Sweep: green, awaiting human merge and removed needs-human-merge Sweep: major bump or code change, needs human labels Nov 9, 2026
@chmaltsp

chmaltsp commented Nov 9, 2026

Copy link
Copy Markdown
Contributor

Sweep: vite 8 / vitest 5 need Node >=20.19/22 and conflict with @vitejs/plugin-react's peer range, which broke npm ci on every job (this package supports Node 18 and CI tests 18/20). Pinned to vite ^6.4.4 and vitest/@vitest/* ^3.2.6 instead, which clear the open advisories. Lint, typecheck, tests and build pass locally.

@chmaltsp @claude
chore(deps-dev): bump vite to 6.4.4 and vitest to 3.2.6
8c6e32e 
Stay on vite 6 / vitest 3 because vite 8 and vitest 5 require Node >=20.19/22
while this package supports Node 18 and CI tests Node 18 and 20. Both clear the
open advisories. vitest 3 defaults the happy-dom URL to localhost:3000, so
disable the same-origin policy in tests that fetch from the local fake servers.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@chmaltsp
chmaltsp force-pushed the dependabot/npm_and_yarn/multi-d24897c0b6 branch from 0349adc to 8c6e32e Compare November 9, 2026 21:17
@chmaltsp
chmaltsp merged commit d772bc2 into main Nov 9, 2026
13 checks passed
@chmaltsp
chmaltsp deleted the dependabot/npm_and_yarn/multi-d24897c0b6 branch November 9, 2026 21:22

This branch was successfully deployed

1 active deployment
Preview — 8c6e32e0 Deployed Nov 9, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@razor-x razor-x Awaiting requested review from razor-x razor-x is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code ready-for-human-merge Sweep: green, awaiting human merge

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@chmaltsp