Skip to content

deps(npm): bump @vitejs/plugin-react from 6.1.0 to 6.1.1 - #1781

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/vitejs/plugin-react-6.1.1
Closed

deps(npm): bump @vitejs/plugin-react from 6.1.0 to 6.1.1#1781
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/vitejs/plugin-react-6.1.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 16, 2026 •
edited by cursor Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps @vitejs/plugin-react from 6.1.0 to 6.1.1.

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.1

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.1 (2026-08-28)

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

Commits
  • 04cac50 release: plugin-react@6.1.1 (#1440)
  • 82d35ab fix(react): respect environment sourcemap option when builder.sharedPlugins...
  • 397e847 fix(react): make logging diagnostics an opt-in for React Compiler (#1431)
  • 61006e6 fix(deps): update all non-major dependencies (#1433)
  • e2a649c chore: use deps.neverBundle instead of external in tsdown config (#1430)
  • fb2d6f3 fix(deps): update all non-major dependencies (#1427)
  • See full diff in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note

Low Risk
Patch dev-dependency bump only; no application or Vite config changes in this repo.

Overview
Bumps @vitejs/plugin-react in the web package from 6.1.0 to 6.1.1, with the lockfile updated to match.

The app still uses the default react() setup in Vite with no custom compiler options, so behavior should stay the same unless you later enable the React Compiler or experimental builder.sharedPlugins. The release mainly makes recoverable compiler diagnostics opt-in (compiler.logDiagnostics) and fixes sourcemap handling for the compiler transform when shared plugins are enabled.

Reviewed by Cursor Bugbot for commit d3fb5e6. Bugbot is set up for automated code reviews on this repo. Configure here.

@dependabot
deps(npm): bump @vitejs/plugin-react from 6.1.0 to 6.1.1
d3fb5e6 
Bumps [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) from 6.1.0 to 6.1.1.
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.1/packages/plugin-react)

---
updated-dependencies:
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 16, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 16, 2026
@nadaverell nadaverell mentioned this pull request Sep 16, 2026
Merged
@nadaverell

nadaverell commented Sep 16, 2026

Copy link
Copy Markdown
Contributor

Superseded by the reviewed dependency batch #1786, which includes this update (soak + upstream review recorded there). Closing in favor of that PR.

@nadaverell nadaverell closed this Sep 16, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 16, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/vitejs/plugin-react-6.1.1 branch September 16, 2026 10:46
nadaverell added a commit that referenced this pull request Sep 16, 2026
@nadaverell
deps: Dependabot batch 2026-09-16 (React 19.3, x/net 0.59, typescript…
4b9f2e2 
…-eslint 8.70, +6) (#1786)

## Summary

One evidence-backed dependency PR replacing this week's open Dependabot
PRs. Every included version was published at least 72 hours before
screening, was reviewed against upstream release notes / commit ranges,
and was judged by how Radar actually uses the package. Dependency-only:
no application source changes.

**Screening time:** 2026-09-16T10:11:50Z · **72-hour cutoff:**
2026-09-13T10:11:50Z

## Included

| Dependabot PR | Dependency | Old → New | Published (UTC) | Soak | Risk
conclusion |
|---|---|---|---|---|---|
| #1779 | `react`, `react-dom`, `@types/react`, `@types/react-dom` |
19.2.8 / 19.2.18 / 19.2.3 → **19.3.0** (+ `scheduler` 0.27→0.28) |
2026-09-09 17:17–18:08 | 6.7d | Minor with new opt-in APIs
(ViewTransition, Fragment refs, `browser()`) Radar doesn't use.
Behavioral changes reviewed: independent transition rendering (Radar
uses `useDeferredValue` in ResourcesView / log search — full suites
pass), Trusted Types integration (Radar sets no Trusted Types CSP),
`resize` batching / form `submitter` / `type=number` defaultValue (no
affected call sites). No upstream regressions filed against client-only
usage since release. **Dependabot's PR only bumped `react`; react-dom
must move in lockstep** (`ensureCorrectIsomorphicReactVersion`
hard-fails otherwise — that was its CI failure). |
| #1781 | `@vitejs/plugin-react` | 6.1.0 → 6.1.1 | 2026-08-28 | 19d |
Only change is React Compiler diagnostics logging
(`compiler.logDiagnostics`) + a `builder.sharedPlugins` sourcemap fix.
Radar's Vite config uses `react()` with no compiler. |
| #1780 | `typescript-eslint` (+ all `@typescript-eslint/*`, nested
`ignore` 7.0.6→7.0.9) | 8.67.0 → 8.70.0 | 2026-09-07 | 8.7d | 8.68–8.70:
rule fixes + one new rule not in `recommended`. Before/after `npm run
lint` in `web/` is identical: 365 warnings, 0 errors (before =
`main@77a4a2f` CI). `ignore` changes are gitignore-pattern parsing
fixes. |
| #1778 | `@fontsource-variable/dm-sans` | 5.2.8 → 5.3.0 | 2026-07-19 |
59d | Tarball diff: font files and `index.css` byte-identical; only adds
`index.d.css.ts` + `types` export. Visually inert. |
| #1777 | `golang.org/x/net` (+ `x/sync` 0.23.0, `x/text` 0.42.0,
`x/crypto` 0.57.0, `x/mod` 0.41.0 via MVS) | 0.58.0 → 0.59.0 |
2026-09-08 (all ≤ 2026-09-08) | ≥7.6d | Radar imports only
`x/net/http/httpguts` (no commits in range); `http2` is used
transitively by client-go — changes are `Transport`/`Server` deprecation
notes, IDNA lookup for non-ASCII hosts, http3/quic fixes. `x/sync`:
`semaphore` negative-capacity panic (Radar uses only
`singleflight`/`errgroup`). `x/crypto`: ssh/acme fixes (unused by
Radar). `x/mod`: sumdb auth-bypass fix. All require `go 1.26.0`, which
Radar already is. |
| #1775 | `golang.org/x/term` | 0.45.0 → 0.46.0 | 2026-09-08 | 7.7d |
Single commit: `Terminal.ReadLine` now surfaces a read error after
processing the bytes returned with it. |
| #1774 | `golang.org/x/oauth2` | 0.36.0 → 0.37.0 | 2026-08-25 | 21d |
Single change in `google/`: GCE metadata path `universe/universe_domain`
→ `universe/universe-domain`. Radar's OIDC code uses the core package
only. |
| #1773 | `github.com/prometheus/client_model` | 0.6.2 → 0.6.3 |
2026-08-31 | 16d | Only Go-visible change is a comment edit in
`metrics.proto`; rest is repo tooling. |
| #1709 | `baseline-browser-mapping` (transitive of browserslist) |
2.10.38 → 2.11.21 | 2026-09-03 | 12.7d | Data-only package; Radar has no
browserslist query so it's never consulted. 2.11.0 also fixed
CVE-2026-45819. **Pinned explicitly** — `npm update` would float to
2.11.24 (2026-09-15, unsoaked). |

## Excluded / held

- **#1776 `github.com/modelcontextprotocol/go-sdk` 1.6.1 → 1.8.0 —
excluded, needs a Radar source change.** Its Backend CI fails
`TestInvestigationHandlerAnnotatesRealToolCallWithoutChangingPublicContract`
("private mount handshake did not mark the scope connected"). Root
cause: v1.7.0 implements protocol `2026-07-28`, which drops the
`initialize` handshake in favor of `server/discover`; stateless handlers
negotiate it, and `investigationEvidenceReferenceMiddleware`
(`internal/mcp/server.go`) only marks the scope connected on
`initialize` / `tools/list`. Also worth noting for the follow-up: 1.7
stateless servers ignore `Mcp-Session-Id` entirely and 1.8 changes the
stateful rejection body and cancel-notify semantics. Independently, its
GitHub Release was only published 2026-09-14 (<72h) even though the tag
is older. Left open.

## Graph movement beyond the PR titles

- `scheduler` 0.27.0 → 0.28.0 — `react-dom` 19.3.0's pinned dependency,
published in the same release (2026-09-09).
- `golang.org/x/{sync,text,crypto,mod}` — pulled by `x/net` 0.59.0's
`go.mod`; each reviewed above. Identical to the set Dependabot's #1777
produced.
- `pkg/go.mod` (separately-versioned shared module) is untouched: no
Dependabot PR targeted it and the root `replace` means the root build
already uses the root versions.

Full resolved-graph diffs (`go list -m all`, lockfile package list)
contain exactly the entries above — no other churn.

## Verification

- `make tsc` ✓
- `make test` (Go, `-v ./...`) — 40 packages ok, 0 failed
- `web/`: vitest 108 files / 1254 tests ✓ · `packages/k8s-ui/`: 189
files / 3763 tests ✓ (1 pre-existing skip)
- `node --test scripts/workload-metrics-demo/capture.test.mjs` ✓ · `cd
pkg && go test ./...` ✓
- `make build` ✓ (frontend + embed + binary)
- `go mod verify` — all modules verified · `git diff --check` clean ·
worktree clean after build
- `web/` lint before/after: 365 warnings / 0 errors both sides
- visual-test: **skipped** — React 19.3's runtime changes are covered by
the 5,000+ rendering tests across both suites and the production build;
no rendered surface in Radar changes by design (fonts byte-identical, no
new components). Happy to run one on request before merge.

## Upstream references

- React 19.3.0: https://github.com/facebook/react/releases/tag/v19.3.0
- @vitejs/plugin-react 6.1.1:
https://github.com/vitejs/vite-plugin-react/releases/tag/plugin-react%406.1.1
- typescript-eslint:
https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.68.0
· v8.69.0 · v8.70.0
- x/net: golang/net@v0.58.0...v0.59.0 ·
x/term: golang/term@v0.45.0...v0.46.0 ·
x/oauth2: golang/oauth2@v0.36.0...v0.37.0 ·
x/crypto: golang/crypto@v0.55.0...v0.57.0 ·
x/mod: golang/mod@v0.39.0...v0.41.0 · x/sync:
golang/sync@v0.22.0...v0.23.0 · x/text:
golang/text@v0.41.0...v0.42.0
- client_model:
prometheus/client_model@v0.6.2...v0.6.3
- baseline-browser-mapping 2.11.0:
https://github.com/web-platform-dx/baseline-browser-mapping/releases/tag/v2.11.0
- go-sdk (excluded):
https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.7.0 ·
https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.8.0

Supersedes #1779, #1781, #1780, #1778, #1777, #1775, #1774, #1773, #1709

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Lockfile and manifest bumps only; excluded packages like MCP go-sdk
were not upgraded, limiting exposure to reviewed minor/patch releases.
> 
> **Overview**
> This PR is **dependency-only**: it updates lockfiles and
`package.json` / `go.mod` manifests with **no application source
changes**.
> 
> **Go** bumps include `golang.org/x/net` (0.58→0.59) with related MVS
pulls (`x/sync`, `x/text`, `x/crypto`, `x/mod`), plus `x/oauth2`,
`x/term`, and `prometheus/client_model`.
> 
> **Frontend** moves **`react` / `react-dom` and matching `@types/*` to
19.3.0** (with `scheduler` 0.28 via `react-dom`) in both `web/` and
`packages/k8s-ui`. Dev tooling updates cover **`typescript-eslint`
8.67→8.70**, **`@vitejs/plugin-react` 6.1.1**, and
**`@fontsource-variable/dm-sans` 5.3.0**. The root
**`package-lock.json`** also refreshes transitive entries such as
**`baseline-browser-mapping`**.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
1e036fe. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@nadaverell nadaverell Awaiting requested review from nadaverell nadaverell is a code owner
@hisco hisco Awaiting requested review from hisco hisco is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@nadaverell