fix(deps): update all non-major dependencies by renovate[bot] · Pull Request #23648 · vitejs/vite

renovate · 2026-10-05T00:58:36Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update
@shikijs/vitepress-twoslash (source)	`^4.4.3` → `^4.5.0`	devDependencies	minor
@types/node (source)	`^24.19.0` → `^24.19.1`	devDependencies	patch
@types/ws (source)	`^8.18.1` → `^8.18.2`	devDependencies	patch
@vitejs/plugin-react (source)	`^6.1.1` → `^6.1.2`	devDependencies	patch
acorn	`^8.18.0` → `^8.19.0`	devDependencies	minor
baseline-browser-mapping	`^2.11.26` → `^2.11.27`	devDependencies	patch
browserslist	`^4.29.1` → `^4.29.3`	dependencies	patch
eslint (source)	`10.11.0` → `10.12.0`		minor
eslint-plugin-n	`^18.4.0` → `^18.4.1`	devDependencies	patch
globals	`17.12.0` → `17.13.0`		minor
globals	`^17.12.0` → `^17.13.0`	devDependencies	minor
magic-string	`^1.4.2` → `^1.4.3`	dependencies	patch
magic-string	`^1.4.2` → `^1.4.3`	devDependencies	patch
oxfmt (source)	`^0.70.0` → `^0.72.0`	devDependencies	minor
oxlint (source)	`^1.85.0` → `^1.87.0`	devDependencies	minor
pnpm (source)	`12.6.0` → `12.9.1`	packageManager	minor
postcss (source)	`^8.5.28` → `^8.5.29`	dependencies	patch
sass	`^1.105.0` → `^1.105.1`	devDependencies	patch
sass-embedded	`^1.105.0` → `^1.105.1`	devDependencies	patch
semgrep/semgrep	`1.178.0` → `1.179.0`	container	minor
typescript-eslint (source)	`8.70.1` → `8.71.1`		minor
typescript-eslint (source)	`^8.70.1` → `^8.71.1`	devDependencies	minor
vite (source)	`^8.3.1` → `^8.3.3`	devDependencies	patch
vitest (source)	`^5.0.2` → `^5.0.3`	devDependencies	patch
vue-tsc (source)	`^3.3.11` → `^3.3.12`	devDependencies	patch

Release Notes

shikijs/shiki (@shikijs/vitepress-twoslash)

`v4.5.0`

Compare Source

🚀 Features

Emit an explicit color level from codeToANSI - by @EvanProgramming in #1320 (b968e)
transformers:
- Add classActiveCode option to transformerNotationWordHighlight - by @curiouscoder-cmd in #1201 (1e968)
- Add transformerRenderLineNumber - by @Divyapahuja31 and DIVYA PAHUJA in #1238 (02f05)

🐞 Bug Fixes

cli:
- Fall back to 'text' when file/URL has no extension and no -… - by @VeerShah41 in #1248 (c00e5)
- Fall back to plaintext for unknown languages - by @Jinjiang and @antfubot in #1319 (4eb7c)
primitive:
- Dispose wasm memory for lazily embedded langs - by @rgodha24 in #1322 (b5423)
- Dedupe grammar injections on repeated language loads - by @antlio and @antfubot in #1318 (33678)
stream:
- Compile Solid renderer with babel-preset-solid - by @BetterAndBetterII and @antfu in #1309 (8724e)
transformers:
- Keep notations on content comment lines - by @tianrking in #1308 (d25ab)
- Handle split # and -- comments in rose-pine theme - by @anandghegde in #1317 (63e6d)
twoslash:
- Avoid crash when @errors nodes land past EOF - by @Yahiro025, @cursoragent and @antfubot in #1316 (5c919)

🏎 Performance

engine-js: Reuse each regex's last search while tokenizing a line - by @issacgerges and @antfu in #1314 (2ef5e)
stream: Group tokens by line in the React renderer - by @CNSeniorious000 in #1311 (81200)
vitepress-twoslash: Replace lz-string with lz-string-es - by @antfubot in #1324 (2e170)

View changes on GitHub

vitejs/vite-plugin-react (@vitejs/plugin-react)

`v6.1.2`

Compare Source

Fix HMR for compound components (#1484)

Adding or removing a component from a compound component was not handled, creating stale updates. Doing this now triggers hmr invalidate on the file and propagates the invalidation to importers.

Fix `compiler.logDiagnostics` option not working (#1483)

With oxc-transform-react >= 0.148, the logDiagnostics was not working. This version fixes it and requires oxc-transform-react >= 0.152 as a peer dependency if you are using the compiler option. compiler.logDiagnostics option is now deprecated and should be swapped for the builtin compiler.reportDiagnostics.

Disable refresh for non-jsx with compiler enabled (fix #1478) (#1485)

When the compiler was enabled, TS files could trigger fast refresh which would cause runtime errors. The logic now follows what the builtin oxc plugin in Vite does.

acornjs/acorn (acorn)

`v8.19.0`

Compare Source

web-platform-dx/baseline-browser-mapping (baseline-browser-mapping)

`v2.11.27`

Compare Source

browserslist/browserslist (browserslist)

`v4.29.3`

Compare Source

Updated Firefox ESR.

`v4.29.2`

Compare Source

Fixed ignoring null usage in cover X in Y query (by @wahidrizka).

eslint/eslint (eslint)

`v10.12.0`

Compare Source

Features

4618052 feat: handle astral letters in new-cap (#21357) (sary)
4ec5168 feat: allow SourceCode#getText() to accept tokens and comments (#21340) (electrohyun)

Bug Fixes

bc51eee fix: prefer-arrow-callback false positive in conditional test (#21373) (Daniel Pinto)
bbff86c fix: skip lines with multiple comments in max-lines-per-function (#21332) (xbinaryx)
efc4d6b fix: astral letters in consistent-return, no-eval, no-invalid-this (#21360) (lumir)
93de066 fix: prefer-exponentiation-operator autofix for async function base (#21322) (Vladimir Babin)
02e34ff fix: add missing space after else in curly autofix (#21355) (Pixel)
b14b8bc fix: correct id-length message for long private names (#21348) (Pixel)
69aac01 fix: support TSFunctionType in getFunctionHeadLoc (#21335) (xbinaryx)
686630e fix: no-loss-of-precision false positive with 0.e5 (#21337) (sethamus)

Documentation

67eb586 docs: Update README (GitHub Actions Bot)
5370d7e docs: clarify one-var separateRequires matches any require() call (#21192) (sethamus)
8816c1d docs: Update README (GitHub Actions Bot)
3d2e7ce docs: fix typo in no-unused-expressions documentation (#21346) (bytedoe)

Chores

152067f chore: update ecosystem plugins (#21362) (ESLint Bot)
b56d58e chore: update github/codeql-action action to v4.38.2 (#21376) (renovate[bot])
bfaea12 perf: cache normalized config globals per languageOptions (#21364) (James Ross)
322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#21369) (Francesco Trotta)
d166567 chore: update dependency prettier to v3.9.9 (#21371) (renovate[bot])
29585ce chore: update dependency eslint-plugin-expect-type to ^0.7.0 (#21359) (renovate[bot])
39d79ba chore: update github/codeql-action action to v4.38.1 (#21354) (renovate[bot])
182a6e9 chore: update dependency prettier to v3.9.8 (#21352) (renovate[bot])
f995127 chore: remove CLAUDE.md in favor of AGENTS.md (#21339) (Jarren)
b95fb6c chore: update dependency prettier to v3.9.7 (#21347) (renovate[bot])
3782dd4 chore: update ecosystem plugins (#21342) (ESLint Bot)

eslint-community/eslint-plugin-n (eslint-plugin-n)

`v18.4.1`

Compare Source

🩹 Fixes

prefer-promises/fs: cover fs.watch (#566) (37bf3a2)
properly handle extension override mappings in file-extension-in-import (#572) (995c881)

🧹 Chores

cache parsed tsconfig per directory (#571) (1cfd694)
Remove stale TypeScript suppressions blocking the Lint job (#574) (73f4d4f)
resolve import targets lazily and reuse resolvers (#570) (aff82d1)

sindresorhus/globals (globals)

`v17.13.0`

Compare Source

Update globals (2026-10-01) (#354) b007369

Rich-Harris/magic-string (magic-string)

`v1.4.3`

Compare Source

Bug Fixes

preserve inserts when update spans several chunks (#361) (fb89bad)
replace the matched text when an offset is set (#362) (607e8e4)

oxc-project/oxc (oxfmt)

`v0.72.0`: oxfmt v0.72.0

Compare Source

💥 BREAKING CHANGES

e2c68b1 oxfmt: [BREAKING] Format parser:markdown files by oxc_formatter_markdown (#27256) (leaysgur)

🚀 Features

b538e3c formatter_css: Parse embedded CSS as a block's contents (#27284) (leaysgur)

🐛 Bug Fixes

71e400b formatter_markdown: Fixed remaining issues found by fuzz (#27334) (leaysgur)
7d0e54d formatter_markdown: Preserve line breaks around Chinese/Japanese characters in all proseWrap (#27331) (leaysgur)
e9ae2d8 formatter_css: Fix layouts found in mdn-content repo (css-in-md) (#27326) (leaysgur)
df85b4c oxfmt: Keep blank lines after a line break in Prettier Doc to IR (#27325) (leaysgur)
7f65b75 formatter: Format assignment target property as assignment-like (#27289) (leaysgur)
6c08f2a formatter_css: Apply the url() import exception to a lone comma group (#27288) (leaysgur)
1967302 formatter_css: Hug a spaced ident ( only at the at-rule prelude head (#27283) (leaysgur)
2445064 formatter_markdown: Keep a preserved line break before a delimiter row that opens no table (#27278) (leaysgur)
dd72fbf formatter_markdown: Keep container columns as spaces under useTabs (#27277) (leaysgur)
1686018 oxfmt: Make one state conditionalGroup fit up to first hardline (#27275) (leaysgur)
fd4ddce formatter_json: Flatten block comment only array|object (#27274) (leaysgur)
267557c formatter,oxfmt: Embed only original JSDoc plugin supported languages (#27241) (leaysgur)
2606c60 oxfmt: Do not re-include a file below an excluded directory with a negated pattern (#27237) (Nicolas Le Cam)
c2de02b formatter: Decide embedded template layout from AST, not source shape (#27218) (leaysgur)
c9e1224 formatter: Handle quoteProps: consistent for patterns and computed keys (#27216) (leaysgur)
36e14df formatter: Keep comments between callee and its opener on the callee side (#27172) (leaysgur)
6da7657 oxfmt: Render diagnostics with source in Stdin mode (#27130) (leaysgur)
e9b2ec5 oxfmt/lsp: Reload .prettierignore on watched file change (#27129) (leaysgur)
30eb463 oxfmt: Check global ignores before resolving nested config in Stdin mode (#27128) (leaysgur)

⚡ Performance

72f42a3 formatter_markdown: Pre-allocate the IR buffer (#27333) (leaysgur)
cea47e3 formatter_core: Avoid exponential will_break check on nested interned (#27211) (leaysgur)
0aba566 oxfmt: Do not resolve root js config from nested context (#27147) (leaysgur)

📚 Documentation

51506c6 formatter_css: Record divergences found in mdn-content (css-in-md) (#27327) (leaysgur)
656b81c formatter_markdown: Record unclosed fences closing at a directive's closer (#27279) (leaysgur)
66545bf formatter_markdown: Record setext heading wrap divergence (#27221) (leaysgur)
af4b269 oxfmt: Document why format() API does not take cwd (#27131) (leaysgur)

`v0.71.0`: oxfmt v0.71.0

Compare Source

🚀 Features

e0b1f9f oxfmt: Bump bundled Prettier version to 3.9.9 (#27002) (leaysgur)
342527d oxfmt: Bump bundled Prettier version to 3.9.8 (#26999) (leaysgur)

🐛 Bug Fixes

eeba1db formatter: Skip test-call layout when arguments have comments (#27119) (leaysgur)
1f7b8ad oxfmt: Allow repeated CLI calls in the same process (#27051) (Liang)
7bcb807 formatter_markdown: Keep blank line between HTML and nested list (#27112) (leaysgur)
10b10c5 formatter: Keep comments around = on their side and line (#27041) (leaysgur)
9aad365 formatter: Keep comments deferred before an assignment operator (#26997) (waltu)
8fbddb1 formatter/jsdoc: More alignment with original plugin (#27039) (leaysgur)
50be18e formatter: Keep trailing spaces on normal block comments (#27037) (leaysgur)
56d1880 formatter: Nestle adjacent block comments (#27036) (leaysgur)
3be5d94 formatter: Treat /*** comments as JSDoc (#27035) (leaysgur)
cd45f71 formatter: Keep trailing double spaces on JSDoc lines (#26861) (John Costa)
fd695f4 formatter_markdown: Fix more mismatches found in ecosystem-ci repos (#27003) (leaysgur)
4e77d59 formatter_markdown: Keep a math span after a kept line break from opening a block (#27001) (leaysgur)
584b8b0 formatter_markdown: Keep a shape line after a multi-line inline node or link title (#27000) (leaysgur)
b939645 formatter_markdown: Keep a line break before an inline liquid tag under preserve (#26998) (leaysgur)

pnpm/pnpm (pnpm)

`v12.9.1`: pnpm 12.9.1

Compare Source

This release moves the WebContainer build into a separate @pnpm/wasm package, shrinks the pnpm package back to about 4 MB, and fixes pnpm publish with provenance from GitLab CI.

Patch Changes

The WebAssembly build for StackBlitz WebContainers now ships as a separate @pnpm/wasm package. The pnpm and @pnpm/exe packages no longer include it, which brings their unpacked size back from about 55 MB to about 4 MB. In a WebContainer, install @pnpm/wasm with npm to get the pnpm command.
pnpm publish with provenance from GitLab CI is no longer rejected by the npm registry with a 422 error. The provenance statement now includes the GitLab CI variables in invocation.parameters, as npm does #16551.
pnpm audit signatures now uses the TLS settings of the redirect target when a registry redirects its signing-keys request, for example to registry.npmjs.org. A cafile scoped to a private registry no longer makes the redirected request fail #16541.
Fixed pnpm install --frozen-lockfile rejecting an up-to-date lockfile when an injected workspace package uses a catalog entry in peerDependencies #16557.
The [<since>] filter selector works again with Git 2.24 through 2.27 #16561. With Git older than 2.24, the selector now fails with an error that names the required Git version.

It also detects changes in projects whose directory names contain non-ASCII characters. Such a change used to be credited to the parent project. changedFilesIgnorePattern and testPattern now match changed files whose names contain non-ASCII characters.
The pnpm executable is about 10% smaller. On macOS arm64 it went from 45.1 MB to 40.3 MB.
Sped up trust downgrade checks for packages with long release histories.
With optimisticRepeatInstall: false, pnpm install now runs the projects' own lifecycle scripts, such as prepare, even when node_modules is already up to date #16545.
pnpm self-update now fails for Homebrew-installed pnpm and prints the brew upgrade command for the installed formula, such as brew upgrade pnpm or brew upgrade pnpm@11. It used to install a second copy of pnpm that the Homebrew one kept shadowing #16547.

Platinum Sponsors

Gold Sponsors

`v12.9.0`: pnpm 12.9

Compare Source

This release runs pnpm in StackBlitz WebContainers, adds a per-registry networkConcurrency setting, and records every installed project in the store. It also carries a security fix for pnpm login.

Minor Changes

pnpm now automatically uses WebAssembly in StackBlitz WebContainers, including when installation scripts are disabled. Native installations continue to use the native executable when installation scripts are enabled.
A registries entry can now set networkConcurrency, the most requests pnpm keeps in flight to that registry's origin. Requests to other registries keep the overall limit. The setting may live in pnpm-workspace.yaml or the global config.yaml.
```
registries:
  https://npm.corp.example.com/:
    scopes: ["@acme"]
    networkConcurrency: 4
```
pnpm install now records every project it installs in the store's projects directory, as a symlink to the project directory. A --frozen-store install without the global virtual store still records nothing. Only projects that used the global virtual store were recorded before #6929.

Patch Changes

pnpm login no longer forwards credentials in its request body to another origin during redirects.

Installing packages

Fixed pnpm install failing on Android with ERR_PNPM_STORE_DIR_ACQUIRE_OPERATION_LOCK #16508.
pnpm install --frozen-lockfile again succeeds when a workspace project recorded in pnpm-lock.yaml has no directory, such as a project left out of a Docker build context. It still fails if the project's directory exists without a package.json #16453.
pnpm install --frozen-lockfile no longer requires a pnpm-lock.yaml in a project that has no dependencies. It also succeeds when pnpm-lock.yaml records only the pinned pnpm version, as other commands write it when they run before the first install #16477.
Fixed pnpm install --frozen-lockfile rejecting a fresh lockfile when an injected workspace dependency has an optional peer supplied by another workspace project #16428.
With nodeLinker: hoisted, a filtered install now keeps the packages of the workspace projects an earlier install put in node_modules. This also covers the install that pnpm --filter <selector> run and pnpm --filter <selector> exec start before the command. Before, these installs removed every package that only the unselected projects needed #16483.
pnpm install with nodeLinker: hoisted now refreshes directories supplied by custom fetchers when reinstalling. pnpm also keeps the symlinks inside those directories.
With enableGlobalVirtualStore on, scripts can run entry points that a CommonJS require hook loads again, such as ts-node index.ts. They failed with ERR_UNKNOWN_FILE_EXTENSION on Node.js versions without built-in TypeScript support #16436.
pnpm now keeps each project's current lockfile and hidden hoisted dependencies in its own node_modules/.pnpm when virtualStoreDir points at a shared global virtual store. --virtual-store-dir now sets the global virtual store's location too pnpm/tasks#47.
pnpm clean no longer deletes the project when virtualStoreDir or globalVirtualStoreDir is set to the project directory. It also leaves a directory outside the project alone when the setting reaches it through a symlink. It now removes a global virtual store that globalVirtualStoreDir places inside the project, as it does for virtualStoreDir.

Optional dependencies

pnpm install no longer fails when a dependency of an optional dependency is missing from the registry. Like npm, pnpm now leaves out the nearest optional dependency above it, together with its subtree #16511.
When an optional dependency fails to build, pnpm now removes its link from node_modules. A repeat pnpm install then reports "Already up to date" and no longer reruns the failing build #16468.
pnpm install now prints a warning with the error when an optional dependency cannot be fetched and is skipped. The skipped package is no longer counted in the Packages: +N summary. The pnpm:skipped-optional-dependency log reports the skip with the fetch_failure reason #16514.

Resolving dependencies

Fixed pnpm install changing an unchanged project's direct dependency to a sibling workspace's pinned version when its dependency tree contains a cycle #16417.
With autoDedupe enabled, downgrading a dependency in one workspace project now moves the other projects to that version when it satisfies their ranges. This also applies to a filtered pnpm --filter <project> add #16432.
pnpm install and pnpm dedupe now move an optional peer to the version already in the dependency graph when no other package provides its locked version anymore. After a bump such as vue 3.5.40 to 3.5.43, the lockfile kept a second copy of @vue/server-renderer for @vue/test-utils #16443.
pnpm dedupe --check no longer fails right after pnpm install when a project's optional peer is satisfied by a package another workspace project installs. pnpm dedupe now picks the same versions for that package's dependencies as pnpm install #16447.
pnpm install no longer re-resolves an up-to-date lockfile on every run when a patched package is a peer in a peer cycle #16418.
With autoDedupe enabled, pnpm install --lockfile-only no longer resolves the dependency graph again when nothing changed since an earlier --lockfile-only install deduplicated the lockfile. Such an install keeps the lockfile even if versions were published since it was written, or if only a setting such as resolutionMode changed. Run pnpm dedupe to apply such a change #16458.

Speed and network

A repeat pnpm install in a large workspace reports "Already up to date" faster #16487.
Sped up dependency resolution of workspaces with many peer dependencies.
pnpm install sends fewer registry metadata requests when the lockfile already decides which version a range resolves to. This now also covers ranges that several locked versions satisfy when one of them outranks the others, and direct dependencies kept at their locked version. Packages that minimumReleaseAgeExclude lists without a version now reuse cached registry metadata the same way they do when minimumReleaseAge is not set #16458.
pnpm no longer downloads every packument again on each install from a registry whose metadata responses forbid caching, such as Cache-Control: no-store. pnpm revalidates the cached metadata with a conditional request, so a registry that supports conditional requests answers with a 304 when the package has not changed #16528.
Cached metadata for a package published within minimumReleaseAge is now revalidated with its ETag, so the npm registry can answer 304 Not Modified. Before, the next install that checked the cache downloaded the whole document again #16506.
A fetch timeout while other downloads from the same host are still running now lowers concurrency for that host to one connection. Retries of that request, and later downloads from that host, use the lower concurrency. Other hosts keep the configured concurrency #12791.
Sped up pnpm install --offline when the version a range picks is not in the store. While it looks for a version the store holds, pnpm now reads only the versions the range admits #16495.
pnpm install --offline now reuses config dependency tarballs that are already present in the store pnpm/tasks#46.

Running scripts

pnpm -s <script> runs the script again, with -s meaning --sequential as it does for pnpm run -s <script>. pnpm rejected it with "unexpected argument '-s' found" #16446.
pnpm run and pnpm exec now warn and run the command when the install that verifyDepsBeforeRun starts fails. This lets scripts run in sandboxes where pnpm cannot install, such as containers with a read-only store or no network #15173.
A filtered pnpm run or pnpm exec now finds dependencies out of date when a workspace dependency of a selected project has no node_modules directory, as after a filtered install. With verifyDepsBeforeRun: install, pnpm installs that dependency before running the command pnpm/tasks#45.
Scripts run without a terminal no longer start a second sh each. One watchdog per pnpm command now ends every script's process group if pnpm is killed, so pnpm -r run across many projects starts half as many processes #16489.
Terminate batch job (Y/N)? no longer appears after pressing Ctrl+C in a script started with pnpm from PowerShell or cmd on Windows #16502.
pnpm rebuild and pnpm approve-builds refresh command launchers when a build changes a

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

| datasource | package | from | to | | ---------- | ------- | ----- | ----- | | npm | vite | 8.3.0 | 8.3.4 | ## [v8.3.4](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-834-2026-10-08-small) ##### Features - **bundled-dev:** support `import.meta.hot.acceptExports` ([#23463](vitejs/vite#23463)) ([bc0f21c](vitejs/vite@bc0f21c)) ##### Bug Fixes - avoid mutating hmr defaults (fix [#23575](vitejs/vite#23575)) ([#23576](vitejs/vite#23576)) ([574d5e3](vitejs/vite@574d5e3)) - **build:** correct preloads when chunkImportMap is enabled with non-root base ([#23698](vitejs/vite#23698)) ([2a8c0f0](vitejs/vite@2a8c0f0)) - **build:** wait for in-flight stylesheets in preload helper (fix [#23652](vitejs/vite#23652)) ([#23662](vitejs/vite#23662)) ([036b745](vitejs/vite@036b745)) - **bundled-dev:** serve `/@vite/client` and stub `@vite/env` ([#23664](vitejs/vite#23664)) ([5afc5a8](vitejs/vite@5afc5a8)) - **client:** skip rewriting unchanged adopted styles ([#23697](vitejs/vite#23697)) ([fa71469](vitejs/vite@fa71469)) - **css:** resolve imported preprocessors from their file path with lightningcss ([#23688](vitejs/vite#23688)) ([cf52011](vitejs/vite@cf52011)) - **deps:** update all non-major dependencies ([#23648](vitejs/vite#23648)) ([8a4c19c](vitejs/vite@8a4c19c)) - **deps:** update rolldown-related dependencies ([#23649](vitejs/vite#23649)) ([794516d](vitejs/vite@794516d)) - **dev:** a restart requested during a restart used to be dropped (fix [#23392](vitejs/vite#23392)) ([#23484](vitejs/vite#23484)) ([70d56ea](vitejs/vite@70d56ea)) - don't treat modules ending with js-like query as js ([#23687](vitejs/vite#23687)) ([fcb6f12](vitejs/vite@fcb6f12)) - **html:** avoid adding filesystem root to watcher ([#23689](vitejs/vite#23689)) ([3a7f2ae](vitejs/vite@3a7f2ae)) - **html:** skip caching CSS of chunks in a cycle (fix [#23628](vitejs/vite#23628)) ([#23636](vitejs/vite#23636)) ([15d82f7](vitejs/vite@15d82f7)) - **optimizer:** scan deep imports with custom extensions ([#23678](vitejs/vite#23678)) ([8579189](vitejs/vite@8579189)) - remove input option unescaping for now ([#23694](vitejs/vite#23694)) ([facc2fb](vitejs/vite@facc2fb)) - **server:** match static aliases on path boundaries ([#23643](vitejs/vite#23643)) ([b28db28](vitejs/vite@b28db28)) - **watcher:** normalize file before root check in `ensureWatchedFile` ([#23673](vitejs/vite#23673)) ([12bb28c](vitejs/vite@12bb28c)) ##### Performance Improvements - **module-runner:** skip cloning call sites that have no source map ([#23646](vitejs/vite#23646)) ([3d67486](vitejs/vite@3d67486)) ##### Code Refactoring - **bundled-dev:** import CSS HMR helpers from `/@vite/client` ([#23674](vitejs/vite#23674)) ([182f5b2](vitejs/vite@182f5b2)) ## [v8.3.3](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-833-2026-10-06-small) ##### Bug Fixes - **deps:** update launch-editor to v2.14.2 ([#23654](vitejs/vite#23654)) ([22fd1d5](vitejs/vite@22fd1d5)) - **html:** filename passed to transformIndexHtml should not include queries ([#23653](vitejs/vite#23653)) ([7dafd8e](vitejs/vite@7dafd8e)) - **server:** check `fs.serve` for `?vite-wasm-instance` ([#23655](vitejs/vite#23655)) ([ba8b7ab](vitejs/vite@ba8b7ab)) - **server:** store ids to `safeModulePaths` rather than URLs ([#23656](vitejs/vite#23656)) ([c3e06f9](vitejs/vite@c3e06f9)) ## [v8.3.2](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-832-2026-10-01-small) ##### Bug Fixes - **build:** preload CSS correctly when `renderBuiltUrl` returns URLs with queries ([#23611](vitejs/vite#23611)) ([64e0a21](vitejs/vite@64e0a21)) - **bundled-dev:** serve lazy chunk sourcemaps ([#23026](vitejs/vite#23026)) ([eb7aa9a](vitejs/vite@eb7aa9a)) - **bundled-dev:** serve the rolldown runtime from the installed rolldown ([#23568](vitejs/vite#23568)) ([bc598a6](vitejs/vite@bc598a6)) - **deps:** update all non-major dependencies ([#23601](vitejs/vite#23601)) ([9944fa6](vitejs/vite@9944fa6)) - **deps:** update rolldown-related dependencies ([#23602](vitejs/vite#23602)) ([88c1741](vitejs/vite@88c1741)) - **html:** resolve percent-encoded srcset urls ([#23609](vitejs/vite#23609)) ([53f1ce7](vitejs/vite@53f1ce7)) - limit size of object and array printing via `forwardConsole` ([#23565](vitejs/vite#23565)) ([e64a587](vitejs/vite@e64a587)) - merge `build.rolldownOptions.output.minify` correctly ([#23536](vitejs/vite#23536)) ([bba3bb8](vitejs/vite@bba3bb8)) - **optimize-deps:** avoid "unsupported" warnings for browser:false mappings ([#23590](vitejs/vite#23590)) ([5e4b9ca](vitejs/vite@5e4b9ca)) - **optimizer:** preserve excluded optional peer require fallbacks ([#23600](vitejs/vite#23600)) ([a2bd6fa](vitejs/vite@a2bd6fa)) - pass queries to `renderBuiltUrl` ([#23586](vitejs/vite#23586)) ([744269e](vitejs/vite@744269e)) - **server:** handle file watcher errors without crashing ([#23503](vitejs/vite#23503)) ([6894f5c](vitejs/vite@6894f5c)) - **server:** release previous environments after initialization ([#23499](vitejs/vite#23499)) ([5a3a010](vitejs/vite@5a3a010)) - **ssr:** encode whitespace in module runner sourceURL ([#23513](vitejs/vite#23513)) ([bbc8812](vitejs/vite@bbc8812)) - **worker:** align worker urls in client and server when using terser ([#23614](vitejs/vite#23614)) ([24bd331](vitejs/vite@24bd331)) ##### Performance Improvements - avoid encoding intermediate source maps ([#23461](vitejs/vite#23461)) ([89574f6](vitejs/vite@89574f6)) - **build:** avoid quadratic link scan in the preload helper ([#23510](vitejs/vite#23510)) ([cf5c028](vitejs/vite@cf5c028)) - only register time middleware when debug logging is enabled ([#23621](vitejs/vite#23621)) ([94d0080](vitejs/vite@94d0080)) ##### Documentation - fix dead og-image PNG links in vite6/vite7 changelog entries ([#23594](vitejs/vite#23594)) ([1929b4c](vitejs/vite@1929b4c)) ##### Miscellaneous Chores - **deps:** update vitest monorepo to v5 ([#23604](vitejs/vite#23604)) ([24339f4](vitejs/vite@24339f4)) ##### Code Refactoring - use `tinyexec` instead of `cross-spawn` ([#23583](vitejs/vite#23583)) ([db915e5](vitejs/vite@db915e5)) ##### Tests - **bundled-dev:** accept a rolldown dev runtime with no helper imports ([#23606](vitejs/vite#23606)) ([634745d](vitejs/vite@634745d)) ## [v8.3.1](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-831-2026-09-24-small) ##### Bug Fixes - **deps:** update all non-major dependencies ([#23482](vitejs/vite#23482)) ([3c752c8](vitejs/vite@3c752c8)) - **deps:** update all non-major dependencies ([#23537](vitejs/vite#23537)) ([e8990c4](vitejs/vite@e8990c4)) - **deps:** update rolldown-related dependencies ([#23483](vitejs/vite#23483)) ([9aecbbf](vitejs/vite@9aecbbf)) - handle `server.ws: false` in mergeConfig ([#23511](vitejs/vite#23511)) ([f68c0d5](vitejs/vite@f68c0d5)) - merge `build.rolldownOptions.output.comments` correctly ([#23514](vitejs/vite#23514)) ([4aba8d8](vitejs/vite@4aba8d8)) - **optimizer:** don't skip imports whose binding starts with type ([#23540](vitejs/vite#23540)) ([39330f4](vitejs/vite@39330f4)) - **optimizer:** resolve pending discovered dep processing on close before init ([#23567](vitejs/vite#23567)) ([5f89433](vitejs/vite@5f89433)) - **server:** avoid reinitializing watcher when adding file after server close ([#23572](vitejs/vite#23572)) ([6f831f9](vitejs/vite@6f831f9)) - **sourcemap:** skip URL source roots when injecting sources content ([#23519](vitejs/vite#23519)) ([04fc30a](vitejs/vite@04fc30a)) ##### Miscellaneous Chores - merge prereleases in changelog ([#23466](vitejs/vite#23466)) ([99bd9d1](vitejs/vite@99bd9d1)) - **optimizer:** add debug log when waiting for dep before init ([#23566](vitejs/vite#23566)) ([63567c7](vitejs/vite@63567c7)) - update `optimizeDeps.include` comment ([#23489](vitejs/vite#23489)) ([6a84c72](vitejs/vite@6a84c72)) ##### Code Refactoring - assets regexp use non-capture ([#23491](vitejs/vite#23491)) ([f4b4431](vitejs/vite@f4b4431)) - remove duplicate configurations ([#23532](vitejs/vite#23532)) ([9abd99b](vitejs/vite@9abd99b)) - replace `find` with `some` ([#23554](vitejs/vite#23554)) ([af7cdf6](vitejs/vite@af7cdf6))

renovate Bot added the dependencies Pull requests that update a dependency file label Oct 5, 2026

renovate Bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from ca53d6f to 63e7ab7 Compare October 7, 2026 06:12

fix(deps): update all non-major dependencies

741157b

renovate Bot force-pushed the renovate/all-minor-patch branch from 63e7ab7 to 741157b Compare October 7, 2026 08:07

chore: format

ea19c29

sapphi-red approved these changes Oct 7, 2026

View reviewed changes

sapphi-red enabled auto-merge (squash) October 7, 2026 08:17

sapphi-red merged commit 8a4c19c into main Oct 7, 2026
19 of 20 checks passed

sapphi-red deleted the renovate/all-minor-patch branch October 7, 2026 08:23

This was referenced Oct 8, 2026

release: v8.3.4 #23702

Merged

chore: update Vite from 8.3.0 to 8.3.4 sudocarlos/tailrelay#146

Closed

chore: update Vite from 8.3.0 to 8.3.4 sudocarlos/tailrelay#147

Merged

Navigation Menu

Repository navigation

fix(deps): update all non-major dependencies - #23648

fix(deps): update all non-major dependencies#23648
sapphi-red merged 2 commits into
mainfrom
renovate/all-minor-patch

renovate Bot commented Oct 5, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

🚀 Features

🐞 Bug Fixes

🏎 Performance

Fix HMR for compound components (#​1484)

Fix compiler.logDiagnostics option not working (#​1483)

Disable refresh for non-jsx with compiler enabled (fix #​1478) (#​1485)

Features

Bug Fixes

Documentation

Chores

🩹 Fixes

🧹 Chores

Bug Fixes

v0.72.0: oxfmt v0.72.0

💥 BREAKING CHANGES

🚀 Features

🐛 Bug Fixes

⚡ Performance

📚 Documentation

v0.71.0: oxfmt v0.71.0

🚀 Features

🐛 Bug Fixes

v12.9.1: pnpm 12.9.1

Patch Changes

Platinum Sponsors

Gold Sponsors

v12.9.0: pnpm 12.9

Minor Changes

Patch Changes

Installing packages

Optional dependencies

Resolving dependencies

Speed and network

Running scripts

Configuration

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented Oct 5, 2026 •

edited

Loading

Fix HMR for compound components (#1484)

Fix `compiler.logDiagnostics` option not working (#1483)

Disable refresh for non-jsx with compiler enabled (fix #1478) (#1485)

`v0.72.0`: oxfmt v0.72.0

`v0.71.0`: oxfmt v0.71.0

`v12.9.1`: pnpm 12.9.1

`v12.9.0`: pnpm 12.9