chore(deps-dev): bump vite from 6.3.5 to 6.4.3

[dependabot]

Bumps vite from 6.3.5 to 6.4.3.

Release notes

Sourced from vite's releases.

v6.4.3

Please refer to CHANGELOG.md for details.

v6.4.2

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.4.3 (2026-06-01)

• fix: backport #22572, reject windows alternate paths (#22576) (96b0c10), closes #22572 #22576
• fix(deps): backport #22571, reject UNC paths for launch-editor-middleware (#22575) (8fed5cf), closes #22571 #22575

6.4.2 (2026-04-06)

• fix: apply server.fs check to env transport (#22159) (#22163) (fe28e47), closes #22159 #22163
• fix: avoid path traversal with optimize deps sourcemap handler (#22161) (ca4da5d), closes #22161

6.4.1 (2025-10-20)

• fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20969) (1114b5d), closes #20968 #20969

6.4.0 (2025-10-15)

• feat: allow passing down resolved config to vite's createServer (#20932) (ca6455e), closes #20932

6.3.7 (2025-10-14)

• fix(esbuild): inject esbuild helpers correctly for esbuild 0.25.9+ (#20940) (c59a222), closes #20940

6.3.6 (2025-09-08)

• fix: apply fs.strict check to HTML files (#20736) (0ab19ea), closes #20736
• fix: upgrade sirv to 3.0.2 (#20735) (e11d240), closes #20735
• test: detect ts support via process.features (#20544) (7d99229), closes #20544

Commits

• 6c2c881 release: v6.4.3
• 96b0c10 fix: backport #22572, reject windows alternate paths (#22576)
• 8fed5cf fix(deps): backport #22571, reject UNC paths for launch-editor-middleware (#2...
• 6b3fad0 release: v6.4.2
• ca4da5d fix: avoid path traversal with optimize deps sourcemap handler (#22161)
• fe28e47 fix: apply server.fs check to env transport (#22159) (#22163)
• 5487f4f release: v6.4.1
• 1114b5d fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20969)
• f12697c release: v6.4.0
• ca6455e feat: allow passing down resolved config to vite's createServer (#20932)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vite since your current version.

[cursor]

PR Summary

Medium Risk
Downgrading frontend from Vite 7 to 6.4.3 and changing the shared bundler affects local dev, production builds, and CI tests; risk is mostly tooling compatibility rather than runtime app logic.

Overview
Aligns the monorepo on Vite 6.4.3 for dev, build, Storybook, and Vitest.

The root workspace bumps vite from 6.3.5 → 6.4.3. The frontend package changes from ^7.3.2 → ^6.4.3, so the Vue app no longer pulls Vite 7 and instead uses the same 6.x line as the rest of the repo. pnpm-lock.yaml is refreshed accordingly: vite@7.3.2 is removed, Storybook/@vitejs/plugin-vue/Vitest resolve against 6.4.3, and Rollup moves to 4.60.1 with minor transitive dependency deduplication (no application source changes).

^{Reviewed by Cursor Bugbot for commit 1b4c00c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

• feat: add user authentication (CM-123)
• feat: add user authentication (IN-123)

Projects:

• CM: Community Data Platform
• IN: Insights

Please add a Jira issue key to your PR title.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 88440f7. Configure here.}

[cursor]

Frontend Vite unexpectedly downgraded

Medium Severity

This PR patches root vite from 6.3.5 to 6.4.3, but frontend/package.json also changes vite from ^7.3.2 to ^6.4.3. That is a major-version downgrade of the production bundler and sits outside the stated bump.

 

^{Reviewed by Cursor Bugbot for commit 88440f7. Configure here.}

[gaspergrom]

This needs changes before it can merge.

[gaspergrom]

On main this is ^7.3.2, so this change downgrades the frontend from Vite 7 to 6.4.3. Dependabot built the bump against the root pin and rewrote this range too. Please keep the frontend on 7.x and only touch the root pin if that is the intent.

[gaspergrom]

pnpm install fails in build, lint and storybook-build with ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION for one lockfile entry, and the test job fails too. Vite 6.4.3 is newer than the repo's minimum release age allows. The lockfile needs to resolve cleanly before CI can go green.