Skip to content

fix(html): filename passed to transformIndexHtml should not include queries - #23653

Merged
sapphi-red merged 3 commits into
mainfrom
fix/html-filename
Oct 6, 2026
Merged

fix(html): filename passed to transformIndexHtml should not include queries#23653
sapphi-red merged 3 commits into
mainfrom
fix/html-filename

Conversation

@sapphi-red

@sapphi-red sapphi-red commented Oct 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

The first commit is the fix for the attack. The second commit is a hardening to avoid generating <script src="//evil.example.com/...">.

fixes GHSA-9jrq-w75r-8gcw

@sapphi-red
sapphi-red merged commit 7dafd8e into main Oct 6, 2026
30 of 34 checks passed
@sapphi-red
sapphi-red deleted the fix/html-filename branch October 6, 2026 03:23
@github-actions github-actions Bot mentioned this pull request Oct 6, 2026
Merged
This was referenced Oct 6, 2026
Merged
Merged
sapphi-red added a commit that referenced this pull request Oct 6, 2026
@sapphi-red
fix(html): filename passed to transformIndexHtml should not include q…
908bffe 
…ueries (#23653)
sapphi-red added a commit that referenced this pull request Oct 6, 2026
@sapphi-red
fix(html): filename passed to transformIndexHtml should not include q…
1baa0fe 
…ueries (#23653)
This was referenced Oct 6, 2026
Merged
Merged
sapphi-red added a commit that referenced this pull request Oct 6, 2026
@sapphi-red
fix(html): filename passed to transformIndexHtml should not include q…
1203c62 
…ueries (#23653)
sapphi-red added a commit that referenced this pull request Oct 6, 2026
@sapphi-red
fix(html): filename passed to transformIndexHtml should not include q…
4ff2522 
…ueries (#23653)
sapphi-red added a commit that referenced this pull request Oct 6, 2026
@sapphi-red
fix(html): filename passed to transformIndexHtml should not include q…
8d479f9 
…ueries (#23653)
sapphi-red added a commit that referenced this pull request Oct 6, 2026
@sapphi-red
fix(html): filename passed to transformIndexHtml should not include q…
19902cf 
…ueries (#23653)
@sapphi-red sapphi-red added p5-urgent Fix build-breaking bugs affecting most users, should be released ASAP (priority) security labels Oct 6, 2026
renovate Bot added a commit to andrei-picus-tink/auto-renovate that referenced this pull request Oct 6, 2026
@renovate
Update dependency vite to v8.3.3
afc7bc3 
| datasource | package | from  | to    |
| ---------- | ------- | ----- | ----- |
| npm        | vite    | 8.3.0 | 8.3.3 |


## [v8.3.3](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-833-2026-10-06-small)

##### Bug Fixes

- **deps:** update launch-editor to v2.14.2 ([#23654](vitejs/vite#23654)) ([22fd1d5](vitejs/vite@22fd1d5))
- **html:** filename passed to transformIndexHtml should not include queries ([#23653](vitejs/vite#23653)) ([7dafd8e](vitejs/vite@7dafd8e))
- **server:** check `fs.serve` for `?vite-wasm-instance` ([#23655](vitejs/vite#23655)) ([ba8b7ab](vitejs/vite@ba8b7ab))
- **server:** store ids to `safeModulePaths` rather than URLs ([#23656](vitejs/vite#23656)) ([c3e06f9](vitejs/vite@c3e06f9))


## [v8.3.2](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-832-2026-10-01-small)

##### Bug Fixes

- **build:** preload CSS correctly when `renderBuiltUrl` returns URLs with queries ([#23611](vitejs/vite#23611)) ([64e0a21](vitejs/vite@64e0a21))
- **bundled-dev:** serve lazy chunk sourcemaps ([#23026](vitejs/vite#23026)) ([eb7aa9a](vitejs/vite@eb7aa9a))
- **bundled-dev:** serve the rolldown runtime from the installed rolldown ([#23568](vitejs/vite#23568)) ([bc598a6](vitejs/vite@bc598a6))
- **deps:** update all non-major dependencies ([#23601](vitejs/vite#23601)) ([9944fa6](vitejs/vite@9944fa6))
- **deps:** update rolldown-related dependencies ([#23602](vitejs/vite#23602)) ([88c1741](vitejs/vite@88c1741))
- **html:** resolve percent-encoded srcset urls ([#23609](vitejs/vite#23609)) ([53f1ce7](vitejs/vite@53f1ce7))
- limit size of object and array printing via `forwardConsole` ([#23565](vitejs/vite#23565)) ([e64a587](vitejs/vite@e64a587))
- merge `build.rolldownOptions.output.minify` correctly ([#23536](vitejs/vite#23536)) ([bba3bb8](vitejs/vite@bba3bb8))
- **optimize-deps:** avoid "unsupported" warnings for browser:false mappings ([#23590](vitejs/vite#23590)) ([5e4b9ca](vitejs/vite@5e4b9ca))
- **optimizer:** preserve excluded optional peer require fallbacks ([#23600](vitejs/vite#23600)) ([a2bd6fa](vitejs/vite@a2bd6fa))
- pass queries to `renderBuiltUrl` ([#23586](vitejs/vite#23586)) ([744269e](vitejs/vite@744269e))
- **server:** handle file watcher errors without crashing ([#23503](vitejs/vite#23503)) ([6894f5c](vitejs/vite@6894f5c))
- **server:** release previous environments after initialization ([#23499](vitejs/vite#23499)) ([5a3a010](vitejs/vite@5a3a010))
- **ssr:** encode whitespace in module runner sourceURL ([#23513](vitejs/vite#23513)) ([bbc8812](vitejs/vite@bbc8812))
- **worker:** align worker urls in client and server when using terser ([#23614](vitejs/vite#23614)) ([24bd331](vitejs/vite@24bd331))

##### Performance Improvements

- avoid encoding intermediate source maps ([#23461](vitejs/vite#23461)) ([89574f6](vitejs/vite@89574f6))
- **build:** avoid quadratic link scan in the preload helper ([#23510](vitejs/vite#23510)) ([cf5c028](vitejs/vite@cf5c028))
- only register time middleware when debug logging is enabled ([#23621](vitejs/vite#23621)) ([94d0080](vitejs/vite@94d0080))

##### Documentation

- fix dead og-image PNG links in vite6/vite7 changelog entries ([#23594](vitejs/vite#23594)) ([1929b4c](vitejs/vite@1929b4c))

##### Miscellaneous Chores

- **deps:** update vitest monorepo to v5 ([#23604](vitejs/vite#23604)) ([24339f4](vitejs/vite@24339f4))

##### Code Refactoring

- use `tinyexec` instead of `cross-spawn` ([#23583](vitejs/vite#23583)) ([db915e5](vitejs/vite@db915e5))

##### Tests

- **bundled-dev:** accept a rolldown dev runtime with no helper imports ([#23606](vitejs/vite#23606)) ([634745d](vitejs/vite@634745d))


## [v8.3.1](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-831-2026-09-24-small)

##### Bug Fixes

- **deps:** update all non-major dependencies ([#23482](vitejs/vite#23482)) ([3c752c8](vitejs/vite@3c752c8))
- **deps:** update all non-major dependencies ([#23537](vitejs/vite#23537)) ([e8990c4](vitejs/vite@e8990c4))
- **deps:** update rolldown-related dependencies ([#23483](vitejs/vite#23483)) ([9aecbbf](vitejs/vite@9aecbbf))
- handle `server.ws: false` in mergeConfig ([#23511](vitejs/vite#23511)) ([f68c0d5](vitejs/vite@f68c0d5))
- merge `build.rolldownOptions.output.comments` correctly ([#23514](vitejs/vite#23514)) ([4aba8d8](vitejs/vite@4aba8d8))
- **optimizer:** don't skip imports whose binding starts with type ([#23540](vitejs/vite#23540)) ([39330f4](vitejs/vite@39330f4))
- **optimizer:** resolve pending discovered dep processing on close before init ([#23567](vitejs/vite#23567)) ([5f89433](vitejs/vite@5f89433))
- **server:** avoid reinitializing watcher when adding file after server close ([#23572](vitejs/vite#23572)) ([6f831f9](vitejs/vite@6f831f9))
- **sourcemap:** skip URL source roots when injecting sources content ([#23519](vitejs/vite#23519)) ([04fc30a](vitejs/vite@04fc30a))

##### Miscellaneous Chores

- merge prereleases in changelog ([#23466](vitejs/vite#23466)) ([99bd9d1](vitejs/vite@99bd9d1))
- **optimizer:** add debug log when waiting for dep before init ([#23566](vitejs/vite#23566)) ([63567c7](vitejs/vite@63567c7))
- update `optimizeDeps.include` comment ([#23489](vitejs/vite#23489)) ([6a84c72](vitejs/vite@6a84c72))

##### Code Refactoring

- assets regexp use non-capture ([#23491](vitejs/vite#23491)) ([f4b4431](vitejs/vite@f4b4431))
- remove duplicate configurations ([#23532](vitejs/vite#23532)) ([9abd99b](vitejs/vite@9abd99b))
- replace `find` with `some` ([#23554](vitejs/vite#23554)) ([af7cdf6](vitejs/vite@af7cdf6))
This was referenced Oct 7, 2026
Closed
Closed
james-elicx added a commit to cloudflare/vinext that referenced this pull request Oct 7, 2026
@james-elicx
fix(dev): stop Vite from watching the filesystem root for /?query pages
b70b575 
Vite 8.3.3 (vitejs/vite#23653) strips the query before mapping the
transformIndexHtml URL to a file, so `/?q` now resolves to the project
root directory. Because that directory exists and the query hides the
trailing slash, Vite treats `/?q` as a real file and gives each inline
<style> proxy module the file `/`, then calls watcher.add("/"). On
Linux chokidar crawls the whole filesystem with one fs.watch per file,
which ran the Pages _document integration tests out of memory.

The query has no meaning for the HTML transform, so the Pages dev server
now passes the bare path, which keeps Vite's virtual proxy modules.
@james-elicx james-elicx mentioned this pull request Oct 7, 2026
Closed
james-elicx added a commit to cloudflare/vinext that referenced this pull request Oct 7, 2026
@james-elicx
chore(deps): upgrade vite-plus to 1.1.0 (#3748)
7fe4bf3 
* chore(deps): upgrade vite-plus to 1.1.0

Bumps vite-plus and the vite-plus-core vite alias from 0.3.2 to 1.1.0
across the workspace catalog, along with vitest and
@vitest/coverage-istanbul 5.0.3 to match the vitest version vite-plus
1.1.0 bundles. Reformats apps/web globals.css for the new oxfmt.

* fix: adapt CI to vite-plus 1.1.0

vite-plus no longer ships an oxlint bin, so knip now treats the oxlint
that `vinext lint` invokes as a consumer-project binary, like eslint.

Vitest 5 clears mocks between tests by default, so the prerender
Cloudflare loader test captures the once-per-process register() call
before any test runs.

* fix(dev): stop Vite from watching the filesystem root for /?query pages

Vite 8.3.3 (vitejs/vite#23653) strips the query before mapping the
transformIndexHtml URL to a file, so `/?q` now resolves to the project
root directory. Because that directory exists and the query hides the
trailing slash, Vite treats `/?q` as a real file and gives each inline
<style> proxy module the file `/`, then calls watcher.add("/"). On
Linux chokidar crawls the whole filesystem with one fs.watch per file,
which ran the Pages _document integration tests out of memory.

The query has no meaning for the HTML transform, so the Pages dev server
now passes the bare path, which keeps Vite's virtual proxy modules.

* ci: point vitest 5 merge-reports at the downloaded shard blobs

Vitest 5 reads --merge-reports from .vitest/blob by default, but the
integration shards upload and the report job downloads their blobs into
.vitest-reports.
@sapphi-red sapphi-red mentioned this pull request Oct 8, 2026
Merged
@india3Eth india3Eth mentioned this pull request Oct 8, 2026
Closed
dadezzz pushed a commit to dadezzz/university_notes that referenced this pull request Oct 9, 2026
Renovate [bot] Forgejo
fix(deps): update dependency vite to v8.3.3 (#1075)
0458f4c 
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [vite](https://vite.dev) ([source](https://github.com/vitejs/vite/tree/HEAD/packages/vite)) | [`8.3.2` → `8.3.3`](https://renovatebot.com/diffs/npm/vite/8.3.2/8.3.3) | ![age](https://developer.mend.io/api/mc/badges/age/npm/vite/8.3.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vite/8.3.2/8.3.3?slim=true) |

---

### Release Notes

<details>
<summary>vitejs/vite (vite)</summary>

### [`v8.3.3`](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-833-2026-10-06-small)

[Compare Source](vitejs/vite@v8.3.2...v8.3.3)

##### Bug Fixes

- **deps:** update launch-editor to v2.14.2 ([#&#8203;23654](vitejs/vite#23654)) ([22fd1d5](vitejs/vite@22fd1d5))
- **html:** filename passed to transformIndexHtml should not include queries ([#&#8203;23653](vitejs/vite#23653)) ([7dafd8e](vitejs/vite@7dafd8e))
- **server:** check `fs.serve` for `?vite-wasm-instance` ([#&#8203;23655](vitejs/vite#23655)) ([ba8b7ab](vitejs/vite@ba8b7ab))
- **server:** store ids to `safeModulePaths` rather than URLs ([#&#8203;23656](vitejs/vite#23656)) ([c3e06f9](vitejs/vite@c3e06f9))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNDUuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE0NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
dadezzz pushed a commit to dadezzz/events-cash-register that referenced this pull request Oct 9, 2026
Renovate [bot] Forgejo
fix(deps): update dependency vite to v8.3.3 (#327)
7b8bd3b 
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [vite](https://vite.dev) ([source](https://github.com/vitejs/vite/tree/HEAD/packages/vite)) | [`8.3.2` → `8.3.3`](https://renovatebot.com/diffs/npm/vite/8.3.2/8.3.3) | ![age](https://developer.mend.io/api/mc/badges/age/npm/vite/8.3.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vite/8.3.2/8.3.3?slim=true) |

---

### Release Notes

<details>
<summary>vitejs/vite (vite)</summary>

### [`v8.3.3`](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-833-2026-10-06-small)

[Compare Source](vitejs/vite@v8.3.2...v8.3.3)

##### Bug Fixes

- **deps:** update launch-editor to v2.14.2 ([#&#8203;23654](vitejs/vite#23654)) ([22fd1d5](vitejs/vite@22fd1d5))
- **html:** filename passed to transformIndexHtml should not include queries ([#&#8203;23653](vitejs/vite#23653)) ([7dafd8e](vitejs/vite@7dafd8e))
- **server:** check `fs.serve` for `?vite-wasm-instance` ([#&#8203;23655](vitejs/vite#23655)) ([ba8b7ab](vitejs/vite@ba8b7ab))
- **server:** store ids to `safeModulePaths` rather than URLs ([#&#8203;23656](vitejs/vite#23656)) ([c3e06f9](vitejs/vite@c3e06f9))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNDUuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE0NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
renovate Bot added a commit to andrei-picus-tink/auto-renovate that referenced this pull request Oct 9, 2026
@renovate
Update dependency vite to v8.3.4
30fd1f2 
| datasource | package | from  | to    |
| ---------- | ------- | ----- | ----- |
| npm        | vite    | 8.3.0 | 8.3.4 |


## [v8.3.4](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-834-2026-10-08-small)

##### Features

- **bundled-dev:** support `import.meta.hot.acceptExports` ([#23463](vitejs/vite#23463)) ([bc0f21c](vitejs/vite@bc0f21c))

##### Bug Fixes

- avoid mutating hmr defaults (fix [#23575](vitejs/vite#23575)) ([#23576](vitejs/vite#23576)) ([574d5e3](vitejs/vite@574d5e3))
- **build:** correct preloads when chunkImportMap is enabled with non-root base ([#23698](vitejs/vite#23698)) ([2a8c0f0](vitejs/vite@2a8c0f0))
- **build:** wait for in-flight stylesheets in preload helper (fix [#23652](vitejs/vite#23652)) ([#23662](vitejs/vite#23662)) ([036b745](vitejs/vite@036b745))
- **bundled-dev:** serve `/@vite/client` and stub `@vite/env` ([#23664](vitejs/vite#23664)) ([5afc5a8](vitejs/vite@5afc5a8))
- **client:** skip rewriting unchanged adopted styles ([#23697](vitejs/vite#23697)) ([fa71469](vitejs/vite@fa71469))
- **css:** resolve imported preprocessors from their file path with lightningcss ([#23688](vitejs/vite#23688)) ([cf52011](vitejs/vite@cf52011))
- **deps:** update all non-major dependencies ([#23648](vitejs/vite#23648)) ([8a4c19c](vitejs/vite@8a4c19c))
- **deps:** update rolldown-related dependencies ([#23649](vitejs/vite#23649)) ([794516d](vitejs/vite@794516d))
- **dev:** a restart requested during a restart used to be dropped (fix [#23392](vitejs/vite#23392)) ([#23484](vitejs/vite#23484)) ([70d56ea](vitejs/vite@70d56ea))
- don't treat modules ending with js-like query as js ([#23687](vitejs/vite#23687)) ([fcb6f12](vitejs/vite@fcb6f12))
- **html:** avoid adding filesystem root to watcher ([#23689](vitejs/vite#23689)) ([3a7f2ae](vitejs/vite@3a7f2ae))
- **html:** skip caching CSS of chunks in a cycle (fix [#23628](vitejs/vite#23628)) ([#23636](vitejs/vite#23636)) ([15d82f7](vitejs/vite@15d82f7))
- **optimizer:** scan deep imports with custom extensions ([#23678](vitejs/vite#23678)) ([8579189](vitejs/vite@8579189))
- remove input option unescaping for now ([#23694](vitejs/vite#23694)) ([facc2fb](vitejs/vite@facc2fb))
- **server:** match static aliases on path boundaries ([#23643](vitejs/vite#23643)) ([b28db28](vitejs/vite@b28db28))
- **watcher:** normalize file before root check in `ensureWatchedFile` ([#23673](vitejs/vite#23673)) ([12bb28c](vitejs/vite@12bb28c))

##### Performance Improvements

- **module-runner:** skip cloning call sites that have no source map ([#23646](vitejs/vite#23646)) ([3d67486](vitejs/vite@3d67486))

##### Code Refactoring

- **bundled-dev:** import CSS HMR helpers from `/@vite/client` ([#23674](vitejs/vite#23674)) ([182f5b2](vitejs/vite@182f5b2))


## [v8.3.3](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-833-2026-10-06-small)

##### Bug Fixes

- **deps:** update launch-editor to v2.14.2 ([#23654](vitejs/vite#23654)) ([22fd1d5](vitejs/vite@22fd1d5))
- **html:** filename passed to transformIndexHtml should not include queries ([#23653](vitejs/vite#23653)) ([7dafd8e](vitejs/vite@7dafd8e))
- **server:** check `fs.serve` for `?vite-wasm-instance` ([#23655](vitejs/vite#23655)) ([ba8b7ab](vitejs/vite@ba8b7ab))
- **server:** store ids to `safeModulePaths` rather than URLs ([#23656](vitejs/vite#23656)) ([c3e06f9](vitejs/vite@c3e06f9))


## [v8.3.2](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-832-2026-10-01-small)

##### Bug Fixes

- **build:** preload CSS correctly when `renderBuiltUrl` returns URLs with queries ([#23611](vitejs/vite#23611)) ([64e0a21](vitejs/vite@64e0a21))
- **bundled-dev:** serve lazy chunk sourcemaps ([#23026](vitejs/vite#23026)) ([eb7aa9a](vitejs/vite@eb7aa9a))
- **bundled-dev:** serve the rolldown runtime from the installed rolldown ([#23568](vitejs/vite#23568)) ([bc598a6](vitejs/vite@bc598a6))
- **deps:** update all non-major dependencies ([#23601](vitejs/vite#23601)) ([9944fa6](vitejs/vite@9944fa6))
- **deps:** update rolldown-related dependencies ([#23602](vitejs/vite#23602)) ([88c1741](vitejs/vite@88c1741))
- **html:** resolve percent-encoded srcset urls ([#23609](vitejs/vite#23609)) ([53f1ce7](vitejs/vite@53f1ce7))
- limit size of object and array printing via `forwardConsole` ([#23565](vitejs/vite#23565)) ([e64a587](vitejs/vite@e64a587))
- merge `build.rolldownOptions.output.minify` correctly ([#23536](vitejs/vite#23536)) ([bba3bb8](vitejs/vite@bba3bb8))
- **optimize-deps:** avoid "unsupported" warnings for browser:false mappings ([#23590](vitejs/vite#23590)) ([5e4b9ca](vitejs/vite@5e4b9ca))
- **optimizer:** preserve excluded optional peer require fallbacks ([#23600](vitejs/vite#23600)) ([a2bd6fa](vitejs/vite@a2bd6fa))
- pass queries to `renderBuiltUrl` ([#23586](vitejs/vite#23586)) ([744269e](vitejs/vite@744269e))
- **server:** handle file watcher errors without crashing ([#23503](vitejs/vite#23503)) ([6894f5c](vitejs/vite@6894f5c))
- **server:** release previous environments after initialization ([#23499](vitejs/vite#23499)) ([5a3a010](vitejs/vite@5a3a010))
- **ssr:** encode whitespace in module runner sourceURL ([#23513](vitejs/vite#23513)) ([bbc8812](vitejs/vite@bbc8812))
- **worker:** align worker urls in client and server when using terser ([#23614](vitejs/vite#23614)) ([24bd331](vitejs/vite@24bd331))

##### Performance Improvements

- avoid encoding intermediate source maps ([#23461](vitejs/vite#23461)) ([89574f6](vitejs/vite@89574f6))
- **build:** avoid quadratic link scan in the preload helper ([#23510](vitejs/vite#23510)) ([cf5c028](vitejs/vite@cf5c028))
- only register time middleware when debug logging is enabled ([#23621](vitejs/vite#23621)) ([94d0080](vitejs/vite@94d0080))

##### Documentation

- fix dead og-image PNG links in vite6/vite7 changelog entries ([#23594](vitejs/vite#23594)) ([1929b4c](vitejs/vite@1929b4c))

##### Miscellaneous Chores

- **deps:** update vitest monorepo to v5 ([#23604](vitejs/vite#23604)) ([24339f4](vitejs/vite@24339f4))

##### Code Refactoring

- use `tinyexec` instead of `cross-spawn` ([#23583](vitejs/vite#23583)) ([db915e5](vitejs/vite@db915e5))

##### Tests

- **bundled-dev:** accept a rolldown dev runtime with no helper imports ([#23606](vitejs/vite#23606)) ([634745d](vitejs/vite@634745d))


## [v8.3.1](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-831-2026-09-24-small)

##### Bug Fixes

- **deps:** update all non-major dependencies ([#23482](vitejs/vite#23482)) ([3c752c8](vitejs/vite@3c752c8))
- **deps:** update all non-major dependencies ([#23537](vitejs/vite#23537)) ([e8990c4](vitejs/vite@e8990c4))
- **deps:** update rolldown-related dependencies ([#23483](vitejs/vite#23483)) ([9aecbbf](vitejs/vite@9aecbbf))
- handle `server.ws: false` in mergeConfig ([#23511](vitejs/vite#23511)) ([f68c0d5](vitejs/vite@f68c0d5))
- merge `build.rolldownOptions.output.comments` correctly ([#23514](vitejs/vite#23514)) ([4aba8d8](vitejs/vite@4aba8d8))
- **optimizer:** don't skip imports whose binding starts with type ([#23540](vitejs/vite#23540)) ([39330f4](vitejs/vite@39330f4))
- **optimizer:** resolve pending discovered dep processing on close before init ([#23567](vitejs/vite#23567)) ([5f89433](vitejs/vite@5f89433))
- **server:** avoid reinitializing watcher when adding file after server close ([#23572](vitejs/vite#23572)) ([6f831f9](vitejs/vite@6f831f9))
- **sourcemap:** skip URL source roots when injecting sources content ([#23519](vitejs/vite#23519)) ([04fc30a](vitejs/vite@04fc30a))

##### Miscellaneous Chores

- merge prereleases in changelog ([#23466](vitejs/vite#23466)) ([99bd9d1](vitejs/vite@99bd9d1))
- **optimizer:** add debug log when waiting for dep before init ([#23566](vitejs/vite#23566)) ([63567c7](vitejs/vite@63567c7))
- update `optimizeDeps.include` comment ([#23489](vitejs/vite#23489)) ([6a84c72](vitejs/vite@6a84c72))

##### Code Refactoring

- assets regexp use non-capture ([#23491](vitejs/vite#23491)) ([f4b4431](vitejs/vite@f4b4431))
- remove duplicate configurations ([#23532](vitejs/vite#23532)) ([9abd99b](vitejs/vite@9abd99b))
- replace `find` with `some` ([#23554](vitejs/vite#23554)) ([af7cdf6](vitejs/vite@af7cdf6))
renovate Bot added a commit to andrei-picus-tink/auto-renovate that referenced this pull request Oct 10, 2026
@renovate
Update dependency vite to v8.3.4
1893ab3 
| datasource | package | from  | to    |
| ---------- | ------- | ----- | ----- |
| npm        | vite    | 8.3.0 | 8.3.4 |


## [v8.3.4](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-834-2026-10-08-small)

##### Features

- **bundled-dev:** support `import.meta.hot.acceptExports` ([#23463](vitejs/vite#23463)) ([bc0f21c](vitejs/vite@bc0f21c))

##### Bug Fixes

- avoid mutating hmr defaults (fix [#23575](vitejs/vite#23575)) ([#23576](vitejs/vite#23576)) ([574d5e3](vitejs/vite@574d5e3))
- **build:** correct preloads when chunkImportMap is enabled with non-root base ([#23698](vitejs/vite#23698)) ([2a8c0f0](vitejs/vite@2a8c0f0))
- **build:** wait for in-flight stylesheets in preload helper (fix [#23652](vitejs/vite#23652)) ([#23662](vitejs/vite#23662)) ([036b745](vitejs/vite@036b745))
- **bundled-dev:** serve `/@vite/client` and stub `@vite/env` ([#23664](vitejs/vite#23664)) ([5afc5a8](vitejs/vite@5afc5a8))
- **client:** skip rewriting unchanged adopted styles ([#23697](vitejs/vite#23697)) ([fa71469](vitejs/vite@fa71469))
- **css:** resolve imported preprocessors from their file path with lightningcss ([#23688](vitejs/vite#23688)) ([cf52011](vitejs/vite@cf52011))
- **deps:** update all non-major dependencies ([#23648](vitejs/vite#23648)) ([8a4c19c](vitejs/vite@8a4c19c))
- **deps:** update rolldown-related dependencies ([#23649](vitejs/vite#23649)) ([794516d](vitejs/vite@794516d))
- **dev:** a restart requested during a restart used to be dropped (fix [#23392](vitejs/vite#23392)) ([#23484](vitejs/vite#23484)) ([70d56ea](vitejs/vite@70d56ea))
- don't treat modules ending with js-like query as js ([#23687](vitejs/vite#23687)) ([fcb6f12](vitejs/vite@fcb6f12))
- **html:** avoid adding filesystem root to watcher ([#23689](vitejs/vite#23689)) ([3a7f2ae](vitejs/vite@3a7f2ae))
- **html:** skip caching CSS of chunks in a cycle (fix [#23628](vitejs/vite#23628)) ([#23636](vitejs/vite#23636)) ([15d82f7](vitejs/vite@15d82f7))
- **optimizer:** scan deep imports with custom extensions ([#23678](vitejs/vite#23678)) ([8579189](vitejs/vite@8579189))
- remove input option unescaping for now ([#23694](vitejs/vite#23694)) ([facc2fb](vitejs/vite@facc2fb))
- **server:** match static aliases on path boundaries ([#23643](vitejs/vite#23643)) ([b28db28](vitejs/vite@b28db28))
- **watcher:** normalize file before root check in `ensureWatchedFile` ([#23673](vitejs/vite#23673)) ([12bb28c](vitejs/vite@12bb28c))

##### Performance Improvements

- **module-runner:** skip cloning call sites that have no source map ([#23646](vitejs/vite#23646)) ([3d67486](vitejs/vite@3d67486))

##### Code Refactoring

- **bundled-dev:** import CSS HMR helpers from `/@vite/client` ([#23674](vitejs/vite#23674)) ([182f5b2](vitejs/vite@182f5b2))


## [v8.3.3](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-833-2026-10-06-small)

##### Bug Fixes

- **deps:** update launch-editor to v2.14.2 ([#23654](vitejs/vite#23654)) ([22fd1d5](vitejs/vite@22fd1d5))
- **html:** filename passed to transformIndexHtml should not include queries ([#23653](vitejs/vite#23653)) ([7dafd8e](vitejs/vite@7dafd8e))
- **server:** check `fs.serve` for `?vite-wasm-instance` ([#23655](vitejs/vite#23655)) ([ba8b7ab](vitejs/vite@ba8b7ab))
- **server:** store ids to `safeModulePaths` rather than URLs ([#23656](vitejs/vite#23656)) ([c3e06f9](vitejs/vite@c3e06f9))


## [v8.3.2](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-832-2026-10-01-small)

##### Bug Fixes

- **build:** preload CSS correctly when `renderBuiltUrl` returns URLs with queries ([#23611](vitejs/vite#23611)) ([64e0a21](vitejs/vite@64e0a21))
- **bundled-dev:** serve lazy chunk sourcemaps ([#23026](vitejs/vite#23026)) ([eb7aa9a](vitejs/vite@eb7aa9a))
- **bundled-dev:** serve the rolldown runtime from the installed rolldown ([#23568](vitejs/vite#23568)) ([bc598a6](vitejs/vite@bc598a6))
- **deps:** update all non-major dependencies ([#23601](vitejs/vite#23601)) ([9944fa6](vitejs/vite@9944fa6))
- **deps:** update rolldown-related dependencies ([#23602](vitejs/vite#23602)) ([88c1741](vitejs/vite@88c1741))
- **html:** resolve percent-encoded srcset urls ([#23609](vitejs/vite#23609)) ([53f1ce7](vitejs/vite@53f1ce7))
- limit size of object and array printing via `forwardConsole` ([#23565](vitejs/vite#23565)) ([e64a587](vitejs/vite@e64a587))
- merge `build.rolldownOptions.output.minify` correctly ([#23536](vitejs/vite#23536)) ([bba3bb8](vitejs/vite@bba3bb8))
- **optimize-deps:** avoid "unsupported" warnings for browser:false mappings ([#23590](vitejs/vite#23590)) ([5e4b9ca](vitejs/vite@5e4b9ca))
- **optimizer:** preserve excluded optional peer require fallbacks ([#23600](vitejs/vite#23600)) ([a2bd6fa](vitejs/vite@a2bd6fa))
- pass queries to `renderBuiltUrl` ([#23586](vitejs/vite#23586)) ([744269e](vitejs/vite@744269e))
- **server:** handle file watcher errors without crashing ([#23503](vitejs/vite#23503)) ([6894f5c](vitejs/vite@6894f5c))
- **server:** release previous environments after initialization ([#23499](vitejs/vite#23499)) ([5a3a010](vitejs/vite@5a3a010))
- **ssr:** encode whitespace in module runner sourceURL ([#23513](vitejs/vite#23513)) ([bbc8812](vitejs/vite@bbc8812))
- **worker:** align worker urls in client and server when using terser ([#23614](vitejs/vite#23614)) ([24bd331](vitejs/vite@24bd331))

##### Performance Improvements

- avoid encoding intermediate source maps ([#23461](vitejs/vite#23461)) ([89574f6](vitejs/vite@89574f6))
- **build:** avoid quadratic link scan in the preload helper ([#23510](vitejs/vite#23510)) ([cf5c028](vitejs/vite@cf5c028))
- only register time middleware when debug logging is enabled ([#23621](vitejs/vite#23621)) ([94d0080](vitejs/vite@94d0080))

##### Documentation

- fix dead og-image PNG links in vite6/vite7 changelog entries ([#23594](vitejs/vite#23594)) ([1929b4c](vitejs/vite@1929b4c))

##### Miscellaneous Chores

- **deps:** update vitest monorepo to v5 ([#23604](vitejs/vite#23604)) ([24339f4](vitejs/vite@24339f4))

##### Code Refactoring

- use `tinyexec` instead of `cross-spawn` ([#23583](vitejs/vite#23583)) ([db915e5](vitejs/vite@db915e5))

##### Tests

- **bundled-dev:** accept a rolldown dev runtime with no helper imports ([#23606](vitejs/vite#23606)) ([634745d](vitejs/vite@634745d))


## [v8.3.1](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-831-2026-09-24-small)

##### Bug Fixes

- **deps:** update all non-major dependencies ([#23482](vitejs/vite#23482)) ([3c752c8](vitejs/vite@3c752c8))
- **deps:** update all non-major dependencies ([#23537](vitejs/vite#23537)) ([e8990c4](vitejs/vite@e8990c4))
- **deps:** update rolldown-related dependencies ([#23483](vitejs/vite#23483)) ([9aecbbf](vitejs/vite@9aecbbf))
- handle `server.ws: false` in mergeConfig ([#23511](vitejs/vite#23511)) ([f68c0d5](vitejs/vite@f68c0d5))
- merge `build.rolldownOptions.output.comments` correctly ([#23514](vitejs/vite#23514)) ([4aba8d8](vitejs/vite@4aba8d8))
- **optimizer:** don't skip imports whose binding starts with type ([#23540](vitejs/vite#23540)) ([39330f4](vitejs/vite@39330f4))
- **optimizer:** resolve pending discovered dep processing on close before init ([#23567](vitejs/vite#23567)) ([5f89433](vitejs/vite@5f89433))
- **server:** avoid reinitializing watcher when adding file after server close ([#23572](vitejs/vite#23572)) ([6f831f9](vitejs/vite@6f831f9))
- **sourcemap:** skip URL source roots when injecting sources content ([#23519](vitejs/vite#23519)) ([04fc30a](vitejs/vite@04fc30a))

##### Miscellaneous Chores

- merge prereleases in changelog ([#23466](vitejs/vite#23466)) ([99bd9d1](vitejs/vite@99bd9d1))
- **optimizer:** add debug log when waiting for dep before init ([#23566](vitejs/vite#23566)) ([63567c7](vitejs/vite@63567c7))
- update `optimizeDeps.include` comment ([#23489](vitejs/vite#23489)) ([6a84c72](vitejs/vite@6a84c72))

##### Code Refactoring

- assets regexp use non-capture ([#23491](vitejs/vite#23491)) ([f4b4431](vitejs/vite@f4b4431))
- remove duplicate configurations ([#23532](vitejs/vite#23532)) ([9abd99b](vitejs/vite@9abd99b))
- replace `find` with `some` ([#23554](vitejs/vite#23554)) ([af7cdf6](vitejs/vite@af7cdf6))
renovate Bot added a commit to andrei-picus-tink/auto-renovate that referenced this pull request Oct 11, 2026
@renovate
Update dependency vite to v8.3.4
60d868e 
| datasource | package | from  | to    |
| ---------- | ------- | ----- | ----- |
| npm        | vite    | 8.3.0 | 8.3.4 |


## [v8.3.4](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-834-2026-10-08-small)

##### Features

- **bundled-dev:** support `import.meta.hot.acceptExports` ([#23463](vitejs/vite#23463)) ([bc0f21c](vitejs/vite@bc0f21c))

##### Bug Fixes

- avoid mutating hmr defaults (fix [#23575](vitejs/vite#23575)) ([#23576](vitejs/vite#23576)) ([574d5e3](vitejs/vite@574d5e3))
- **build:** correct preloads when chunkImportMap is enabled with non-root base ([#23698](vitejs/vite#23698)) ([2a8c0f0](vitejs/vite@2a8c0f0))
- **build:** wait for in-flight stylesheets in preload helper (fix [#23652](vitejs/vite#23652)) ([#23662](vitejs/vite#23662)) ([036b745](vitejs/vite@036b745))
- **bundled-dev:** serve `/@vite/client` and stub `@vite/env` ([#23664](vitejs/vite#23664)) ([5afc5a8](vitejs/vite@5afc5a8))
- **client:** skip rewriting unchanged adopted styles ([#23697](vitejs/vite#23697)) ([fa71469](vitejs/vite@fa71469))
- **css:** resolve imported preprocessors from their file path with lightningcss ([#23688](vitejs/vite#23688)) ([cf52011](vitejs/vite@cf52011))
- **deps:** update all non-major dependencies ([#23648](vitejs/vite#23648)) ([8a4c19c](vitejs/vite@8a4c19c))
- **deps:** update rolldown-related dependencies ([#23649](vitejs/vite#23649)) ([794516d](vitejs/vite@794516d))
- **dev:** a restart requested during a restart used to be dropped (fix [#23392](vitejs/vite#23392)) ([#23484](vitejs/vite#23484)) ([70d56ea](vitejs/vite@70d56ea))
- don't treat modules ending with js-like query as js ([#23687](vitejs/vite#23687)) ([fcb6f12](vitejs/vite@fcb6f12))
- **html:** avoid adding filesystem root to watcher ([#23689](vitejs/vite#23689)) ([3a7f2ae](vitejs/vite@3a7f2ae))
- **html:** skip caching CSS of chunks in a cycle (fix [#23628](vitejs/vite#23628)) ([#23636](vitejs/vite#23636)) ([15d82f7](vitejs/vite@15d82f7))
- **optimizer:** scan deep imports with custom extensions ([#23678](vitejs/vite#23678)) ([8579189](vitejs/vite@8579189))
- remove input option unescaping for now ([#23694](vitejs/vite#23694)) ([facc2fb](vitejs/vite@facc2fb))
- **server:** match static aliases on path boundaries ([#23643](vitejs/vite#23643)) ([b28db28](vitejs/vite@b28db28))
- **watcher:** normalize file before root check in `ensureWatchedFile` ([#23673](vitejs/vite#23673)) ([12bb28c](vitejs/vite@12bb28c))

##### Performance Improvements

- **module-runner:** skip cloning call sites that have no source map ([#23646](vitejs/vite#23646)) ([3d67486](vitejs/vite@3d67486))

##### Code Refactoring

- **bundled-dev:** import CSS HMR helpers from `/@vite/client` ([#23674](vitejs/vite#23674)) ([182f5b2](vitejs/vite@182f5b2))


## [v8.3.3](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-833-2026-10-06-small)

##### Bug Fixes

- **deps:** update launch-editor to v2.14.2 ([#23654](vitejs/vite#23654)) ([22fd1d5](vitejs/vite@22fd1d5))
- **html:** filename passed to transformIndexHtml should not include queries ([#23653](vitejs/vite#23653)) ([7dafd8e](vitejs/vite@7dafd8e))
- **server:** check `fs.serve` for `?vite-wasm-instance` ([#23655](vitejs/vite#23655)) ([ba8b7ab](vitejs/vite@ba8b7ab))
- **server:** store ids to `safeModulePaths` rather than URLs ([#23656](vitejs/vite#23656)) ([c3e06f9](vitejs/vite@c3e06f9))


## [v8.3.2](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-832-2026-10-01-small)

##### Bug Fixes

- **build:** preload CSS correctly when `renderBuiltUrl` returns URLs with queries ([#23611](vitejs/vite#23611)) ([64e0a21](vitejs/vite@64e0a21))
- **bundled-dev:** serve lazy chunk sourcemaps ([#23026](vitejs/vite#23026)) ([eb7aa9a](vitejs/vite@eb7aa9a))
- **bundled-dev:** serve the rolldown runtime from the installed rolldown ([#23568](vitejs/vite#23568)) ([bc598a6](vitejs/vite@bc598a6))
- **deps:** update all non-major dependencies ([#23601](vitejs/vite#23601)) ([9944fa6](vitejs/vite@9944fa6))
- **deps:** update rolldown-related dependencies ([#23602](vitejs/vite#23602)) ([88c1741](vitejs/vite@88c1741))
- **html:** resolve percent-encoded srcset urls ([#23609](vitejs/vite#23609)) ([53f1ce7](vitejs/vite@53f1ce7))
- limit size of object and array printing via `forwardConsole` ([#23565](vitejs/vite#23565)) ([e64a587](vitejs/vite@e64a587))
- merge `build.rolldownOptions.output.minify` correctly ([#23536](vitejs/vite#23536)) ([bba3bb8](vitejs/vite@bba3bb8))
- **optimize-deps:** avoid "unsupported" warnings for browser:false mappings ([#23590](vitejs/vite#23590)) ([5e4b9ca](vitejs/vite@5e4b9ca))
- **optimizer:** preserve excluded optional peer require fallbacks ([#23600](vitejs/vite#23600)) ([a2bd6fa](vitejs/vite@a2bd6fa))
- pass queries to `renderBuiltUrl` ([#23586](vitejs/vite#23586)) ([744269e](vitejs/vite@744269e))
- **server:** handle file watcher errors without crashing ([#23503](vitejs/vite#23503)) ([6894f5c](vitejs/vite@6894f5c))
- **server:** release previous environments after initialization ([#23499](vitejs/vite#23499)) ([5a3a010](vitejs/vite@5a3a010))
- **ssr:** encode whitespace in module runner sourceURL ([#23513](vitejs/vite#23513)) ([bbc8812](vitejs/vite@bbc8812))
- **worker:** align worker urls in client and server when using terser ([#23614](vitejs/vite#23614)) ([24bd331](vitejs/vite@24bd331))

##### Performance Improvements

- avoid encoding intermediate source maps ([#23461](vitejs/vite#23461)) ([89574f6](vitejs/vite@89574f6))
- **build:** avoid quadratic link scan in the preload helper ([#23510](vitejs/vite#23510)) ([cf5c028](vitejs/vite@cf5c028))
- only register time middleware when debug logging is enabled ([#23621](vitejs/vite#23621)) ([94d0080](vitejs/vite@94d0080))

##### Documentation

- fix dead og-image PNG links in vite6/vite7 changelog entries ([#23594](vitejs/vite#23594)) ([1929b4c](vitejs/vite@1929b4c))

##### Miscellaneous Chores

- **deps:** update vitest monorepo to v5 ([#23604](vitejs/vite#23604)) ([24339f4](vitejs/vite@24339f4))

##### Code Refactoring

- use `tinyexec` instead of `cross-spawn` ([#23583](vitejs/vite#23583)) ([db915e5](vitejs/vite@db915e5))

##### Tests

- **bundled-dev:** accept a rolldown dev runtime with no helper imports ([#23606](vitejs/vite#23606)) ([634745d](vitejs/vite@634745d))


## [v8.3.1](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-831-2026-09-24-small)

##### Bug Fixes

- **deps:** update all non-major dependencies ([#23482](vitejs/vite#23482)) ([3c752c8](vitejs/vite@3c752c8))
- **deps:** update all non-major dependencies ([#23537](vitejs/vite#23537)) ([e8990c4](vitejs/vite@e8990c4))
- **deps:** update rolldown-related dependencies ([#23483](vitejs/vite#23483)) ([9aecbbf](vitejs/vite@9aecbbf))
- handle `server.ws: false` in mergeConfig ([#23511](vitejs/vite#23511)) ([f68c0d5](vitejs/vite@f68c0d5))
- merge `build.rolldownOptions.output.comments` correctly ([#23514](vitejs/vite#23514)) ([4aba8d8](vitejs/vite@4aba8d8))
- **optimizer:** don't skip imports whose binding starts with type ([#23540](vitejs/vite#23540)) ([39330f4](vitejs/vite@39330f4))
- **optimizer:** resolve pending discovered dep processing on close before init ([#23567](vitejs/vite#23567)) ([5f89433](vitejs/vite@5f89433))
- **server:** avoid reinitializing watcher when adding file after server close ([#23572](vitejs/vite#23572)) ([6f831f9](vitejs/vite@6f831f9))
- **sourcemap:** skip URL source roots when injecting sources content ([#23519](vitejs/vite#23519)) ([04fc30a](vitejs/vite@04fc30a))

##### Miscellaneous Chores

- merge prereleases in changelog ([#23466](vitejs/vite#23466)) ([99bd9d1](vitejs/vite@99bd9d1))
- **optimizer:** add debug log when waiting for dep before init ([#23566](vitejs/vite#23566)) ([63567c7](vitejs/vite@63567c7))
- update `optimizeDeps.include` comment ([#23489](vitejs/vite#23489)) ([6a84c72](vitejs/vite@6a84c72))

##### Code Refactoring

- assets regexp use non-capture ([#23491](vitejs/vite#23491)) ([f4b4431](vitejs/vite@f4b4431))
- remove duplicate configurations ([#23532](vitejs/vite#23532)) ([9abd99b](vitejs/vite@9abd99b))
- replace `find` with `some` ([#23554](vitejs/vite#23554)) ([af7cdf6](vitejs/vite@af7cdf6))
renovate Bot added a commit to andrei-picus-tink/auto-renovate that referenced this pull request Oct 12, 2026
@renovate
Update dependency vite to v8.3.4
d66f8fb 
| datasource | package | from  | to    |
| ---------- | ------- | ----- | ----- |
| npm        | vite    | 8.3.0 | 8.3.4 |


## [v8.3.4](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-834-2026-10-08-small)

##### Features

- **bundled-dev:** support `import.meta.hot.acceptExports` ([#23463](vitejs/vite#23463)) ([bc0f21c](vitejs/vite@bc0f21c))

##### Bug Fixes

- avoid mutating hmr defaults (fix [#23575](vitejs/vite#23575)) ([#23576](vitejs/vite#23576)) ([574d5e3](vitejs/vite@574d5e3))
- **build:** correct preloads when chunkImportMap is enabled with non-root base ([#23698](vitejs/vite#23698)) ([2a8c0f0](vitejs/vite@2a8c0f0))
- **build:** wait for in-flight stylesheets in preload helper (fix [#23652](vitejs/vite#23652)) ([#23662](vitejs/vite#23662)) ([036b745](vitejs/vite@036b745))
- **bundled-dev:** serve `/@vite/client` and stub `@vite/env` ([#23664](vitejs/vite#23664)) ([5afc5a8](vitejs/vite@5afc5a8))
- **client:** skip rewriting unchanged adopted styles ([#23697](vitejs/vite#23697)) ([fa71469](vitejs/vite@fa71469))
- **css:** resolve imported preprocessors from their file path with lightningcss ([#23688](vitejs/vite#23688)) ([cf52011](vitejs/vite@cf52011))
- **deps:** update all non-major dependencies ([#23648](vitejs/vite#23648)) ([8a4c19c](vitejs/vite@8a4c19c))
- **deps:** update rolldown-related dependencies ([#23649](vitejs/vite#23649)) ([794516d](vitejs/vite@794516d))
- **dev:** a restart requested during a restart used to be dropped (fix [#23392](vitejs/vite#23392)) ([#23484](vitejs/vite#23484)) ([70d56ea](vitejs/vite@70d56ea))
- don't treat modules ending with js-like query as js ([#23687](vitejs/vite#23687)) ([fcb6f12](vitejs/vite@fcb6f12))
- **html:** avoid adding filesystem root to watcher ([#23689](vitejs/vite#23689)) ([3a7f2ae](vitejs/vite@3a7f2ae))
- **html:** skip caching CSS of chunks in a cycle (fix [#23628](vitejs/vite#23628)) ([#23636](vitejs/vite#23636)) ([15d82f7](vitejs/vite@15d82f7))
- **optimizer:** scan deep imports with custom extensions ([#23678](vitejs/vite#23678)) ([8579189](vitejs/vite@8579189))
- remove input option unescaping for now ([#23694](vitejs/vite#23694)) ([facc2fb](vitejs/vite@facc2fb))
- **server:** match static aliases on path boundaries ([#23643](vitejs/vite#23643)) ([b28db28](vitejs/vite@b28db28))
- **watcher:** normalize file before root check in `ensureWatchedFile` ([#23673](vitejs/vite#23673)) ([12bb28c](vitejs/vite@12bb28c))

##### Performance Improvements

- **module-runner:** skip cloning call sites that have no source map ([#23646](vitejs/vite#23646)) ([3d67486](vitejs/vite@3d67486))

##### Code Refactoring

- **bundled-dev:** import CSS HMR helpers from `/@vite/client` ([#23674](vitejs/vite#23674)) ([182f5b2](vitejs/vite@182f5b2))


## [v8.3.3](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-833-2026-10-06-small)

##### Bug Fixes

- **deps:** update launch-editor to v2.14.2 ([#23654](vitejs/vite#23654)) ([22fd1d5](vitejs/vite@22fd1d5))
- **html:** filename passed to transformIndexHtml should not include queries ([#23653](vitejs/vite#23653)) ([7dafd8e](vitejs/vite@7dafd8e))
- **server:** check `fs.serve` for `?vite-wasm-instance` ([#23655](vitejs/vite#23655)) ([ba8b7ab](vitejs/vite@ba8b7ab))
- **server:** store ids to `safeModulePaths` rather than URLs ([#23656](vitejs/vite#23656)) ([c3e06f9](vitejs/vite@c3e06f9))


## [v8.3.2](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-832-2026-10-01-small)

##### Bug Fixes

- **build:** preload CSS correctly when `renderBuiltUrl` returns URLs with queries ([#23611](vitejs/vite#23611)) ([64e0a21](vitejs/vite@64e0a21))
- **bundled-dev:** serve lazy chunk sourcemaps ([#23026](vitejs/vite#23026)) ([eb7aa9a](vitejs/vite@eb7aa9a))
- **bundled-dev:** serve the rolldown runtime from the installed rolldown ([#23568](vitejs/vite#23568)) ([bc598a6](vitejs/vite@bc598a6))
- **deps:** update all non-major dependencies ([#23601](vitejs/vite#23601)) ([9944fa6](vitejs/vite@9944fa6))
- **deps:** update rolldown-related dependencies ([#23602](vitejs/vite#23602)) ([88c1741](vitejs/vite@88c1741))
- **html:** resolve percent-encoded srcset urls ([#23609](vitejs/vite#23609)) ([53f1ce7](vitejs/vite@53f1ce7))
- limit size of object and array printing via `forwardConsole` ([#23565](vitejs/vite#23565)) ([e64a587](vitejs/vite@e64a587))
- merge `build.rolldownOptions.output.minify` correctly ([#23536](vitejs/vite#23536)) ([bba3bb8](vitejs/vite@bba3bb8))
- **optimize-deps:** avoid "unsupported" warnings for browser:false mappings ([#23590](vitejs/vite#23590)) ([5e4b9ca](vitejs/vite@5e4b9ca))
- **optimizer:** preserve excluded optional peer require fallbacks ([#23600](vitejs/vite#23600)) ([a2bd6fa](vitejs/vite@a2bd6fa))
- pass queries to `renderBuiltUrl` ([#23586](vitejs/vite#23586)) ([744269e](vitejs/vite@744269e))
- **server:** handle file watcher errors without crashing ([#23503](vitejs/vite#23503)) ([6894f5c](vitejs/vite@6894f5c))
- **server:** release previous environments after initialization ([#23499](vitejs/vite#23499)) ([5a3a010](vitejs/vite@5a3a010))
- **ssr:** encode whitespace in module runner sourceURL ([#23513](vitejs/vite#23513)) ([bbc8812](vitejs/vite@bbc8812))
- **worker:** align worker urls in client and server when using terser ([#23614](vitejs/vite#23614)) ([24bd331](vitejs/vite@24bd331))

##### Performance Improvements

- avoid encoding intermediate source maps ([#23461](vitejs/vite#23461)) ([89574f6](vitejs/vite@89574f6))
- **build:** avoid quadratic link scan in the preload helper ([#23510](vitejs/vite#23510)) ([cf5c028](vitejs/vite@cf5c028))
- only register time middleware when debug logging is enabled ([#23621](vitejs/vite#23621)) ([94d0080](vitejs/vite@94d0080))

##### Documentation

- fix dead og-image PNG links in vite6/vite7 changelog entries ([#23594](vitejs/vite#23594)) ([1929b4c](vitejs/vite@1929b4c))

##### Miscellaneous Chores

- **deps:** update vitest monorepo to v5 ([#23604](vitejs/vite#23604)) ([24339f4](vitejs/vite@24339f4))

##### Code Refactoring

- use `tinyexec` instead of `cross-spawn` ([#23583](vitejs/vite#23583)) ([db915e5](vitejs/vite@db915e5))

##### Tests

- **bundled-dev:** accept a rolldown dev runtime with no helper imports ([#23606](vitejs/vite#23606)) ([634745d](vitejs/vite@634745d))


## [v8.3.1](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-831-2026-09-24-small)

##### Bug Fixes

- **deps:** update all non-major dependencies ([#23482](vitejs/vite#23482)) ([3c752c8](vitejs/vite@3c752c8))
- **deps:** update all non-major dependencies ([#23537](vitejs/vite#23537)) ([e8990c4](vitejs/vite@e8990c4))
- **deps:** update rolldown-related dependencies ([#23483](vitejs/vite#23483)) ([9aecbbf](vitejs/vite@9aecbbf))
- handle `server.ws: false` in mergeConfig ([#23511](vitejs/vite#23511)) ([f68c0d5](vitejs/vite@f68c0d5))
- merge `build.rolldownOptions.output.comments` correctly ([#23514](vitejs/vite#23514)) ([4aba8d8](vitejs/vite@4aba8d8))
- **optimizer:** don't skip imports whose binding starts with type ([#23540](vitejs/vite#23540)) ([39330f4](vitejs/vite@39330f4))
- **optimizer:** resolve pending discovered dep processing on close before init ([#23567](vitejs/vite#23567)) ([5f89433](vitejs/vite@5f89433))
- **server:** avoid reinitializing watcher when adding file after server close ([#23572](vitejs/vite#23572)) ([6f831f9](vitejs/vite@6f831f9))
- **sourcemap:** skip URL source roots when injecting sources content ([#23519](vitejs/vite#23519)) ([04fc30a](vitejs/vite@04fc30a))

##### Miscellaneous Chores

- merge prereleases in changelog ([#23466](vitejs/vite#23466)) ([99bd9d1](vitejs/vite@99bd9d1))
- **optimizer:** add debug log when waiting for dep before init ([#23566](vitejs/vite#23566)) ([63567c7](vitejs/vite@63567c7))
- update `optimizeDeps.include` comment ([#23489](vitejs/vite#23489)) ([6a84c72](vitejs/vite@6a84c72))

##### Code Refactoring

- assets regexp use non-capture ([#23491](vitejs/vite#23491)) ([f4b4431](vitejs/vite@f4b4431))
- remove duplicate configurations ([#23532](vitejs/vite#23532)) ([9abd99b](vitejs/vite@9abd99b))
- replace `find` with `some` ([#23554](vitejs/vite#23554)) ([af7cdf6](vitejs/vite@af7cdf6))
renovate Bot added a commit to andrei-picus-tink/auto-renovate that referenced this pull request Oct 15, 2026
@renovate
Update dependency vite to v8.3.4
1dc861f 
| datasource | package | from  | to    |
| ---------- | ------- | ----- | ----- |
| npm        | vite    | 8.3.0 | 8.3.4 |


## [v8.3.4](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-834-2026-10-08-small)

##### Features

- **bundled-dev:** support `import.meta.hot.acceptExports` ([#23463](vitejs/vite#23463)) ([bc0f21c](vitejs/vite@bc0f21c))

##### Bug Fixes

- avoid mutating hmr defaults (fix [#23575](vitejs/vite#23575)) ([#23576](vitejs/vite#23576)) ([574d5e3](vitejs/vite@574d5e3))
- **build:** correct preloads when chunkImportMap is enabled with non-root base ([#23698](vitejs/vite#23698)) ([2a8c0f0](vitejs/vite@2a8c0f0))
- **build:** wait for in-flight stylesheets in preload helper (fix [#23652](vitejs/vite#23652)) ([#23662](vitejs/vite#23662)) ([036b745](vitejs/vite@036b745))
- **bundled-dev:** serve `/@vite/client` and stub `@vite/env` ([#23664](vitejs/vite#23664)) ([5afc5a8](vitejs/vite@5afc5a8))
- **client:** skip rewriting unchanged adopted styles ([#23697](vitejs/vite#23697)) ([fa71469](vitejs/vite@fa71469))
- **css:** resolve imported preprocessors from their file path with lightningcss ([#23688](vitejs/vite#23688)) ([cf52011](vitejs/vite@cf52011))
- **deps:** update all non-major dependencies ([#23648](vitejs/vite#23648)) ([8a4c19c](vitejs/vite@8a4c19c))
- **deps:** update rolldown-related dependencies ([#23649](vitejs/vite#23649)) ([794516d](vitejs/vite@794516d))
- **dev:** a restart requested during a restart used to be dropped (fix [#23392](vitejs/vite#23392)) ([#23484](vitejs/vite#23484)) ([70d56ea](vitejs/vite@70d56ea))
- don't treat modules ending with js-like query as js ([#23687](vitejs/vite#23687)) ([fcb6f12](vitejs/vite@fcb6f12))
- **html:** avoid adding filesystem root to watcher ([#23689](vitejs/vite#23689)) ([3a7f2ae](vitejs/vite@3a7f2ae))
- **html:** skip caching CSS of chunks in a cycle (fix [#23628](vitejs/vite#23628)) ([#23636](vitejs/vite#23636)) ([15d82f7](vitejs/vite@15d82f7))
- **optimizer:** scan deep imports with custom extensions ([#23678](vitejs/vite#23678)) ([8579189](vitejs/vite@8579189))
- remove input option unescaping for now ([#23694](vitejs/vite#23694)) ([facc2fb](vitejs/vite@facc2fb))
- **server:** match static aliases on path boundaries ([#23643](vitejs/vite#23643)) ([b28db28](vitejs/vite@b28db28))
- **watcher:** normalize file before root check in `ensureWatchedFile` ([#23673](vitejs/vite#23673)) ([12bb28c](vitejs/vite@12bb28c))

##### Performance Improvements

- **module-runner:** skip cloning call sites that have no source map ([#23646](vitejs/vite#23646)) ([3d67486](vitejs/vite@3d67486))

##### Code Refactoring

- **bundled-dev:** import CSS HMR helpers from `/@vite/client` ([#23674](vitejs/vite#23674)) ([182f5b2](vitejs/vite@182f5b2))


## [v8.3.3](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-833-2026-10-06-small)

##### Bug Fixes

- **deps:** update launch-editor to v2.14.2 ([#23654](vitejs/vite#23654)) ([22fd1d5](vitejs/vite@22fd1d5))
- **html:** filename passed to transformIndexHtml should not include queries ([#23653](vitejs/vite#23653)) ([7dafd8e](vitejs/vite@7dafd8e))
- **server:** check `fs.serve` for `?vite-wasm-instance` ([#23655](vitejs/vite#23655)) ([ba8b7ab](vitejs/vite@ba8b7ab))
- **server:** store ids to `safeModulePaths` rather than URLs ([#23656](vitejs/vite#23656)) ([c3e06f9](vitejs/vite@c3e06f9))


## [v8.3.2](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-832-2026-10-01-small)

##### Bug Fixes

- **build:** preload CSS correctly when `renderBuiltUrl` returns URLs with queries ([#23611](vitejs/vite#23611)) ([64e0a21](vitejs/vite@64e0a21))
- **bundled-dev:** serve lazy chunk sourcemaps ([#23026](vitejs/vite#23026)) ([eb7aa9a](vitejs/vite@eb7aa9a))
- **bundled-dev:** serve the rolldown runtime from the installed rolldown ([#23568](vitejs/vite#23568)) ([bc598a6](vitejs/vite@bc598a6))
- **deps:** update all non-major dependencies ([#23601](vitejs/vite#23601)) ([9944fa6](vitejs/vite@9944fa6))
- **deps:** update rolldown-related dependencies ([#23602](vitejs/vite#23602)) ([88c1741](vitejs/vite@88c1741))
- **html:** resolve percent-encoded srcset urls ([#23609](vitejs/vite#23609)) ([53f1ce7](vitejs/vite@53f1ce7))
- limit size of object and array printing via `forwardConsole` ([#23565](vitejs/vite#23565)) ([e64a587](vitejs/vite@e64a587))
- merge `build.rolldownOptions.output.minify` correctly ([#23536](vitejs/vite#23536)) ([bba3bb8](vitejs/vite@bba3bb8))
- **optimize-deps:** avoid "unsupported" warnings for browser:false mappings ([#23590](vitejs/vite#23590)) ([5e4b9ca](vitejs/vite@5e4b9ca))
- **optimizer:** preserve excluded optional peer require fallbacks ([#23600](vitejs/vite#23600)) ([a2bd6fa](vitejs/vite@a2bd6fa))
- pass queries to `renderBuiltUrl` ([#23586](vitejs/vite#23586)) ([744269e](vitejs/vite@744269e))
- **server:** handle file watcher errors without crashing ([#23503](vitejs/vite#23503)) ([6894f5c](vitejs/vite@6894f5c))
- **server:** release previous environments after initialization ([#23499](vitejs/vite#23499)) ([5a3a010](vitejs/vite@5a3a010))
- **ssr:** encode whitespace in module runner sourceURL ([#23513](vitejs/vite#23513)) ([bbc8812](vitejs/vite@bbc8812))
- **worker:** align worker urls in client and server when using terser ([#23614](vitejs/vite#23614)) ([24bd331](vitejs/vite@24bd331))

##### Performance Improvements

- avoid encoding intermediate source maps ([#23461](vitejs/vite#23461)) ([89574f6](vitejs/vite@89574f6))
- **build:** avoid quadratic link scan in the preload helper ([#23510](vitejs/vite#23510)) ([cf5c028](vitejs/vite@cf5c028))
- only register time middleware when debug logging is enabled ([#23621](vitejs/vite#23621)) ([94d0080](vitejs/vite@94d0080))

##### Documentation

- fix dead og-image PNG links in vite6/vite7 changelog entries ([#23594](vitejs/vite#23594)) ([1929b4c](vitejs/vite@1929b4c))

##### Miscellaneous Chores

- **deps:** update vitest monorepo to v5 ([#23604](vitejs/vite#23604)) ([24339f4](vitejs/vite@24339f4))

##### Code Refactoring

- use `tinyexec` instead of `cross-spawn` ([#23583](vitejs/vite#23583)) ([db915e5](vitejs/vite@db915e5))

##### Tests

- **bundled-dev:** accept a rolldown dev runtime with no helper imports ([#23606](vitejs/vite#23606)) ([634745d](vitejs/vite@634745d))


## [v8.3.1](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-831-2026-09-24-small)

##### Bug Fixes

- **deps:** update all non-major dependencies ([#23482](vitejs/vite#23482)) ([3c752c8](vitejs/vite@3c752c8))
- **deps:** update all non-major dependencies ([#23537](vitejs/vite#23537)) ([e8990c4](vitejs/vite@e8990c4))
- **deps:** update rolldown-related dependencies ([#23483](vitejs/vite#23483)) ([9aecbbf](vitejs/vite@9aecbbf))
- handle `server.ws: false` in mergeConfig ([#23511](vitejs/vite#23511)) ([f68c0d5](vitejs/vite@f68c0d5))
- merge `build.rolldownOptions.output.comments` correctly ([#23514](vitejs/vite#23514)) ([4aba8d8](vitejs/vite@4aba8d8))
- **optimizer:** don't skip imports whose binding starts with type ([#23540](vitejs/vite#23540)) ([39330f4](vitejs/vite@39330f4))
- **optimizer:** resolve pending discovered dep processing on close before init ([#23567](vitejs/vite#23567)) ([5f89433](vitejs/vite@5f89433))
- **server:** avoid reinitializing watcher when adding file after server close ([#23572](vitejs/vite#23572)) ([6f831f9](vitejs/vite@6f831f9))
- **sourcemap:** skip URL source roots when injecting sources content ([#23519](vitejs/vite#23519)) ([04fc30a](vitejs/vite@04fc30a))

##### Miscellaneous Chores

- merge prereleases in changelog ([#23466](vitejs/vite#23466)) ([99bd9d1](vitejs/vite@99bd9d1))
- **optimizer:** add debug log when waiting for dep before init ([#23566](vitejs/vite#23566)) ([63567c7](vitejs/vite@63567c7))
- update `optimizeDeps.include` comment ([#23489](vitejs/vite#23489)) ([6a84c72](vitejs/vite@6a84c72))

##### Code Refactoring

- assets regexp use non-capture ([#23491](vitejs/vite#23491)) ([f4b4431](vitejs/vite@f4b4431))
- remove duplicate configurations ([#23532](vitejs/vite#23532)) ([9abd99b](vitejs/vite@9abd99b))
- replace `find` with `some` ([#23554](vitejs/vite#23554)) ([af7cdf6](vitejs/vite@af7cdf6))
renovate Bot added a commit to andrei-picus-tink/auto-renovate that referenced this pull request Oct 17, 2026
@renovate
Update dependency vite to v8.3.4
7ecca16 
| datasource | package | from  | to    |
| ---------- | ------- | ----- | ----- |
| npm        | vite    | 8.3.0 | 8.3.4 |


## [v8.3.4](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-834-2026-10-08-small)

##### Features

- **bundled-dev:** support `import.meta.hot.acceptExports` ([#23463](vitejs/vite#23463)) ([bc0f21c](vitejs/vite@bc0f21c))

##### Bug Fixes

- avoid mutating hmr defaults (fix [#23575](vitejs/vite#23575)) ([#23576](vitejs/vite#23576)) ([574d5e3](vitejs/vite@574d5e3))
- **build:** correct preloads when chunkImportMap is enabled with non-root base ([#23698](vitejs/vite#23698)) ([2a8c0f0](vitejs/vite@2a8c0f0))
- **build:** wait for in-flight stylesheets in preload helper (fix [#23652](vitejs/vite#23652)) ([#23662](vitejs/vite#23662)) ([036b745](vitejs/vite@036b745))
- **bundled-dev:** serve `/@vite/client` and stub `@vite/env` ([#23664](vitejs/vite#23664)) ([5afc5a8](vitejs/vite@5afc5a8))
- **client:** skip rewriting unchanged adopted styles ([#23697](vitejs/vite#23697)) ([fa71469](vitejs/vite@fa71469))
- **css:** resolve imported preprocessors from their file path with lightningcss ([#23688](vitejs/vite#23688)) ([cf52011](vitejs/vite@cf52011))
- **deps:** update all non-major dependencies ([#23648](vitejs/vite#23648)) ([8a4c19c](vitejs/vite@8a4c19c))
- **deps:** update rolldown-related dependencies ([#23649](vitejs/vite#23649)) ([794516d](vitejs/vite@794516d))
- **dev:** a restart requested during a restart used to be dropped (fix [#23392](vitejs/vite#23392)) ([#23484](vitejs/vite#23484)) ([70d56ea](vitejs/vite@70d56ea))
- don't treat modules ending with js-like query as js ([#23687](vitejs/vite#23687)) ([fcb6f12](vitejs/vite@fcb6f12))
- **html:** avoid adding filesystem root to watcher ([#23689](vitejs/vite#23689)) ([3a7f2ae](vitejs/vite@3a7f2ae))
- **html:** skip caching CSS of chunks in a cycle (fix [#23628](vitejs/vite#23628)) ([#23636](vitejs/vite#23636)) ([15d82f7](vitejs/vite@15d82f7))
- **optimizer:** scan deep imports with custom extensions ([#23678](vitejs/vite#23678)) ([8579189](vitejs/vite@8579189))
- remove input option unescaping for now ([#23694](vitejs/vite#23694)) ([facc2fb](vitejs/vite@facc2fb))
- **server:** match static aliases on path boundaries ([#23643](vitejs/vite#23643)) ([b28db28](vitejs/vite@b28db28))
- **watcher:** normalize file before root check in `ensureWatchedFile` ([#23673](vitejs/vite#23673)) ([12bb28c](vitejs/vite@12bb28c))

##### Performance Improvements

- **module-runner:** skip cloning call sites that have no source map ([#23646](vitejs/vite#23646)) ([3d67486](vitejs/vite@3d67486))

##### Code Refactoring

- **bundled-dev:** import CSS HMR helpers from `/@vite/client` ([#23674](vitejs/vite#23674)) ([182f5b2](vitejs/vite@182f5b2))


## [v8.3.3](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-833-2026-10-06-small)

##### Bug Fixes

- **deps:** update launch-editor to v2.14.2 ([#23654](vitejs/vite#23654)) ([22fd1d5](vitejs/vite@22fd1d5))
- **html:** filename passed to transformIndexHtml should not include queries ([#23653](vitejs/vite#23653)) ([7dafd8e](vitejs/vite@7dafd8e))
- **server:** check `fs.serve` for `?vite-wasm-instance` ([#23655](vitejs/vite#23655)) ([ba8b7ab](vitejs/vite@ba8b7ab))
- **server:** store ids to `safeModulePaths` rather than URLs ([#23656](vitejs/vite#23656)) ([c3e06f9](vitejs/vite@c3e06f9))


## [v8.3.2](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-832-2026-10-01-small)

##### Bug Fixes

- **build:** preload CSS correctly when `renderBuiltUrl` returns URLs with queries ([#23611](vitejs/vite#23611)) ([64e0a21](vitejs/vite@64e0a21))
- **bundled-dev:** serve lazy chunk sourcemaps ([#23026](vitejs/vite#23026)) ([eb7aa9a](vitejs/vite@eb7aa9a))
- **bundled-dev:** serve the rolldown runtime from the installed rolldown ([#23568](vitejs/vite#23568)) ([bc598a6](vitejs/vite@bc598a6))
- **deps:** update all non-major dependencies ([#23601](vitejs/vite#23601)) ([9944fa6](vitejs/vite@9944fa6))
- **deps:** update rolldown-related dependencies ([#23602](vitejs/vite#23602)) ([88c1741](vitejs/vite@88c1741))
- **html:** resolve percent-encoded srcset urls ([#23609](vitejs/vite#23609)) ([53f1ce7](vitejs/vite@53f1ce7))
- limit size of object and array printing via `forwardConsole` ([#23565](vitejs/vite#23565)) ([e64a587](vitejs/vite@e64a587))
- merge `build.rolldownOptions.output.minify` correctly ([#23536](vitejs/vite#23536)) ([bba3bb8](vitejs/vite@bba3bb8))
- **optimize-deps:** avoid "unsupported" warnings for browser:false mappings ([#23590](vitejs/vite#23590)) ([5e4b9ca](vitejs/vite@5e4b9ca))
- **optimizer:** preserve excluded optional peer require fallbacks ([#23600](vitejs/vite#23600)) ([a2bd6fa](vitejs/vite@a2bd6fa))
- pass queries to `renderBuiltUrl` ([#23586](vitejs/vite#23586)) ([744269e](vitejs/vite@744269e))
- **server:** handle file watcher errors without crashing ([#23503](vitejs/vite#23503)) ([6894f5c](vitejs/vite@6894f5c))
- **server:** release previous environments after initialization ([#23499](vitejs/vite#23499)) ([5a3a010](vitejs/vite@5a3a010))
- **ssr:** encode whitespace in module runner sourceURL ([#23513](vitejs/vite#23513)) ([bbc8812](vitejs/vite@bbc8812))
- **worker:** align worker urls in client and server when using terser ([#23614](vitejs/vite#23614)) ([24bd331](vitejs/vite@24bd331))

##### Performance Improvements

- avoid encoding intermediate source maps ([#23461](vitejs/vite#23461)) ([89574f6](vitejs/vite@89574f6))
- **build:** avoid quadratic link scan in the preload helper ([#23510](vitejs/vite#23510)) ([cf5c028](vitejs/vite@cf5c028))
- only register time middleware when debug logging is enabled ([#23621](vitejs/vite#23621)) ([94d0080](vitejs/vite@94d0080))

##### Documentation

- fix dead og-image PNG links in vite6/vite7 changelog entries ([#23594](vitejs/vite#23594)) ([1929b4c](vitejs/vite@1929b4c))

##### Miscellaneous Chores

- **deps:** update vitest monorepo to v5 ([#23604](vitejs/vite#23604)) ([24339f4](vitejs/vite@24339f4))

##### Code Refactoring

- use `tinyexec` instead of `cross-spawn` ([#23583](vitejs/vite#23583)) ([db915e5](vitejs/vite@db915e5))

##### Tests

- **bundled-dev:** accept a rolldown dev runtime with no helper imports ([#23606](vitejs/vite#23606)) ([634745d](vitejs/vite@634745d))


## [v8.3.1](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-831-2026-09-24-small)

##### Bug Fixes

- **deps:** update all non-major dependencies ([#23482](vitejs/vite#23482)) ([3c752c8](vitejs/vite@3c752c8))
- **deps:** update all non-major dependencies ([#23537](vitejs/vite#23537)) ([e8990c4](vitejs/vite@e8990c4))
- **deps:** update rolldown-related dependencies ([#23483](vitejs/vite#23483)) ([9aecbbf](vitejs/vite@9aecbbf))
- handle `server.ws: false` in mergeConfig ([#23511](vitejs/vite#23511)) ([f68c0d5](vitejs/vite@f68c0d5))
- merge `build.rolldownOptions.output.comments` correctly ([#23514](vitejs/vite#23514)) ([4aba8d8](vitejs/vite@4aba8d8))
- **optimizer:** don't skip imports whose binding starts with type ([#23540](vitejs/vite#23540)) ([39330f4](vitejs/vite@39330f4))
- **optimizer:** resolve pending discovered dep processing on close before init ([#23567](vitejs/vite#23567)) ([5f89433](vitejs/vite@5f89433))
- **server:** avoid reinitializing watcher when adding file after server close ([#23572](vitejs/vite#23572)) ([6f831f9](vitejs/vite@6f831f9))
- **sourcemap:** skip URL source roots when injecting sources content ([#23519](vitejs/vite#23519)) ([04fc30a](vitejs/vite@04fc30a))

##### Miscellaneous Chores

- merge prereleases in changelog ([#23466](vitejs/vite#23466)) ([99bd9d1](vitejs/vite@99bd9d1))
- **optimizer:** add debug log when waiting for dep before init ([#23566](vitejs/vite#23566)) ([63567c7](vitejs/vite@63567c7))
- update `optimizeDeps.include` comment ([#23489](vitejs/vite#23489)) ([6a84c72](vitejs/vite@6a84c72))

##### Code Refactoring

- assets regexp use non-capture ([#23491](vitejs/vite#23491)) ([f4b4431](vitejs/vite@f4b4431))
- remove duplicate configurations ([#23532](vitejs/vite#23532)) ([9abd99b](vitejs/vite@9abd99b))
- replace `find` with `some` ([#23554](vitejs/vite#23554)) ([af7cdf6](vitejs/vite@af7cdf6))
renovate Bot added a commit to cigaleapp/cigale that referenced this pull request Oct 19, 2026
@renovate
⬆️ Update dependency vite to ^8.3.4
953cee7 
##### [v8.3.4](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-834-2026-10-08-small)

##### Features

- **bundled-dev:** support `import.meta.hot.acceptExports` ([#23463](vitejs/vite#23463)) ([bc0f21c](vitejs/vite@bc0f21c))

##### Bug Fixes

- avoid mutating hmr defaults (fix [#23575](vitejs/vite#23575)) ([#23576](vitejs/vite#23576)) ([574d5e3](vitejs/vite@574d5e3))
- **build:** correct preloads when chunkImportMap is enabled with non-root base ([#23698](vitejs/vite#23698)) ([2a8c0f0](vitejs/vite@2a8c0f0))
- **build:** wait for in-flight stylesheets in preload helper (fix [#23652](vitejs/vite#23652)) ([#23662](vitejs/vite#23662)) ([036b745](vitejs/vite@036b745))
- **bundled-dev:** serve `/@vite/client` and stub `@vite/env` ([#23664](vitejs/vite#23664)) ([5afc5a8](vitejs/vite@5afc5a8))
- **client:** skip rewriting unchanged adopted styles ([#23697](vitejs/vite#23697)) ([fa71469](vitejs/vite@fa71469))
- **css:** resolve imported preprocessors from their file path with lightningcss ([#23688](vitejs/vite#23688)) ([cf52011](vitejs/vite@cf52011))
- **deps:** update all non-major dependencies ([#23648](vitejs/vite#23648)) ([8a4c19c](vitejs/vite@8a4c19c))
- **deps:** update rolldown-related dependencies ([#23649](vitejs/vite#23649)) ([794516d](vitejs/vite@794516d))
- **dev:** a restart requested during a restart used to be dropped (fix [#23392](vitejs/vite#23392)) ([#23484](vitejs/vite#23484)) ([70d56ea](vitejs/vite@70d56ea))
- don't treat modules ending with js-like query as js ([#23687](vitejs/vite#23687)) ([fcb6f12](vitejs/vite@fcb6f12))
- **html:** avoid adding filesystem root to watcher ([#23689](vitejs/vite#23689)) ([3a7f2ae](vitejs/vite@3a7f2ae))
- **html:** skip caching CSS of chunks in a cycle (fix [#23628](vitejs/vite#23628)) ([#23636](vitejs/vite#23636)) ([15d82f7](vitejs/vite@15d82f7))
- **optimizer:** scan deep imports with custom extensions ([#23678](vitejs/vite#23678)) ([8579189](vitejs/vite@8579189))
- remove input option unescaping for now ([#23694](vitejs/vite#23694)) ([facc2fb](vitejs/vite@facc2fb))
- **server:** match static aliases on path boundaries ([#23643](vitejs/vite#23643)) ([b28db28](vitejs/vite@b28db28))
- **watcher:** normalize file before root check in `ensureWatchedFile` ([#23673](vitejs/vite#23673)) ([12bb28c](vitejs/vite@12bb28c))

##### Performance Improvements

- **module-runner:** skip cloning call sites that have no source map ([#23646](vitejs/vite#23646)) ([3d67486](vitejs/vite@3d67486))

##### Code Refactoring

- **bundled-dev:** import CSS HMR helpers from `/@vite/client` ([#23674](vitejs/vite#23674)) ([182f5b2](vitejs/vite@182f5b2))
##### [v8.3.3](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-833-2026-10-06-small)

##### Bug Fixes

- **deps:** update launch-editor to v2.14.2 ([#23654](vitejs/vite#23654)) ([22fd1d5](vitejs/vite@22fd1d5))
- **html:** filename passed to transformIndexHtml should not include queries ([#23653](vitejs/vite#23653)) ([7dafd8e](vitejs/vite@7dafd8e))
- **server:** check `fs.serve` for `?vite-wasm-instance` ([#23655](vitejs/vite#23655)) ([ba8b7ab](vitejs/vite@ba8b7ab))
- **server:** store ids to `safeModulePaths` rather than URLs ([#23656](vitejs/vite#23656)) ([c3e06f9](vitejs/vite@c3e06f9))
renovate Bot added a commit to cigaleapp/cigale that referenced this pull request Oct 19, 2026
@renovate
⬆️ Update dependency vite to ^8.3.4
1c74095 
##### [v8.3.4](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-834-2026-10-08-small)

##### Features

- **bundled-dev:** support `import.meta.hot.acceptExports` ([#23463](vitejs/vite#23463)) ([bc0f21c](vitejs/vite@bc0f21c))

##### Bug Fixes

- avoid mutating hmr defaults (fix [#23575](vitejs/vite#23575)) ([#23576](vitejs/vite#23576)) ([574d5e3](vitejs/vite@574d5e3))
- **build:** correct preloads when chunkImportMap is enabled with non-root base ([#23698](vitejs/vite#23698)) ([2a8c0f0](vitejs/vite@2a8c0f0))
- **build:** wait for in-flight stylesheets in preload helper (fix [#23652](vitejs/vite#23652)) ([#23662](vitejs/vite#23662)) ([036b745](vitejs/vite@036b745))
- **bundled-dev:** serve `/@vite/client` and stub `@vite/env` ([#23664](vitejs/vite#23664)) ([5afc5a8](vitejs/vite@5afc5a8))
- **client:** skip rewriting unchanged adopted styles ([#23697](vitejs/vite#23697)) ([fa71469](vitejs/vite@fa71469))
- **css:** resolve imported preprocessors from their file path with lightningcss ([#23688](vitejs/vite#23688)) ([cf52011](vitejs/vite@cf52011))
- **deps:** update all non-major dependencies ([#23648](vitejs/vite#23648)) ([8a4c19c](vitejs/vite@8a4c19c))
- **deps:** update rolldown-related dependencies ([#23649](vitejs/vite#23649)) ([794516d](vitejs/vite@794516d))
- **dev:** a restart requested during a restart used to be dropped (fix [#23392](vitejs/vite#23392)) ([#23484](vitejs/vite#23484)) ([70d56ea](vitejs/vite@70d56ea))
- don't treat modules ending with js-like query as js ([#23687](vitejs/vite#23687)) ([fcb6f12](vitejs/vite@fcb6f12))
- **html:** avoid adding filesystem root to watcher ([#23689](vitejs/vite#23689)) ([3a7f2ae](vitejs/vite@3a7f2ae))
- **html:** skip caching CSS of chunks in a cycle (fix [#23628](vitejs/vite#23628)) ([#23636](vitejs/vite#23636)) ([15d82f7](vitejs/vite@15d82f7))
- **optimizer:** scan deep imports with custom extensions ([#23678](vitejs/vite#23678)) ([8579189](vitejs/vite@8579189))
- remove input option unescaping for now ([#23694](vitejs/vite#23694)) ([facc2fb](vitejs/vite@facc2fb))
- **server:** match static aliases on path boundaries ([#23643](vitejs/vite#23643)) ([b28db28](vitejs/vite@b28db28))
- **watcher:** normalize file before root check in `ensureWatchedFile` ([#23673](vitejs/vite#23673)) ([12bb28c](vitejs/vite@12bb28c))

##### Performance Improvements

- **module-runner:** skip cloning call sites that have no source map ([#23646](vitejs/vite#23646)) ([3d67486](vitejs/vite@3d67486))

##### Code Refactoring

- **bundled-dev:** import CSS HMR helpers from `/@vite/client` ([#23674](vitejs/vite#23674)) ([182f5b2](vitejs/vite@182f5b2))
##### [v8.3.3](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-833-2026-10-06-small)

##### Bug Fixes

- **deps:** update launch-editor to v2.14.2 ([#23654](vitejs/vite#23654)) ([22fd1d5](vitejs/vite@22fd1d5))
- **html:** filename passed to transformIndexHtml should not include queries ([#23653](vitejs/vite#23653)) ([7dafd8e](vitejs/vite@7dafd8e))
- **server:** check `fs.serve` for `?vite-wasm-instance` ([#23655](vitejs/vite#23655)) ([ba8b7ab](vitejs/vite@ba8b7ab))
- **server:** store ids to `safeModulePaths` rather than URLs ([#23656](vitejs/vite#23656)) ([c3e06f9](vitejs/vite@c3e06f9))
@dbhagen dbhagen mentioned this pull request Oct 20, 2026
Open
@vharseko vharseko mentioned this pull request Oct 21, 2026
Merged
vharseko pushed a commit to OpenIdentityPlatform/OpenAM that referenced this pull request Oct 21, 2026
@dependabot
CVE-2026-112942 CVE-2026-112943 CVE-2026-112944 CVE-2026-112945 CVE-2…
9e6af24 
…026-112946 vite: Dev-server command injection via bundled launch-editor and server.fs bypass (8.0.16 -> 8.3.5) (#1190)

Bumps `vite` in `openam-ui/openam-ui-js-sdk` from 8.0.16 to 8.3.5,
clearing Dependabot alerts #369, #370 and #371. All three are advisories
against `launch-editor`, which Vite bundles into its own `dist` (8.0.16
carries `launch-editor` / `launch-editor-middleware` 2.14.1, 8.3.5
carries 2.14.2), so the lock file has no `launch-editor` entry and only
a Vite release can fix it. The same bump fixes two more Vite advisories
that are published in the vitejs/vite repository but have not reached
the GitHub Advisory Database yet, hence no Dependabot alert.
`openam-ui-js-sdk` is the only lock file in the repository that resolves
`vite`.

## Advisories

Vite's dev server mounts `launch-editor-middleware` at
`/__open-in-editor`: a request to `/__open-in-editor?file=<path>`
resolves `<path>` against the project root and has `launch-editor` open
it in the developer's editor (the error overlay's "click to open" uses
it). The three `launch-editor` advisories are about what that `file`
argument can make the editor's command line do.

**CVE-2026-112942 / GHSA-587h-7wmj-h5pm** (Windows only) — Command
injection (CWE-77). `launch-editor` only starts the editor for a path
that `fs.existsSync()` accepts, which was meant to require the attacker
to plant a file with a malicious name. A value ending in `\..:1:1` gets
past that: the middleware's `path.resolve()` keeps `..:1:1` as an
ordinary name, `launch-editor` strips `:1:1` as line and column, and
Windows then accepts the trailing `\..` as the existing parent
directory, so an arbitrary, non-existent preceding component reaches the
shell command. Combined with GHSA-698v-4r3x-3vcv this gives OS command
injection to whoever controls the `file` argument. launch-editor 2.14.2
resolves the path after stripping the position, so the existence check
sees the real target (vitejs/launch-editor@f13cd83).

**CVE-2026-112943 / GHSA-698v-4r3x-3vcv** (Windows only) — OS command
injection (CWE-78). On Windows `launch-editor` starts the editor through
`cmd.exe` (`child_process.exec(…, { shell: true })`), and
`escapeCmdArgs()` did not escape `%`, so environment-variable expansion
(`%VAR%`, `%CD%`, `%CMDCMDLINE:~-38%`) can splice a subcommand into the
command line. On its own it needs a planted file plus an injected
environment variable or an NTFS alternate data stream; GHSA-587h removes
the planted-file requirement. 2.14.2 rejects any argument containing `%`
or a line break on Windows instead of trying to escape it
(vitejs/launch-editor@3c2f9bf).

**CVE-2026-112944 / GHSA-r825-w8mm-5pxw** — Argument injection (CWE-88).
A file name that starts with `+` or `-` reaches the editor as an option;
Vim runs `+<cmd>` as an Ex command, and Emacs and some Notepad++ plugins
expose similar switches. For Vite it is limited to WSL, where
`launch-editor` turns the absolute path back into a relative one, with
Vim / MacVim / Emacs / Notepad++ as the editor and an attacker who can
create a `+…` or `-…` entry in the working directory. 2.14.2 resolves
the name to an absolute path and prefixes the WSL relative form with
`./` (vitejs/launch-editor@f6e6701).

Not in the Advisory Database yet:

**CVE-2026-112946 / GHSA-rq7h-c2jc-7f22** (not on Windows) — Path
traversal and improper access control (CWE-22, CWE-284) that bypasses
`server.fs.allow`. When Vite rewrote an in-root import to a browser URL
such as `/etc/hostname`, it recorded that URL in `safeModulePaths` as if
it were an absolute filesystem path, so a later `/@fs/etc/hostname`
request returned the host's `/etc/hostname` instead of the project file.
It needs the dev server exposed to the network (`--host` /
`server.host`), a project import whose root-relative URL is also the
absolute path of a readable host file, and that file not matched by
`server.fs.deny`. The fix stores module IDs rather than URLs in
`safeModulePaths` (vitejs/vite#23656, in 8.3.3).

**CVE-2026-112945 / GHSA-9jrq-w75r-8gcw** — Cross-origin script
execution (CWE-80). A server that hands the unchanged browser request
URL to `server.transformIndexHtml` — the middleware-mode / `appType:
'custom'` SSR pattern from Vite's guide — could be made to emit `<script
type="module" src="//evil.example/…">` for an inline module script and
so load an attacker's script into the dev-server origin. Vite's own
`spa` / `mpa` HTML handling is not affected. The fix strips the query
before deriving the HTML file name (vitejs/vite#23653, in 8.3.3).

| | Severity | Affected (8.x line) | Fixed in |
|---|---|---|---|
| GHSA-587h-7wmj-h5pm | High — CVSS 4.0 7.5
(`AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`) |
8.0.0–8.1.5, 8.2.0–8.2.3, 8.3.0–8.3.2 | 8.1.6, 8.2.4, 8.3.3 |
| GHSA-698v-4r3x-3vcv | Medium — CVSS 4.0 6.3
(`AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N`) | same | same
|
| GHSA-r825-w8mm-5pxw | Medium — CVSS 4.0 6.3
(`AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N`) | same | same
|
| GHSA-rq7h-c2jc-7f22 | Medium — CVSS 4.0 6.3
(`AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N`) | same | same
|
| GHSA-9jrq-w75r-8gcw | Low — CVSS 4.0 2.1
(`AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N`) | same | same
|

8.0.16 was never affected by GHSA-vfpm-58rq-9qcg / CVE-2026-112947
(`?vite-wasm-instance` exposes the first 4 bytes of files outside
`server.fs`), which covers only 8.2.0–8.3.2; 8.3.5 is past it, whereas a
bump that stopped in that window would have introduced it.

## Impact on OpenAM

Nothing at runtime and nothing in the build; the exposure is `npm run
dev` on a developer machine. `vite` is a direct development dependency
of `openam-ui-js-sdk` (`devDependencies`, `dev: true`), and every
advisory above sits in the dev server — `/__open-in-editor`, the `/@fs/`
handler, `transformIndexHtml` — none of which ends up in what `vite
build` writes.

- The Maven build runs `npm run build` (`tsc -b && vite build` with
`vite.config.ts` and with `vite.lib.config.ts`) and `npm run test:run`
(`vitest run`). `vite build` starts no server. `vitest run` creates a
Vite server in-process but calls `listen()` only when `api.port` is set
(`createVitest`: `if (ctx.config.api?.port) await server.listen()`), and
`vitest.config.js` sets no `api`, so no port is opened and
`/__open-in-editor` is unreachable, the `windows-latest` CI runners
included.
- What ships is the `vite build` output: `openam-server-only` unpacks
the `app` zip (`target/app`) into the WAR as `extui/`, and the `lib` zip
carries `target/lib`. Neither contains the dev server, the Vite client
or `launch-editor`.
- `npm run dev` runs `vite --host 0.0.0.0`, which binds the dev server
to every interface, so `/__open-in-editor` and `/@fs/` answer anyone on
the network. `server.allowedHosts` (`localhost`, `openam.example.org`)
checks only the `Host` header, which a client other than a browser sets
at will; it stops DNS rebinding, not direct requests. A developer
running `npm run dev` on Windows with an editor that launch-editor
detects was therefore open to command injection over the network through
GHSA-587h + GHSA-698v. GHSA-r825 additionally needs WSL, a Vim- or
Emacs-type editor and a planted `+…` / `-…` entry in the working
directory. GHSA-rq7h needs an import whose root-relative URL is also a
readable host path; this module's imports resolve to `/src/…` and
`/node_modules/…`, which a standard Linux or macOS host does not have.
GHSA-9jrq does not apply: the module uses Vite's default `spa` app type
and never calls `transformIndexHtml` itself.

## Change

`vite` 8.0.16 → 8.3.5 in `openam-ui/openam-ui-js-sdk`. The
`devDependencies` floor in `package.json` moves `^8.0.16` → `^8.3.5`, so
a fresh `npm install` cannot resolve back into an affected version, and
`package-lock.json` follows Vite's own dependency floors:

- `rolldown` 1.0.3 → 1.2.14 (Vite 8.3.5 pins `~1.2.14`), with
`@oxc-project/types` 0.133.0 → 0.154.0 and the `@rolldown/binding-*`
platform packages 1.0.3 → 1.2.14. Rolldown 1.2.14 adds
`@rolldown/binding-android-arm-eabi` and no longer lists the WebAssembly
fallback `@rolldown/binding-wasm32-wasi`, so that binding and its
helpers (`@napi-rs/wasm-runtime`, `@emnapi/core`, `@emnapi/runtime`,
`@emnapi/wasi-threads`, `@tybys/wasm-util`, `tslib`) leave the lock
file; the CI runners (Linux x64, macOS arm64, Windows x64) all have
native bindings.
- `lightningcss` and its platform packages 1.32.0 → 1.33.0, `postcss`
8.5.23 → 8.5.31, `nanoid` 3.3.16 → 3.3.20 (from `postcss`'s new
`^3.3.20` floor), and Vite's nested `picomatch` 4.0.4 → 4.0.7.

This is a minor-version step for the toolchain that produces the shipped
`extui/` and `lib` bundles — Rolldown is Vite 8's production bundler —
so the generated JavaScript can differ in chunking and output details
although no source or configuration changes. The smallest fixed 8.x
release is 8.1.6; Dependabot took the latest, 8.3.5, which is also clear
of GHSA-vfpm-58rq-9qcg.

The `nanoid` move also takes this lock file out of GHSA-2v37-7h3g-55p8 /
CVE-2026-67213 (infinite loop in `customAlphabet` / `customRandom` with
`size` 0, fixed in 3.3.18). Its alert #303 had been auto-dismissed, and
it was never reachable: `postcss` only calls `nanoid(6)` from
`nanoid/non-secure`.

Verified:
- all 33 changed `integrity` hashes match the npm registry:
`vite@8.3.5`, `rolldown@1.2.14`, the 15 `@rolldown/binding-*@1.2.14`,
`@oxc-project/types@0.154.0`, `lightningcss@1.33.0` and its 11 platform
packages, `postcss@8.5.31`, `nanoid@3.3.20`, `picomatch@4.0.7`
- Vite 8.3.5's `dist` bundles `launch-editor` and
`launch-editor-middleware` 2.14.2 (8.0.16: 2.14.1), and
`/__open-in-editor` is mounted only in the dev server
- the GitHub Advisory Database lists no advisory affecting `vite@8.3.5`
- the packages that constrain `vite` accept 8.3.5:
`@vitejs/plugin-react` 5.2.0 (`… || ^8.0.0`), `vitest` and
`@vitest/mocker` 4.1.11 (`^6.0.0 || ^7.0.0 || ^8.0.0`),
`vite-plugin-dts` 5.0.3 (`>=3`)
- `engines.node` of `vite` and `rolldown` is unchanged (`^20.19.0 ||
>=22.12.0`); the build's Node v22.21.1 satisfies it

## References

- GHSA-587h-7wmj-h5pm
- GHSA-698v-4r3x-3vcv
- GHSA-r825-w8mm-5pxw
- GHSA-rq7h-c2jc-7f22
- GHSA-9jrq-w75r-8gcw
- https://nvd.nist.gov/vuln/detail/CVE-2026-112942
- https://nvd.nist.gov/vuln/detail/CVE-2026-112943
- https://nvd.nist.gov/vuln/detail/CVE-2026-112944
-
vitejs/launch-editor@f13cd83
-
vitejs/launch-editor@3c2f9bf
-
vitejs/launch-editor@f6e6701
- https://github.com/vitejs/launch-editor/releases/tag/v2.14.2
- vitejs/vite#23654
- vitejs/vite#23656
- vitejs/vite#23653
- https://github.com/vitejs/vite/releases/tag/v8.3.3

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
renovate Bot added a commit to andrei-picus-tink/auto-renovate that referenced this pull request Oct 22, 2026
@renovate
Update dependency vite to v8.3.5
c23fdb8 
| datasource | package | from  | to    |
| ---------- | ------- | ----- | ----- |
| npm        | vite    | 8.3.0 | 8.3.5 |


## [v8.3.5](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-835-2026-10-21-small)

##### Bug Fixes

- **build:** handle missing chunk import maps ([#23777](vitejs/vite#23777)) ([8d7623d](vitejs/vite@8d7623d))
- **build:** include preload dependencies to chunk import map hashing ([#23793](vitejs/vite#23793)) ([4d16e7c](vitejs/vite@4d16e7c))
- **bundled-dev:** apply `server.origin` to asset URLs ([#23683](vitejs/vite#23683)) ([52ba877](vitejs/vite@52ba877))
- **bundled-dev:** declare utf-8 charset in fallback page ([#23846](vitejs/vite#23846)) ([197daf6](vitejs/vite@197daf6))
- **bundled-dev:** ignore build.chunkImportMap ([#23685](vitejs/vite#23685)) ([cfe917d](vitejs/vite@cfe917d))
- **bundled-dev:** include user `import.meta.env.*` defines in the `import.meta.env` object ([#23713](vitejs/vite#23713)) ([6019aa7](vitejs/vite@6019aa7))
- **bundled-dev:** map forwarded error stacks through the bundle source maps ([#23741](vitejs/vite#23741)) ([11fe1e4](vitejs/vite@11fe1e4))
- **bundled-dev:** normalize served output files ([#23684](vitejs/vite#23684)) ([df4e02c](vitejs/vite@df4e02c))
- **bundled-dev:** stop hmr propagation at modules that are no longer imported ([#23839](vitejs/vite#23839)) ([7471e8c](vitejs/vite@7471e8c))
- **css:** don't fail on a literal `%` in `url()` ([#23676](vitejs/vite#23676)) ([50b382d](vitejs/vite@50b382d))
- **deps:** update all non-major dependencies ([#23731](vitejs/vite#23731)) ([cf80aa5](vitejs/vite@cf80aa5))
- **deps:** update all non-major dependencies ([#23826](vitejs/vite#23826)) ([77d8373](vitejs/vite@77d8373))
- **deps:** update rolldown-related dependencies ([#23733](vitejs/vite#23733)) ([43f0d05](vitejs/vite@43f0d05))
- **deps:** update rolldown-related dependencies ([#23827](vitejs/vite#23827)) ([c2e0418](vitejs/vite@c2e0418))
- **optimizer:** fall back to yarn.lock for lockfile hash ([#23667](vitejs/vite#23667)) ([f206096](vitejs/vite@f206096))
- **optimizer:** scan `oxc.jsxInject` imports ([#23758](vitejs/vite#23758)) ([38f3cb4](vitejs/vite@38f3cb4))
- **optimizer:** skip patches dir check for yarn.lock fallback ([#23725](vitejs/vite#23725)) ([8e890e1](vitejs/vite@8e890e1))
- **optimizer:** skip patches dir hash for nub lockfile ([#23761](vitejs/vite#23761)) ([a7d5696](vitejs/vite@a7d5696))
- **resolve:** support subpath imports with multiple `#` ([#23631](vitejs/vite#23631)) ([0d86b34](vitejs/vite@0d86b34))
- **resolve:** update resolve.exports to 2.0.4 ([#23739](vitejs/vite#23739)) ([4ea708a](vitejs/vite@4ea708a))
- **server:** handle socket errors on upgrade requests not taken by the HMR server ([#23728](vitejs/vite#23728)) ([c2c9ef4](vitejs/vite@c2c9ef4))
- **server:** only strip base when path matches a full segment ([#23641](vitejs/vite#23641)) ([3dfde87](vitejs/vite@3dfde87))

##### Performance Improvements

- **ssr:** extract inline source maps without a regexp ([#23775](vitejs/vite#23775)) ([6a02780](vitejs/vite@6a02780))

##### Miscellaneous Chores

- migrate to Oxlint ([#23746](vitejs/vite#23746)) ([5b73935](vitejs/vite@5b73935))

##### Code Refactoring

- **deps:** replace `@vercel/detect-agent` with `std-env` ([#23744](vitejs/vite#23744)) ([ce4293f](vitejs/vite@ce4293f))
- **dev:** consolidate moduleURL to file path utilities ([#23828](vitejs/vite#23828)) ([df7b40e](vitejs/vite@df7b40e))
- **dev:** separate import resolution from URL conversion ([#23791](vitejs/vite#23791)) ([6116689](vitejs/vite@6116689))
- **dev:** share ModuleURL and BrowserURL conversions ([#23790](vitejs/vite#23790)) ([446954c](vitejs/vite@446954c))
- **dev:** use ModuleURLs throughout HTML transforms ([#23815](vitejs/vite#23815)) ([a162990](vitejs/vite@a162990))


## [v8.3.4](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-834-2026-10-08-small)

##### Features

- **bundled-dev:** support `import.meta.hot.acceptExports` ([#23463](vitejs/vite#23463)) ([bc0f21c](vitejs/vite@bc0f21c))

##### Bug Fixes

- avoid mutating hmr defaults (fix [#23575](vitejs/vite#23575)) ([#23576](vitejs/vite#23576)) ([574d5e3](vitejs/vite@574d5e3))
- **build:** correct preloads when chunkImportMap is enabled with non-root base ([#23698](vitejs/vite#23698)) ([2a8c0f0](vitejs/vite@2a8c0f0))
- **build:** wait for in-flight stylesheets in preload helper (fix [#23652](vitejs/vite#23652)) ([#23662](vitejs/vite#23662)) ([036b745](vitejs/vite@036b745))
- **bundled-dev:** serve `/@vite/client` and stub `@vite/env` ([#23664](vitejs/vite#23664)) ([5afc5a8](vitejs/vite@5afc5a8))
- **client:** skip rewriting unchanged adopted styles ([#23697](vitejs/vite#23697)) ([fa71469](vitejs/vite@fa71469))
- **css:** resolve imported preprocessors from their file path with lightningcss ([#23688](vitejs/vite#23688)) ([cf52011](vitejs/vite@cf52011))
- **deps:** update all non-major dependencies ([#23648](vitejs/vite#23648)) ([8a4c19c](vitejs/vite@8a4c19c))
- **deps:** update rolldown-related dependencies ([#23649](vitejs/vite#23649)) ([794516d](vitejs/vite@794516d))
- **dev:** a restart requested during a restart used to be dropped (fix [#23392](vitejs/vite#23392)) ([#23484](vitejs/vite#23484)) ([70d56ea](vitejs/vite@70d56ea))
- don't treat modules ending with js-like query as js ([#23687](vitejs/vite#23687)) ([fcb6f12](vitejs/vite@fcb6f12))
- **html:** avoid adding filesystem root to watcher ([#23689](vitejs/vite#23689)) ([3a7f2ae](vitejs/vite@3a7f2ae))
- **html:** skip caching CSS of chunks in a cycle (fix [#23628](vitejs/vite#23628)) ([#23636](vitejs/vite#23636)) ([15d82f7](vitejs/vite@15d82f7))
- **optimizer:** scan deep imports with custom extensions ([#23678](vitejs/vite#23678)) ([8579189](vitejs/vite@8579189))
- remove input option unescaping for now ([#23694](vitejs/vite#23694)) ([facc2fb](vitejs/vite@facc2fb))
- **server:** match static aliases on path boundaries ([#23643](vitejs/vite#23643)) ([b28db28](vitejs/vite@b28db28))
- **watcher:** normalize file before root check in `ensureWatchedFile` ([#23673](vitejs/vite#23673)) ([12bb28c](vitejs/vite@12bb28c))

##### Performance Improvements

- **module-runner:** skip cloning call sites that have no source map ([#23646](vitejs/vite#23646)) ([3d67486](vitejs/vite@3d67486))

##### Code Refactoring

- **bundled-dev:** import CSS HMR helpers from `/@vite/client` ([#23674](vitejs/vite#23674)) ([182f5b2](vitejs/vite@182f5b2))


## [v8.3.3](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-833-2026-10-06-small)

##### Bug Fixes

- **deps:** update launch-editor to v2.14.2 ([#23654](vitejs/vite#23654)) ([22fd1d5](vitejs/vite@22fd1d5))
- **html:** filename passed to transformIndexHtml should not include queries ([#23653](vitejs/vite#23653)) ([7dafd8e](vitejs/vite@7dafd8e))
- **server:** check `fs.serve` for `?vite-wasm-instance` ([#23655](vitejs/vite#23655)) ([ba8b7ab](vitejs/vite@ba8b7ab))
- **server:** store ids to `safeModulePaths` rather than URLs ([#23656](vitejs/vite#23656)) ([c3e06f9](vitejs/vite@c3e06f9))


## [v8.3.2](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-832-2026-10-01-small)

##### Bug Fixes

- **build:** preload CSS correctly when `renderBuiltUrl` returns URLs with queries ([#23611](vitejs/vite#23611)) ([64e0a21](vitejs/vite@64e0a21))
- **bundled-dev:** serve lazy chunk sourcemaps ([#23026](vitejs/vite#23026)) ([eb7aa9a](vitejs/vite@eb7aa9a))
- **bundled-dev:** serve the rolldown runtime from the installed rolldown ([#23568](vitejs/vite#23568)) ([bc598a6](vitejs/vite@bc598a6))
- **deps:** update all non-major dependencies ([#23601](vitejs/vite#23601)) ([9944fa6](vitejs/vite@9944fa6))
- **deps:** update rolldown-related dependencies ([#23602](vitejs/vite#23602)) ([88c1741](vitejs/vite@88c1741))
- **html:** resolve percent-encoded srcset urls ([#23609](vitejs/vite#23609)) ([53f1ce7](vitejs/vite@53f1ce7))
- limit size of object and array printing via `forwardConsole` ([#23565](vitejs/vite#23565)) ([e64a587](vitejs/vite@e64a587))
- merge `build.rolldownOptions.output.minify` correctly ([#23536](vitejs/vite#23536)) ([bba3bb8](vitejs/vite@bba3bb8))
- **optimize-deps:** avoid "unsupported" warnings for browser:false mappings ([#23590](vitejs/vite#23590)) ([5e4b9ca](vitejs/vite@5e4b9ca))
- **optimizer:** preserve excluded optional peer require fallbacks ([#23600](vitejs/vite#23600)) ([a2bd6fa](vitejs/vite@a2bd6fa))
- pass queries to `renderBuiltUrl` ([#23586](vitejs/vite#23586)) ([744269e](vitejs/vite@744269e))
- **server:** handle file watcher errors without crashing ([#23503](vitejs/vite#23503)) ([6894f5c](vitejs/vite@6894f5c))
- **server:** release previous environments after initialization ([#23499](vitejs/vite#23499)) ([5a3a010](vitejs/vite@5a3a010))
- **ssr:** encode whitespace in module runner sourceURL ([#23513](vitejs/vite#23513)) ([bbc8812](vitejs/vite@bbc8812))
- **worker:** align worker urls in client and server when using terser ([#23614](vitejs/vite#23614)) ([24bd331](vitejs/vite@24bd331))

##### Performance Improvements

- avoid encoding intermediate source maps ([#23461](vitejs/vite#23461)) ([89574f6](vitejs/vite@89574f6))
- **build:** avoid quadratic link scan in the preload helper ([#23510](vitejs/vite#23510)) ([cf5c028](vitejs/vite@cf5c028))
- only register time middleware when debug logging is enabled ([#23621](vitejs/vite#23621)) ([94d0080](vitejs/vite@94d0080))

##### Documentation

- fix dead og-image PNG links in vite6/vite7 changelog entries ([#23594](vitejs/vite#23594)) ([1929b4c](vitejs/vite@1929b4c))

##### Miscellaneous Chores

- **deps:** update vitest monorepo to v5 ([#23604](vitejs/vite#23604)) ([24339f4](vitejs/vite@24339f4))

##### Code Refactoring

- use `tinyexec` instead of `cross-spawn` ([#23583](vitejs/vite#23583)) ([db915e5](vitejs/vite@db915e5))

##### Tests

- **bundled-dev:** accept a rolldown dev runtime with no helper imports ([#23606](vitejs/vite#23606)) ([634745d](vitejs/vite@634745d))


## [v8.3.1](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-831-2026-09-24-small)

##### Bug Fixes

- **deps:** update all non-major dependencies ([#23482](vitejs/vite#23482)) ([3c752c8](vitejs/vite@3c752c8))
- **deps:** update all non-major dependencies ([#23537](vitejs/vite#23537)) ([e8990c4](vitejs/vite@e8990c4))
- **deps:** update rolldown-related dependencies ([#23483](vitejs/vite#23483)) ([9aecbbf](vitejs/vite@9aecbbf))
- handle `server.ws: false` in mergeConfig ([#23511](vitejs/vite#23511)) ([f68c0d5](vitejs/vite@f68c0d5))
- merge `build.rolldownOptions.output.comments` correctly ([#23514](vitejs/vite#23514)) ([4aba8d8](vitejs/vite@4aba8d8))
- **optimizer:** don't skip imports whose binding starts with type ([#23540](vitejs/vite#23540)) ([39330f4](vitejs/vite@39330f4))
- **optimizer:** resolve pending discovered dep processing on close before init ([#23567](vitejs/vite#23567)) ([5f89433](vitejs/vite@5f89433))
- **server:** avoid reinitializing watcher when adding file after server close ([#23572](vitejs/vite#23572)) ([6f831f9](vitejs/vite@6f831f9))
- **sourcemap:** skip URL source roots when injecting sources content ([#23519](vitejs/vite#23519)) ([04fc30a](vitejs/vite@04fc30a))

##### Miscellaneous Chores

- merge prereleases in changelog ([#23466](vitejs/vite#23466)) ([99bd9d1](vitejs/vite@99bd9d1))
- **optimizer:** add debug log when waiting for dep before init ([#23566](vitejs/vite#23566)) ([63567c7](vitejs/vite@63567c7))
- update `optimizeDeps.include` comment ([#23489](vitejs/vite#23489)) ([6a84c72](vitejs/vite@6a84c72))

##### Code Refactoring

- assets regexp use non-capture ([#23491](vitejs/vite#23491)) ([f4b4431](vitejs/vite@f4b4431))
- remove duplicate configurations ([#23532](vitejs/vite#23532)) ([9abd99b](vitejs/vite@9abd99b))
- replace `find` with `some` ([#23554](vitejs/vite#23554)) ([af7cdf6](vitejs/vite@af7cdf6))
@renovate renovate Bot mentioned this pull request Oct 22, 2026
Open
@mtrezza mtrezza mentioned this pull request Oct 24, 2026
Merged
renovate Bot added a commit to andrei-picus-tink/auto-renovate that referenced this pull request Oct 24, 2026
@renovate
Update dependency vite to v8.3.5
1e4cf23 
| datasource | package | from  | to    |
| ---------- | ------- | ----- | ----- |
| npm        | vite    | 8.3.0 | 8.3.5 |


## [v8.3.5](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-835-2026-10-21-small)

##### Bug Fixes

- **build:** handle missing chunk import maps ([#23777](vitejs/vite#23777)) ([8d7623d](vitejs/vite@8d7623d))
- **build:** include preload dependencies to chunk import map hashing ([#23793](vitejs/vite#23793)) ([4d16e7c](vitejs/vite@4d16e7c))
- **bundled-dev:** apply `server.origin` to asset URLs ([#23683](vitejs/vite#23683)) ([52ba877](vitejs/vite@52ba877))
- **bundled-dev:** declare utf-8 charset in fallback page ([#23846](vitejs/vite#23846)) ([197daf6](vitejs/vite@197daf6))
- **bundled-dev:** ignore build.chunkImportMap ([#23685](vitejs/vite#23685)) ([cfe917d](vitejs/vite@cfe917d))
- **bundled-dev:** include user `import.meta.env.*` defines in the `import.meta.env` object ([#23713](vitejs/vite#23713)) ([6019aa7](vitejs/vite@6019aa7))
- **bundled-dev:** map forwarded error stacks through the bundle source maps ([#23741](vitejs/vite#23741)) ([11fe1e4](vitejs/vite@11fe1e4))
- **bundled-dev:** normalize served output files ([#23684](vitejs/vite#23684)) ([df4e02c](vitejs/vite@df4e02c))
- **bundled-dev:** stop hmr propagation at modules that are no longer imported ([#23839](vitejs/vite#23839)) ([7471e8c](vitejs/vite@7471e8c))
- **css:** don't fail on a literal `%` in `url()` ([#23676](vitejs/vite#23676)) ([50b382d](vitejs/vite@50b382d))
- **deps:** update all non-major dependencies ([#23731](vitejs/vite#23731)) ([cf80aa5](vitejs/vite@cf80aa5))
- **deps:** update all non-major dependencies ([#23826](vitejs/vite#23826)) ([77d8373](vitejs/vite@77d8373))
- **deps:** update rolldown-related dependencies ([#23733](vitejs/vite#23733)) ([43f0d05](vitejs/vite@43f0d05))
- **deps:** update rolldown-related dependencies ([#23827](vitejs/vite#23827)) ([c2e0418](vitejs/vite@c2e0418))
- **optimizer:** fall back to yarn.lock for lockfile hash ([#23667](vitejs/vite#23667)) ([f206096](vitejs/vite@f206096))
- **optimizer:** scan `oxc.jsxInject` imports ([#23758](vitejs/vite#23758)) ([38f3cb4](vitejs/vite@38f3cb4))
- **optimizer:** skip patches dir check for yarn.lock fallback ([#23725](vitejs/vite#23725)) ([8e890e1](vitejs/vite@8e890e1))
- **optimizer:** skip patches dir hash for nub lockfile ([#23761](vitejs/vite#23761)) ([a7d5696](vitejs/vite@a7d5696))
- **resolve:** support subpath imports with multiple `#` ([#23631](vitejs/vite#23631)) ([0d86b34](vitejs/vite@0d86b34))
- **resolve:** update resolve.exports to 2.0.4 ([#23739](vitejs/vite#23739)) ([4ea708a](vitejs/vite@4ea708a))
- **server:** handle socket errors on upgrade requests not taken by the HMR server ([#23728](vitejs/vite#23728)) ([c2c9ef4](vitejs/vite@c2c9ef4))
- **server:** only strip base when path matches a full segment ([#23641](vitejs/vite#23641)) ([3dfde87](vitejs/vite@3dfde87))

##### Performance Improvements

- **ssr:** extract inline source maps without a regexp ([#23775](vitejs/vite#23775)) ([6a02780](vitejs/vite@6a02780))

##### Miscellaneous Chores

- migrate to Oxlint ([#23746](vitejs/vite#23746)) ([5b73935](vitejs/vite@5b73935))

##### Code Refactoring

- **deps:** replace `@vercel/detect-agent` with `std-env` ([#23744](vitejs/vite#23744)) ([ce4293f](vitejs/vite@ce4293f))
- **dev:** consolidate moduleURL to file path utilities ([#23828](vitejs/vite#23828)) ([df7b40e](vitejs/vite@df7b40e))
- **dev:** separate import resolution from URL conversion ([#23791](vitejs/vite#23791)) ([6116689](vitejs/vite@6116689))
- **dev:** share ModuleURL and BrowserURL conversions ([#23790](vitejs/vite#23790)) ([446954c](vitejs/vite@446954c))
- **dev:** use ModuleURLs throughout HTML transforms ([#23815](vitejs/vite#23815)) ([a162990](vitejs/vite@a162990))


## [v8.3.4](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-834-2026-10-08-small)

##### Features

- **bundled-dev:** support `import.meta.hot.acceptExports` ([#23463](vitejs/vite#23463)) ([bc0f21c](vitejs/vite@bc0f21c))

##### Bug Fixes

- avoid mutating hmr defaults (fix [#23575](vitejs/vite#23575)) ([#23576](vitejs/vite#23576)) ([574d5e3](vitejs/vite@574d5e3))
- **build:** correct preloads when chunkImportMap is enabled with non-root base ([#23698](vitejs/vite#23698)) ([2a8c0f0](vitejs/vite@2a8c0f0))
- **build:** wait for in-flight stylesheets in preload helper (fix [#23652](vitejs/vite#23652)) ([#23662](vitejs/vite#23662)) ([036b745](vitejs/vite@036b745))
- **bundled-dev:** serve `/@vite/client` and stub `@vite/env` ([#23664](vitejs/vite#23664)) ([5afc5a8](vitejs/vite@5afc5a8))
- **client:** skip rewriting unchanged adopted styles ([#23697](vitejs/vite#23697)) ([fa71469](vitejs/vite@fa71469))
- **css:** resolve imported preprocessors from their file path with lightningcss ([#23688](vitejs/vite#23688)) ([cf52011](vitejs/vite@cf52011))
- **deps:** update all non-major dependencies ([#23648](vitejs/vite#23648)) ([8a4c19c](vitejs/vite@8a4c19c))
- **deps:** update rolldown-related dependencies ([#23649](vitejs/vite#23649)) ([794516d](vitejs/vite@794516d))
- **dev:** a restart requested during a restart used to be dropped (fix [#23392](vitejs/vite#23392)) ([#23484](vitejs/vite#23484)) ([70d56ea](vitejs/vite@70d56ea))
- don't treat modules ending with js-like query as js ([#23687](vitejs/vite#23687)) ([fcb6f12](vitejs/vite@fcb6f12))
- **html:** avoid adding filesystem root to watcher ([#23689](vitejs/vite#23689)) ([3a7f2ae](vitejs/vite@3a7f2ae))
- **html:** skip caching CSS of chunks in a cycle (fix [#23628](vitejs/vite#23628)) ([#23636](vitejs/vite#23636)) ([15d82f7](vitejs/vite@15d82f7))
- **optimizer:** scan deep imports with custom extensions ([#23678](vitejs/vite#23678)) ([8579189](vitejs/vite@8579189))
- remove input option unescaping for now ([#23694](vitejs/vite#23694)) ([facc2fb](vitejs/vite@facc2fb))
- **server:** match static aliases on path boundaries ([#23643](vitejs/vite#23643)) ([b28db28](vitejs/vite@b28db28))
- **watcher:** normalize file before root check in `ensureWatchedFile` ([#23673](vitejs/vite#23673)) ([12bb28c](vitejs/vite@12bb28c))

##### Performance Improvements

- **module-runner:** skip cloning call sites that have no source map ([#23646](vitejs/vite#23646)) ([3d67486](vitejs/vite@3d67486))

##### Code Refactoring

- **bundled-dev:** import CSS HMR helpers from `/@vite/client` ([#23674](vitejs/vite#23674)) ([182f5b2](vitejs/vite@182f5b2))


## [v8.3.3](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-833-2026-10-06-small)

##### Bug Fixes

- **deps:** update launch-editor to v2.14.2 ([#23654](vitejs/vite#23654)) ([22fd1d5](vitejs/vite@22fd1d5))
- **html:** filename passed to transformIndexHtml should not include queries ([#23653](vitejs/vite#23653)) ([7dafd8e](vitejs/vite@7dafd8e))
- **server:** check `fs.serve` for `?vite-wasm-instance` ([#23655](vitejs/vite#23655)) ([ba8b7ab](vitejs/vite@ba8b7ab))
- **server:** store ids to `safeModulePaths` rather than URLs ([#23656](vitejs/vite#23656)) ([c3e06f9](vitejs/vite@c3e06f9))


## [v8.3.2](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-832-2026-10-01-small)

##### Bug Fixes

- **build:** preload CSS correctly when `renderBuiltUrl` returns URLs with queries ([#23611](vitejs/vite#23611)) ([64e0a21](vitejs/vite@64e0a21))
- **bundled-dev:** serve lazy chunk sourcemaps ([#23026](vitejs/vite#23026)) ([eb7aa9a](vitejs/vite@eb7aa9a))
- **bundled-dev:** serve the rolldown runtime from the installed rolldown ([#23568](vitejs/vite#23568)) ([bc598a6](vitejs/vite@bc598a6))
- **deps:** update all non-major dependencies ([#23601](vitejs/vite#23601)) ([9944fa6](vitejs/vite@9944fa6))
- **deps:** update rolldown-related dependencies ([#23602](vitejs/vite#23602)) ([88c1741](vitejs/vite@88c1741))
- **html:** resolve percent-encoded srcset urls ([#23609](vitejs/vite#23609)) ([53f1ce7](vitejs/vite@53f1ce7))
- limit size of object and array printing via `forwardConsole` ([#23565](vitejs/vite#23565)) ([e64a587](vitejs/vite@e64a587))
- merge `build.rolldownOptions.output.minify` correctly ([#23536](vitejs/vite#23536)) ([bba3bb8](vitejs/vite@bba3bb8))
- **optimize-deps:** avoid "unsupported" warnings for browser:false mappings ([#23590](vitejs/vite#23590)) ([5e4b9ca](vitejs/vite@5e4b9ca))
- **optimizer:** preserve excluded optional peer require fallbacks ([#23600](vitejs/vite#23600)) ([a2bd6fa](vitejs/vite@a2bd6fa))
- pass queries to `renderBuiltUrl` ([#23586](vitejs/vite#23586)) ([744269e](vitejs/vite@744269e))
- **server:** handle file watcher errors without crashing ([#23503](vitejs/vite#23503)) ([6894f5c](vitejs/vite@6894f5c))
- **server:** release previous environments after initialization ([#23499](vitejs/vite#23499)) ([5a3a010](vitejs/vite@5a3a010))
- **ssr:** encode whitespace in module runner sourceURL ([#23513](vitejs/vite#23513)) ([bbc8812](vitejs/vite@bbc8812))
- **worker:** align worker urls in client and server when using terser ([#23614](vitejs/vite#23614)) ([24bd331](vitejs/vite@24bd331))

##### Performance Improvements

- avoid encoding intermediate source maps ([#23461](vitejs/vite#23461)) ([89574f6](vitejs/vite@89574f6))
- **build:** avoid quadratic link scan in the preload helper ([#23510](vitejs/vite#23510)) ([cf5c028](vitejs/vite@cf5c028))
- only register time middleware when debug logging is enabled ([#23621](vitejs/vite#23621)) ([94d0080](vitejs/vite@94d0080))

##### Documentation

- fix dead og-image PNG links in vite6/vite7 changelog entries ([#23594](vitejs/vite#23594)) ([1929b4c](vitejs/vite@1929b4c))

##### Miscellaneous Chores

- **deps:** update vitest monorepo to v5 ([#23604](vitejs/vite#23604)) ([24339f4](vitejs/vite@24339f4))

##### Code Refactoring

- use `tinyexec` instead of `cross-spawn` ([#23583](vitejs/vite#23583)) ([db915e5](vitejs/vite@db915e5))

##### Tests

- **bundled-dev:** accept a rolldown dev runtime with no helper imports ([#23606](vitejs/vite#23606)) ([634745d](vitejs/vite@634745d))


## [v8.3.1](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-831-2026-09-24-small)

##### Bug Fixes

- **deps:** update all non-major dependencies ([#23482](vitejs/vite#23482)) ([3c752c8](vitejs/vite@3c752c8))
- **deps:** update all non-major dependencies ([#23537](vitejs/vite#23537)) ([e8990c4](vitejs/vite@e8990c4))
- **deps:** update rolldown-related dependencies ([#23483](vitejs/vite#23483)) ([9aecbbf](vitejs/vite@9aecbbf))
- handle `server.ws: false` in mergeConfig ([#23511](vitejs/vite#23511)) ([f68c0d5](vitejs/vite@f68c0d5))
- merge `build.rolldownOptions.output.comments` correctly ([#23514](vitejs/vite#23514)) ([4aba8d8](vitejs/vite@4aba8d8))
- **optimizer:** don't skip imports whose binding starts with type ([#23540](vitejs/vite#23540)) ([39330f4](vitejs/vite@39330f4))
- **optimizer:** resolve pending discovered dep processing on close before init ([#23567](vitejs/vite#23567)) ([5f89433](vitejs/vite@5f89433))
- **server:** avoid reinitializing watcher when adding file after server close ([#23572](vitejs/vite#23572)) ([6f831f9](vitejs/vite@6f831f9))
- **sourcemap:** skip URL source roots when injecting sources content ([#23519](vitejs/vite#23519)) ([04fc30a](vitejs/vite@04fc30a))

##### Miscellaneous Chores

- merge prereleases in changelog ([#23466](vitejs/vite#23466)) ([99bd9d1](vitejs/vite@99bd9d1))
- **optimizer:** add debug log when waiting for dep before init ([#23566](vitejs/vite#23566)) ([63567c7](vitejs/vite@63567c7))
- update `optimizeDeps.include` comment ([#23489](vitejs/vite#23489)) ([6a84c72](vitejs/vite@6a84c72))

##### Code Refactoring

- assets regexp use non-capture ([#23491](vitejs/vite#23491)) ([f4b4431](vitejs/vite@f4b4431))
- remove duplicate configurations ([#23532](vitejs/vite#23532)) ([9abd99b](vitejs/vite@9abd99b))
- replace `find` with `some` ([#23554](vitejs/vite#23554)) ([af7cdf6](vitejs/vite@af7cdf6))
@commercelayer-ci commercelayer-ci mentioned this pull request Oct 25, 2026
Open
@RogerioDoCarmo RogerioDoCarmo mentioned this pull request Oct 25, 2026
Open
renovate Bot added a commit to cigaleapp/cigale that referenced this pull request Oct 25, 2026
@renovate
⬆️ Update dependency vite to ^8.3.4
00a698b 
##### [v8.3.4](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-834-2026-10-08-small)

##### Features

- **bundled-dev:** support `import.meta.hot.acceptExports` ([#23463](vitejs/vite#23463)) ([bc0f21c](vitejs/vite@bc0f21c))

##### Bug Fixes

- avoid mutating hmr defaults (fix [#23575](vitejs/vite#23575)) ([#23576](vitejs/vite#23576)) ([574d5e3](vitejs/vite@574d5e3))
- **build:** correct preloads when chunkImportMap is enabled with non-root base ([#23698](vitejs/vite#23698)) ([2a8c0f0](vitejs/vite@2a8c0f0))
- **build:** wait for in-flight stylesheets in preload helper (fix [#23652](vitejs/vite#23652)) ([#23662](vitejs/vite#23662)) ([036b745](vitejs/vite@036b745))
- **bundled-dev:** serve `/@vite/client` and stub `@vite/env` ([#23664](vitejs/vite#23664)) ([5afc5a8](vitejs/vite@5afc5a8))
- **client:** skip rewriting unchanged adopted styles ([#23697](vitejs/vite#23697)) ([fa71469](vitejs/vite@fa71469))
- **css:** resolve imported preprocessors from their file path with lightningcss ([#23688](vitejs/vite#23688)) ([cf52011](vitejs/vite@cf52011))
- **deps:** update all non-major dependencies ([#23648](vitejs/vite#23648)) ([8a4c19c](vitejs/vite@8a4c19c))
- **deps:** update rolldown-related dependencies ([#23649](vitejs/vite#23649)) ([794516d](vitejs/vite@794516d))
- **dev:** a restart requested during a restart used to be dropped (fix [#23392](vitejs/vite#23392)) ([#23484](vitejs/vite#23484)) ([70d56ea](vitejs/vite@70d56ea))
- don't treat modules ending with js-like query as js ([#23687](vitejs/vite#23687)) ([fcb6f12](vitejs/vite@fcb6f12))
- **html:** avoid adding filesystem root to watcher ([#23689](vitejs/vite#23689)) ([3a7f2ae](vitejs/vite@3a7f2ae))
- **html:** skip caching CSS of chunks in a cycle (fix [#23628](vitejs/vite#23628)) ([#23636](vitejs/vite#23636)) ([15d82f7](vitejs/vite@15d82f7))
- **optimizer:** scan deep imports with custom extensions ([#23678](vitejs/vite#23678)) ([8579189](vitejs/vite@8579189))
- remove input option unescaping for now ([#23694](vitejs/vite#23694)) ([facc2fb](vitejs/vite@facc2fb))
- **server:** match static aliases on path boundaries ([#23643](vitejs/vite#23643)) ([b28db28](vitejs/vite@b28db28))
- **watcher:** normalize file before root check in `ensureWatchedFile` ([#23673](vitejs/vite#23673)) ([12bb28c](vitejs/vite@12bb28c))

##### Performance Improvements

- **module-runner:** skip cloning call sites that have no source map ([#23646](vitejs/vite#23646)) ([3d67486](vitejs/vite@3d67486))

##### Code Refactoring

- **bundled-dev:** import CSS HMR helpers from `/@vite/client` ([#23674](vitejs/vite#23674)) ([182f5b2](vitejs/vite@182f5b2))
##### [v8.3.3](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-833-2026-10-06-small)

##### Bug Fixes

- **deps:** update launch-editor to v2.14.2 ([#23654](vitejs/vite#23654)) ([22fd1d5](vitejs/vite@22fd1d5))
- **html:** filename passed to transformIndexHtml should not include queries ([#23653](vitejs/vite#23653)) ([7dafd8e](vitejs/vite@7dafd8e))
- **server:** check `fs.serve` for `?vite-wasm-instance` ([#23655](vitejs/vite#23655)) ([ba8b7ab](vitejs/vite@ba8b7ab))
- **server:** store ids to `safeModulePaths` rather than URLs ([#23656](vitejs/vite#23656)) ([c3e06f9](vitejs/vite@c3e06f9))
renovate Bot added a commit to cigaleapp/cigale that referenced this pull request Oct 26, 2026
@renovate
⬆️ Update dependency vite to ^8.3.4
0e3fba0 
##### [v8.3.4](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-834-2026-10-08-small)

##### Features

- **bundled-dev:** support `import.meta.hot.acceptExports` ([#23463](vitejs/vite#23463)) ([bc0f21c](vitejs/vite@bc0f21c))

##### Bug Fixes

- avoid mutating hmr defaults (fix [#23575](vitejs/vite#23575)) ([#23576](vitejs/vite#23576)) ([574d5e3](vitejs/vite@574d5e3))
- **build:** correct preloads when chunkImportMap is enabled with non-root base ([#23698](vitejs/vite#23698)) ([2a8c0f0](vitejs/vite@2a8c0f0))
- **build:** wait for in-flight stylesheets in preload helper (fix [#23652](vitejs/vite#23652)) ([#23662](vitejs/vite#23662)) ([036b745](vitejs/vite@036b745))
- **bundled-dev:** serve `/@vite/client` and stub `@vite/env` ([#23664](vitejs/vite#23664)) ([5afc5a8](vitejs/vite@5afc5a8))
- **client:** skip rewriting unchanged adopted styles ([#23697](vitejs/vite#23697)) ([fa71469](vitejs/vite@fa71469))
- **css:** resolve imported preprocessors from their file path with lightningcss ([#23688](vitejs/vite#23688)) ([cf52011](vitejs/vite@cf52011))
- **deps:** update all non-major dependencies ([#23648](vitejs/vite#23648)) ([8a4c19c](vitejs/vite@8a4c19c))
- **deps:** update rolldown-related dependencies ([#23649](vitejs/vite#23649)) ([794516d](vitejs/vite@794516d))
- **dev:** a restart requested during a restart used to be dropped (fix [#23392](vitejs/vite#23392)) ([#23484](vitejs/vite#23484)) ([70d56ea](vitejs/vite@70d56ea))
- don't treat modules ending with js-like query as js ([#23687](vitejs/vite#23687)) ([fcb6f12](vitejs/vite@fcb6f12))
- **html:** avoid adding filesystem root to watcher ([#23689](vitejs/vite#23689)) ([3a7f2ae](vitejs/vite@3a7f2ae))
- **html:** skip caching CSS of chunks in a cycle (fix [#23628](vitejs/vite#23628)) ([#23636](vitejs/vite#23636)) ([15d82f7](vitejs/vite@15d82f7))
- **optimizer:** scan deep imports with custom extensions ([#23678](vitejs/vite#23678)) ([8579189](vitejs/vite@8579189))
- remove input option unescaping for now ([#23694](vitejs/vite#23694)) ([facc2fb](vitejs/vite@facc2fb))
- **server:** match static aliases on path boundaries ([#23643](vitejs/vite#23643)) ([b28db28](vitejs/vite@b28db28))
- **watcher:** normalize file before root check in `ensureWatchedFile` ([#23673](vitejs/vite#23673)) ([12bb28c](vitejs/vite@12bb28c))

##### Performance Improvements

- **module-runner:** skip cloning call sites that have no source map ([#23646](vitejs/vite#23646)) ([3d67486](vitejs/vite@3d67486))

##### Code Refactoring

- **bundled-dev:** import CSS HMR helpers from `/@vite/client` ([#23674](vitejs/vite#23674)) ([182f5b2](vitejs/vite@182f5b2))
##### [v8.3.3](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-833-2026-10-06-small)

##### Bug Fixes

- **deps:** update launch-editor to v2.14.2 ([#23654](vitejs/vite#23654)) ([22fd1d5](vitejs/vite@22fd1d5))
- **html:** filename passed to transformIndexHtml should not include queries ([#23653](vitejs/vite#23653)) ([7dafd8e](vitejs/vite@7dafd8e))
- **server:** check `fs.serve` for `?vite-wasm-instance` ([#23655](vitejs/vite#23655)) ([ba8b7ab](vitejs/vite@ba8b7ab))
- **server:** store ids to `safeModulePaths` rather than URLs ([#23656](vitejs/vite#23656)) ([c3e06f9](vitejs/vite@c3e06f9))
@formicoidea formicoidea mentioned this pull request Oct 26, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

p5-urgent Fix build-breaking bugs affecting most users, should be released ASAP (priority) security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@sapphi-red