[Snyk] Security upgrade @vitejs/plugin-react from 4.3.0 to 6.0.0

[snyk-io]

Snyk has created this PR to fix 2 vulnerabilities in the pnpm dependencies of this project.

Snyk changed the following file(s):

• packages/sample/package.json

⚠️ Warning

Failed to update the pnpm-lock.yaml, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Prototype Pollution SNYK-JS-BROWSERSLIST-18854715	124
	Allocation of Resources Without Limits or Throttling SNYK-JS-BROWSERSLIST-18856271	124

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Allocation of Resources Without Limits or Throttling

[snyk-io]

This major version upgrade from v4 to v6 of @vitejs/plugin-react introduces a significant breaking change by removing the built-in Babel integration.

Key Breaking Change (in v6.0.0):

• Removal of Babel: The plugin no longer includes Babel as a dependency, and the babel option within the plugin's configuration has been removed. [1, 2, 4] Projects that previously customized Babel by passing options like react({ babel: { ... } }) will no longer work as expected. [4]
• New Architecture: The plugin now uses Oxc (a Rust-based tool) for the React Refresh transform, which improves performance. [2]

Recommendation:

If your project relies on custom Babel plugins (including the React Compiler), you must refactor your Vite configuration. The required action is to explicitly add @rolldown/plugin-babel to your project and configure it separately from the react() plugin. [1, 4]

Example Migration:

Before (v4.x):

// vite.config.js  
import react from '@vitejs/plugin-react';  
  
export default {  
  plugins: [  
    react({  
      babel: { plugins: ['my-babel-plugin'] },  
    }),  
  ],  
};  

After (v6.0.0):

// vite.config.js  
import react from '@vitejs/plugin-react';  
import babel from '@rolldown/plugin-babel';  
  
export default {  
  plugins: [  
    babel({ plugins: ['my-babel-plugin'] }),  
    react(),  
  ],  
};  

If you were not using the babel option, this upgrade may not require code changes, but the risk is high due to the fundamental architectural shift. Thorough testing is strongly recommended.

Source: CHANGELOG

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[snyk-io]

⛔ Snyk checks have failed. 6 issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (6)
⛔	Open Source Security	0	6	0	0	6 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.