Repository navigation
build(deps-dev): bump vite from 8.0.16 to 8.1.6 - #244
Conversation
dependabot
Bot
added
dependencies
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
All alerts resolved. Learn more about Socket for GitHub. This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored. Ignoring alerts on:
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Looks good, straightforward dependency bump.
What was reviewed: the package.json change bumping the vite devDependency constraint from ^8.0.16 to ^8.1.6, and the corresponding yarn.lock regeneration (transitive dependency version/checksum updates for vite's deps like @ rolldown/, @ oxc-project/types, @ emnapi/, @ napi-rs/wasm-runtime). No source code (src/, spec/) is touched, and vite is a dev-only build tool dependency with no runtime/security surface affected by this change.
Extended reasoning...
The diff is limited to package.json (one line: vite devDependency version range bump) and yarn.lock (mechanical lockfile regeneration reflecting that bump, including transitive dependency updates). No application source files are touched, vite is a devDependency used only for building/testing, and the change is a routine dependabot version bump with no design decisions or security-sensitive paths involved, so it is simple and mechanical enough to approve without further human review.
|
@SocketSecurity ignore npm/postcss@8.5.31 |
|
@dependabot rebase |
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 8.0.16 to 8.1.6. - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v8.1.6/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.1.6/packages/vite) --- updated-dependencies: - dependency-name: vite dependency-version: 8.1.6 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
0bf2688 to
509e992
Compare
Bumps vite from 8.0.16 to 8.1.6.
Release notes
Sourced from vite's releases.
Changelog
Sourced from vite's changelog.
... (truncated)
Commits
dade886release: v8.1.6170b927fix(server): store ids tosafeModulePathsrather than URLs (#23656)e46fc9cfix(deps): update launch-editor to v2.14.2 (#23654)4ff2522fix(html): filename passed to transformIndexHtml should not include queries (...5e7fe12release: v8.1.56c08c39fix(optimizer): respect importer module format for dynamic import interop wit...5a72b87fix(client): overlay error message format align rolldown (#22869)f8b38e3fix(module-runner): don't crash stack-trace source mapping when globalThis.Bu...8100320fix(bundled-dev): avoid duplicatedbuildEnd(#22931)c88c236docs(build): fix incorrect@defaultfor build.cssMinify (#22948)