[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
vite (source)	8.3.1 → 8.3.5

---

Release Notes

vitejs/vite (vite)

v8.3.5

Compare Source

Bug Fixes

• build: handle missing chunk import maps (#​23777) (8d7623d)
• build: include preload dependencies to chunk import map hashing (#​23793) (4d16e7c)
• bundled-dev: apply server.origin to asset URLs (#​23683) (52ba877)
• bundled-dev: declare utf-8 charset in fallback page (#​23846) (197daf6)
• bundled-dev: ignore build.chunkImportMap (#​23685) (cfe917d)
• bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#​23713) (6019aa7)
• bundled-dev: map forwarded error stacks through the bundle source maps (#​23741) (11fe1e4)
• bundled-dev: normalize served output files (#​23684) (df4e02c)
• bundled-dev: stop hmr propagation at modules that are no longer imported (#​23839) (7471e8c)
• css: don't fail on a literal % in url() (#​23676) (50b382d)
• deps: update all non-major dependencies (#​23731) (cf80aa5)
• deps: update all non-major dependencies (#​23826) (77d8373)
• deps: update rolldown-related dependencies (#​23733) (43f0d05)
• deps: update rolldown-related dependencies (#​23827) (c2e0418)
• optimizer: fall back to yarn.lock for lockfile hash (#​23667) (f206096)
• optimizer: scan oxc.jsxInject imports (#​23758) (38f3cb4)
• optimizer: skip patches dir check for yarn.lock fallback (#​23725) (8e890e1)
• optimizer: skip patches dir hash for nub lockfile (#​23761) (a7d5696)
• resolve: support subpath imports with multiple # (#​23631) (0d86b34)
• resolve: update resolve.exports to 2.0.4 (#​23739) (4ea708a)
• server: handle socket errors on upgrade requests not taken by the HMR server (#​23728) (c2c9ef4)
• server: only strip base when path matches a full segment (#​23641) (3dfde87)

Performance Improvements

• ssr: extract inline source maps without a regexp (#​23775) (6a02780)

Miscellaneous Chores

• migrate to Oxlint (#​23746) (5b73935)

Code Refactoring

• deps: replace @vercel/detect-agent with std-env (#​23744) (ce4293f)
• dev: consolidate moduleURL to file path utilities (#​23828) (df7b40e)
• dev: separate import resolution from URL conversion (#​23791) (6116689)
• dev: share ModuleURL and BrowserURL conversions (#​23790) (446954c)
• dev: use ModuleURLs throughout HTML transforms (#​23815) (a162990)

v8.3.4

Compare Source

Features

• bundled-dev: support import.meta.hot.acceptExports (#​23463) (bc0f21c)

Bug Fixes

• avoid mutating hmr defaults (fix #​23575) (#​23576) (574d5e3)
• build: correct preloads when chunkImportMap is enabled with non-root base (#​23698) (2a8c0f0)
• build: wait for in-flight stylesheets in preload helper (fix #​23652) (#​23662) (036b745)
• bundled-dev: serve /@vite/client and stub @vite/env (#​23664) (5afc5a8)
• client: skip rewriting unchanged adopted styles (#​23697) (fa71469)
• css: resolve imported preprocessors from their file path with lightningcss (#​23688) (cf52011)
• deps: update all non-major dependencies (#​23648) (8a4c19c)
• deps: update rolldown-related dependencies (#​23649) (794516d)
• dev: a restart requested during a restart used to be dropped (fix #​23392) (#​23484) (70d56ea)
• don't treat modules ending with js-like query as js (#​23687) (fcb6f12)
• html: avoid adding filesystem root to watcher (#​23689) (3a7f2ae)
• html: skip caching CSS of chunks in a cycle (fix #​23628) (#​23636) (15d82f7)
• optimizer: scan deep imports with custom extensions (#​23678) (8579189)
• remove input option unescaping for now (#​23694) (facc2fb)
• server: match static aliases on path boundaries (#​23643) (b28db28)
• watcher: normalize file before root check in ensureWatchedFile (#​23673) (12bb28c)

Performance Improvements

• module-runner: skip cloning call sites that have no source map (#​23646) (3d67486)

Code Refactoring

• bundled-dev: import CSS HMR helpers from /@vite/client (#​23674) (182f5b2)

v8.3.3

Compare Source

Bug Fixes

• deps: update launch-editor to v2.14.2 (#​23654) (22fd1d5)
• html: filename passed to transformIndexHtml should not include queries (#​23653) (7dafd8e)
• server: check fs.serve for ?vite-wasm-instance (#​23655) (ba8b7ab)
• server: store ids to safeModulePaths rather than URLs (#​23656) (c3e06f9)

v8.3.2

Compare Source

Bug Fixes

• build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#​23611) (64e0a21)
• bundled-dev: serve lazy chunk sourcemaps (#​23026) (eb7aa9a)
• bundled-dev: serve the rolldown runtime from the installed rolldown (#​23568) (bc598a6)
• deps: update all non-major dependencies (#​23601) (9944fa6)
• deps: update rolldown-related dependencies (#​23602) (88c1741)
• html: resolve percent-encoded srcset urls (#​23609) (53f1ce7)
• limit size of object and array printing via forwardConsole (#​23565) (e64a587)
• merge build.rolldownOptions.output.minify correctly (#​23536) (bba3bb8)
• optimize-deps: avoid "unsupported" warnings for browser:false mappings (#​23590) (5e4b9ca)
• optimizer: preserve excluded optional peer require fallbacks (#​23600) (a2bd6fa)
• pass queries to renderBuiltUrl (#​23586) (744269e)
• server: handle file watcher errors without crashing (#​23503) (6894f5c)
• server: release previous environments after initialization (#​23499) (5a3a010)
• ssr: encode whitespace in module runner sourceURL (#​23513) (bbc8812)
• worker: align worker urls in client and server when using terser (#​23614) (24bd331)

Performance Improvements

• avoid encoding intermediate source maps (#​23461) (89574f6)
• build: avoid quadratic link scan in the preload helper (#​23510) (cf5c028)
• only register time middleware when debug logging is enabled (#​23621) (94d0080)

Documentation

• fix dead og-image PNG links in vite6/vite7 changelog entries (#​23594) (1929b4c)

Miscellaneous Chores

• deps: update vitest monorepo to v5 (#​23604) (24339f4)

Code Refactoring

• use tinyexec instead of cross-spawn (#​23583) (db915e5)

Tests

• bundled-dev: accept a rolldown dev runtime with no helper imports (#​23606) (634745d)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[jerelvelarde]

Reviewed a1b343bff30fd9fb4204560cf8de4bbcb22db77b with an independent Codex Astra review and local run. The Vite/toolchain patch stays within existing tooling and preserves application defaults. All 21 changed package tarballs match the lockfile and official registry; no actionable security or alignment blocker found in this scope.

Cumulative current-main integration passes formatting, lint, typecheck, all 351 tests and client/server builds. Actual Vite dev-server checks pass for loopback binding, host/file access restrictions, TSX transformation and a synthetic API proxy. Other-platform native binaries were not run locally. Ready for merge with the current green CI.