Skip to content

Bump vite from 7.2.6 to 8.3.0 - #18

Closed
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/develop/vite-8.3.0
Closed

Bump vite from 7.2.6 to 8.3.0#18
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/develop/vite-8.3.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 23, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps vite from 7.2.6 to 8.3.0.

Release notes

Sourced from vite's releases.

create-vite@8.3.0

Please refer to CHANGELOG.md for details.

v8.3.0

Features

  • build: avoid settling seen preload dependencies for performance (#23446) (e6f6b3e)

Bug Fixes

  • handle CRLF line endings in code frame positions (#23219) (9913672)
  • only treat whole node_modules path segments as dependencies (fix #17467) (#23437) (ef0dc17)

Performance Improvements

  • proxy: pre-compile context matchers at server creation (#23263) (8abf700)

v8.3.0-beta.1

Features

Bug Fixes

  • build: keep hash placeholders as-is in resolveFileUrl hook (#23422) (e8d6a4d)
  • bundled-dev: mark payload delivered on client report (#23373) (a6d43bc)
  • deps: update all non-major dependencies (#23445) (fc7c104)
  • html: don't inline preload link targets (fix #13355) (#23387) (12e709c)
  • resolve the actual package root in findNearestMainPackageData for nested package.json (#23356) (8492422)
  • shortcuts extend error (#23447) (4ec58d1)

Miscellaneous Chores

v8.3.0-beta.0

Features

  • accept Rolldown watch options in server.watch (#23133) (1b5cfe3)
  • add closeServer and closePreviewServer hooks (#23110) (e17d2d5)
  • add top-level tsconfig option (#23310) (93164c3)
  • add warning for unsupported hooks in plugin returned from applyToEnvironment hook (#23191) (fdef04f)
  • cli: support naming the CPU profile via --profile [name] (#23042) (a500dee)
  • config: warn on named imports from JSON modules (#23378) (472385e)
  • css: minify style tag (#23183) (8156684)
  • searched params attached to workers are now preserved (#22280) (517b97f)
  • support subpath imports in dynamic import statements (#23185) (b78e2f1)
  • use import.meta.ROLLDOWN_FILE_URL_* for assets in JS (#22888) (4366ac4)
  • use import.meta.ROLLDOWN_FILE_URL_* for other plugins (#22894) (e38f29e)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.0 (2026-09-10)

Features

  • build: avoid settling seen preload dependencies for performance (#23446) (e6f6b3e)
  • devtools: enable dev server integration (#23333) (68aeb8a)
  • accept Rolldown watch options in server.watch (#23133) (1b5cfe3)
  • add closeServer and closePreviewServer hooks (#23110) (e17d2d5)
  • add top-level tsconfig option (#23310) (93164c3)
  • add warning for unsupported hooks in plugin returned from applyToEnvironment hook (#23191) (fdef04f)
  • cli: support naming the CPU profile via --profile [name] (#23042) (a500dee)
  • config: warn on named imports from JSON modules (#23378) (472385e)
  • css: minify style tag (#23183) (8156684)
  • searched params attached to workers are now preserved (#22280) (517b97f)
  • support subpath imports in dynamic import statements (#23185) (b78e2f1)
  • use import.meta.ROLLDOWN_FILE_URL_* for assets in JS (#22888) (4366ac4)
  • use import.meta.ROLLDOWN_FILE_URL_* for other plugins (#22894) (e38f29e)
  • worker: remove worker chunk if it's detected that it's not referenced (#22473) (924997a)

Bug Fixes

  • handle CRLF line endings in code frame positions (#23219) (9913672)
  • only treat whole node_modules path segments as dependencies (fix #17467) (#23437) (ef0dc17)
  • build: keep hash placeholders as-is in resolveFileUrl hook (#23422) (e8d6a4d)
  • bundled-dev: mark payload delivered on client report (#23373) (a6d43bc)
  • deps: update all non-major dependencies (#23445) (fc7c104)
  • html: don't inline preload link targets (fix #13355) (#23387) (12e709c)
  • resolve the actual package root in findNearestMainPackageData for nested package.json (#23356) (8492422)
  • shortcuts extend error (#23447) (4ec58d1)
  • config: close bundles when generation fails (#23256) (6bacc95)
  • css: keep newline-separated srcset candidates intact (#23265) (4f9d2f4)
  • deps: update all non-major dependencies (#23337) (d550815)
  • deps: update all non-major dependencies (#23404) (238ad81)
  • deps: update rolldown-related dependencies (#23338) (76e8082)
  • deps: update rolldown-related dependencies (#23405) (b882566)
  • dev: run closeBundle after buildEnd failure (#23165) (8cb872e)
  • hmr: handle import.meta.hot.invalidate in virtual module (#23171) (6162968)
  • utils: handle dot in srcset density descriptor (#23346) (b50e1b4)
  • utils: match timestamp query parameter with proper delimiters (#23364) (41f3c6f)

Performance Improvements

  • proxy: pre-compile context matchers at server creation (#23263) (8abf700)

Miscellaneous Chores

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 23, 2026
@dependabot
Bump vite from 7.2.6 to 8.3.0
3e12e09 
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 7.2.6 to 8.3.0.
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/create-vite@8.3.0/packages/vite)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 8.3.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title build(deps-dev): bump vite from 7.2.6 to 8.3.0 Bump vite from 7.2.6 to 8.3.0 Sep 24, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/develop/vite-8.3.0 branch from 0f354be to 3e12e09 Compare September 24, 2026 19:29
EarMaster added a commit that referenced this pull request Sep 24, 2026
@EarMaster @claude
Skip CodeQL's rust analysis on pull requests that touch no Rust
46c2650 
The rust leg is the whole length of codeql.yml - six to eight minutes, against
about one each for actions and javascript-typescript - and almost none of it
is this repository's code. The extractor spends it resolving the 799 crates in
Cargo.lock, and the queries spend it on one shared pass over the database that
builds, which is why all 37 finish within seconds of each other. Caching the
cargo registry was measured and saved nothing, so the remaining lever is not
running it when it cannot find anything new.

A small job now asks the pull request's file list whether anything under
src-tauri/, or this workflow itself, changed. When nothing did, the rust leg
still runs as a job but skips its steps and says so in its summary, so the
check reads as skipped rather than disappearing. Every doubt resolves to
analysing: a failed lookup, an empty list, or a list at the endpoint's
3000-file cap. The weekly schedule and a manual dispatch always analyse
everything, which keeps the Security tab's baseline for main complete.

Checked the lookup against real pull requests: #16 and #18 (npm only) skip,
#19 and #21 (cargo) analyse, #23 (develop) analyses, a missing PR analyses,
and a scheduled run analyses.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@EarMaster

EarMaster commented Sep 24, 2026

Copy link
Copy Markdown
Owner

Closing: scheduled npm/cargo version updates are being turned off. Dependencies are now refreshed by hand before each release, and security alerts stay on.

@EarMaster EarMaster closed this Sep 24, 2026
@EarMaster
EarMaster deleted the dependabot/npm_and_yarn/develop/vite-8.3.0 branch September 24, 2026 22:55
@dependabot @github

dependabot Bot commented on behalf of github Sep 24, 2026

Copy link
Copy Markdown
Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@EarMaster