build(deps-dev): bump vite, @vitejs/plugin-react and vitest in /app - #166
build(deps-dev): bump vite, @vitejs/plugin-react and vitest in /app#166dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite), [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). These dependencies needed to be updated together. Updates `vite` from 5.4.21 to 8.2.2 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite) Updates `@vitejs/plugin-react` from 4.7.0 to 6.1.1 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.1/packages/plugin-react) Updates `vitest` from 2.1.9 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest) --- updated-dependencies: - dependency-name: vite dependency-version: 8.2.2 dependency-type: direct:development - dependency-name: "@vitejs/plugin-react" dependency-version: 6.1.1 dependency-type: direct:development - dependency-name: vitest dependency-version: 4.1.11 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![obvious-autobuild-staging[bot]](https://avatars.githubusercontent.com/u/31830338?s=60&v=4){kind=small}
There was a problem hiding this comment.
Obvious Code Review
Verdict: COMMENT (1 Blocker, 1 Suggestion)
Summary
The toolchain bump itself is sound: vite 8.2.2 / @vitejs/plugin-react 6.1.1 / vitest 4.1.11 all satisfy Node and peer ranges on CI's Node 20 (resolves to 20.19+, meeting vite 8's ^20.19.0 || >=22.12.0), @tailwindcss/vite 4.3.3 accepts vite 8, the minimal vite.config.ts uses only stable API, and the lockfile actually removes an install script (esbuild 0.21.5's postinstall drops out with Rolldown). On this PR's head, CI lint, typecheck, tests (vitest 4), and the vite 8 production build all pass.
The PR fails CI only at the committed-dist freshness guard: this repo ships the production frontend through committed app/dist, and the bump leaves it at the vite 5 output. See the inline comment — the fix is to run npm run build and commit the regenerated app/dist.
- Blocker: 1
- High: 0
- Medium: 0
Suggestions
app/package.json— Declare the Node engine floor ("engines": { "node": ">=20.19" }or a.nvmrc); vite 8 / vitest 4 now hard-require it and the repo declares nothing.
| "typescript-eslint": "^8.18.0", | ||
| "vite": "^5.4.11", | ||
| "vitest": "^2.1.8" | ||
| "vite": "^8.2.2", |
There was a problem hiding this comment.
Blocker · reliability — Committed app/dist not regenerated; CI's stale-artifact guard fails at this head. Vite 5 → 8 switches the bundler to Rolldown, so the build output hashes necessarily change: CI (run 33465139118, job 99723329729) shows the fresh build emitting dist/assets/index-BBJaplHK.js + index-Cuhko0SD.css while the committed artifacts are index-CQC8l2Yz.js + index-gaL4kw_s.css, and the "Verify committed dist matches the fresh build" step exits 1. Since app/dist is this repo's deploy transport (the guard exists so a forgotten rebuild can never ship stale frontend code), merging as-is would put master on a vite-8 lockfile serving a vite-5 bundle. Fix: run npm run build on Node >= 20.19 and commit the regenerated app/dist in this PR. Longer term, every Dependabot bump touching vite/@vitejs/plugin-react/tailwind will trip this guard — consider a rebuild step or automation for such bumps, since Dependabot cannot regenerate the artifact itself.
Bumps vite, @vitejs/plugin-react and vitest. These dependencies needed to be updated together.
Updates
vitefrom 5.4.21 to 8.2.2Release notes
Sourced from vite's releases.
... (truncated)
Changelog
Sourced from vite's changelog.
... (truncated)
Commits
de1111arelease: v8.2.2cb77e2atest(ssr): add destructing assignment case for moduleRunnerTransform (#23308)9db0b61fix(ssr): rewrite computed key of destructing parameter (#23307)8413052fix: respectresolve.preserveSymlinkswhen resolving root (fix #23197) (#23...05a003efix(config): resolve sourcemap paths against sourcemap location (#23239)495d9fffeat(deps): widen@vitejs/devtoolspeer range to v0.5.0 (#23302)1d9fa39refactor: use JSON import attributes instead of readFileSync in constants (#2...2804636fix(css): don't pass empty targets to lightningcss (#23295)599b44btest(module-runner): simplify server-hmr tests (#23300)4a261f2test(module-runner): add TLA circular import case (#23299)Updates
@vitejs/plugin-reactfrom 4.7.0 to 6.1.1Release notes
Sourced from @vitejs/plugin-react's releases.
... (truncated)
Changelog
Sourced from @vitejs/plugin-react's changelog.
... (truncated)
Commits
04cac50release: plugin-react@6.1.1 (#1440)82d35abfix(react): respect environment sourcemap option whenbuilder.sharedPlugins...397e847fix(react): make logging diagnostics an opt-in for React Compiler (#1431)61006e6fix(deps): update all non-major dependencies (#1433)e2a649cchore: usedeps.neverBundleinstead ofexternalin tsdown config (#1430)fb2d6f3fix(deps): update all non-major dependencies (#1427)39b3173release: plugin-react@6.1.0 (#1428)f1340b0feat(react): add native React Compiler support (#1419)9ab698efix(deps): update all non-major dependencies (#1375)68c0cb8release: plugin-react@6.0.5 (#1362)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@vitejs/plugin-reactsince your current version.Updates
vitestfrom 2.1.9 to 4.1.11Release notes
Sourced from vitest's releases.
... (truncated)
Commits
9bd8d46chore: release v4.1.11 (#10995)9851dbcfix(browser): trigger playwright/chromium gc on lower disk availability [back...db616d2chore: release v4.1.10 (#10718)bae52b5fix(vm): fix external module resolve error with deps optimizer query for enco...a7a61e7chore: release v4.1.9 (#10598)934b0f5fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...7fb2965fix(browser): wait for orchestrator readiness before resolving browser sessio...a518019fix: fiximportOriginalwith optimizer and query import [backport to v4] (#...e61f2ddchore: release v4.1.8e4067b3fix(browser): disable clientcdpAPI whenallowWrite/allowExec: false[ba...Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for vitest since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.