Repository navigation
Bump vite from 8.0.16 to 8.1.6 in /js - #1524
Merged
Merged
Conversation
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 8.0.16 to 8.1.6. - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v8.1.6/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.1.6/packages/vite) --- updated-dependencies: - dependency-name: vite dependency-version: 8.1.6 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
bgentry
approved these changes
Oct 22, 2026
bgentry
left a comment
bgentry
left a comment
Contributor
There was a problem hiding this comment.
🤖 Codex review: Approved after dependency security and compatibility review.
Upgrade
vite:8.0.16→8.1.6- Reviewed head:
57ec7ef3dd2cf43e675f2ab943d2ecb9749b1537
Security review
- This is a security update: 8.1.6 fixes GHSA-9jrq-w75r-8gcw (custom middleware cross-origin script execution), GHSA-rq7h-c2jc-7f22 (
server.fs.allowbypass), and bundled launch-editor advisories GHSA-r825-w8mm-5pxw, GHSA-587h-7wmj-h5pm and GHSA-698v-4r3x-3vcv. The old version falls in their affected ranges. - Reviewed the complete manifest/lock delta: Vite, Rolldown 1.0.3 → 1.1.5 and 15 optional platform bindings, PostCSS 8.5.25 → 8.5.31, Oxc declarations and WASI fallback dependencies. New Node/undici type versions resolve existing example peer contexts. No same-version integrity rewrites, new registry/Git sources, added lifecycle hooks, or new native platforms.
- Compared actual published artifacts and canonical source. Verified 54 tarballs, including both versions of all 15 native/WASM bindings: downloaded SHA512 = registry integrity = lockfile integrity. Verified 20 additional unchanged artifact identities against registry metadata. Reviewed 27 exact old/new artifact pairs, publisher continuity, package contents and provenance subjects/workflows.
- Vite provenance pins canonical source
dade886f0cc17fedf777eff804593d2af182abd4; Rolldown and its platform packages pinf09947ab017d6df74299f691853dcfc4f4f0f86e. Expected trusted publishing identities persist. Reviewed filesystem/config/env/subprocess changes, native loading, WASI/thread glue, and source transformations. New task-client integration loads only an explicitly configured local addon and introduces no network endpoint. No unexpected credential harvesting, downloaders, or execution hooks were found.
Compatibility verification
pnpm -C js install --frozen-lockfile— passed.make lint/js— passed build, ESLint/Knip, formatting and both TypeScript compilers.make test/jsandmake test/js/integration— passed on Node 26.9.0 and Node 24.14.1: 1,321 unit and 149 database integration tests on each runtime, using a dedicated Postgres 18 database.- Migration verification, API reports, TypeDoc, README snippets, legacy migration fixture, license validation, packed package archives and examples — passed.
make check/js/dependencies— exits 2 becausepnpm auditreports retained findings; license validation passes separately. Compared base/head audit JSON and exact artifact identities: zero introduced advisories, five Vite advisories removed. This audit result is explicitly triaged below rather than represented as a pass.- Tracked tree remains unchanged. Existing CI also covers both Node lines and Postgres 14–18.
Retained audit findings and follow-up
- Unchanged
markdown-it 14.3.1via TypeDoc: GHSA-r7fv-28h4-cvq7 requires typography, which River leaves disabled; GHSA-gfr2-rv44-r23c and GHSA-vfgh-jcmw-g37q can cause expensive parsing during documentation generation. Input is checkout-owned source comments/local documentation, and there is no public/runtime Markdown renderer. Updatemarkdown-itto14.3.3or later in a follow-up. - Unchanged
@vitest/mocker 4.1.11: GHSA-qxg6-89mg-rqv8 and GHSA-xp26-3454-mjgp require the public mocker/interceptor HMR registration plugins. River uses Nodevitest run, with browser mode disabled and neither affected plugin registered. Update Vitest tooling to4.1.12or later in a follow-up. cliGHSA-6cpc-mj5c-m9rq is scanner misattribution: theclilockfile importer is local@riverqueue/cli 0.2.0; the vulnerable npm packagecliis absent.- All retained artifact versions/integrities and relevant configuration match the base. These findings do not establish a material regression or public runtime vulnerability in this upgrade, so they do not block the five-advisory Vite security fix.
Residual risk
- The dependency audit remains nonzero until the retained tooling is updated; checkout-provided pathological Markdown can still consume documentation-build resources.
- Native/WASM payloads were verified against registry and provenance identities without an independent reproducible rebuild. Source inspection focuses on execution/security surfaces; full Sigstore cryptographic certificate/log proof verification is outside this review. Local database execution covers Postgres 18; CI supplies the broader database matrix.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps vite from 8.0.16 to 8.1.6.
Release notes
Sourced from vite's releases.
Changelog
Sourced from vite's changelog.
... (truncated)
Commits
dade886release: v8.1.6170b927fix(server): store ids tosafeModulePathsrather than URLs (#23656)e46fc9cfix(deps): update launch-editor to v2.14.2 (#23654)4ff2522fix(html): filename passed to transformIndexHtml should not include queries (...5e7fe12release: v8.1.56c08c39fix(optimizer): respect importer module format for dynamic import interop wit...5a72b87fix(client): overlay error message format align rolldown (#22869)f8b38e3fix(module-runner): don't crash stack-trace source mapping when globalThis.Bu...8100320fix(bundled-dev): avoid duplicatedbuildEnd(#22931)c88c236docs(build): fix incorrect@defaultfor build.cssMinify (#22948)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.