Skip to content

Bump vite from 8.0.8 to 8.0.16 - #241

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/vite-8.0.16
Open

Bump vite from 8.0.8 to 8.0.16#241
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/vite-8.0.16

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps vite from 8.0.8 to 8.0.16.

Release notes

Sourced from vite's releases.

v8.0.16

Please refer to CHANGELOG.md for details.

v8.0.15

Please refer to CHANGELOG.md for details.

v8.0.14

Please refer to CHANGELOG.md for details.

v8.0.13

Please refer to CHANGELOG.md for details.

v8.0.12

Please refer to CHANGELOG.md for details.

v8.0.11

Please refer to CHANGELOG.md for details.

v8.0.10

Please refer to CHANGELOG.md for details.

v8.0.9

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.0.16 (2026-06-01)

Bug Fixes

8.0.15 (2026-06-01)

Features

Bug Fixes

  • capitalize error messages and remove spurious space in parse error (#22488) (85a0eff)
  • deps: update all non-major dependencies (#22511) (2686d7d)
  • dev: fix html-proxy cache key mismatch for /@fs/ HTML paths (#21762) (47c4213)
  • glob: error on relative glob in virtual module when no files match (#22497) (5c8e98f)
  • optimizer: close the rolldown bundle when write() rejects (#22528) (e3cfb9d)
  • resolve: provide onWarn for viteResolvePlugin in JS plugin containers (#22509) (40985f1)

Miscellaneous Chores

Code Refactoring

8.0.14 (2026-05-21)

Features

Bug Fixes

  • deps: update all non-major dependencies (#22471) (98b8163)
  • dev: handle errors when sending messages to vite server (#22450) (e8e9a34)
  • html: handle trailing slash paths in transformIndexHtml (#22480) (5d94d1b)
  • optimizer: pass oxc jsx options to transformSync in dependency scan (#22342) (b3132da)

Miscellaneous Chores

  • deps: update rolldown-related dependencies (#22470) (7cb728e)
  • remove irrelevant commits from changelog (2c69495)

Code Refactoring

  • glob: do not rewrite import path for absolute base (#22310) (0ae2844)

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump vite from 8.0.8 to 8.0.16
aad89aa 
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 8.0.8 to 8.0.16.
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 8.0.16
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 16, 2026
@netlify

netlify Bot commented Jun 16, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for servicestart ready!

Name Link
🔨 Latest commit aad89aa
🔍 Latest deploy log https://app.netlify.com/projects/servicestart/deploys/6a30b950523b0a000895ba2b
😎 Deploy Preview https://deploy-preview-241--servicestart.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
🤖 Make changes Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

@greptile-apps

greptile-apps Bot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

Greptile Summary

This is an automated Dependabot security update that bumps vite from 8.0.8 to 8.0.16 (a devDependency used only for development and testing). The update includes two path-traversal security fixes — rejection of UNC paths and Windows alternate data stream paths in the launch-editor-middleware — along with several bug fixes and minor feature updates across the eight intermediate releases.

  • Security patches: v8.0.16 adds guards against UNC paths and Windows alternate paths in launch-editor-middleware, which could have allowed a malicious request to trick the dev server into opening arbitrary files.
  • Lock file: pnpm-lock.yaml reflects the new vite resolution plus an incidental next bump from 16.2.6 → 16.2.9 and simplified drizzle-orm peer-dep specifiers; no application code is changed.

Confidence Score: 5/5

Safe to merge — this is a devDependency-only update with no application code changes and two security fixes in the new version.

The change touches only vite, a devDependency used for the dev server and test runner, so there is no production runtime surface. The new version patches two path-handling bugs in dev-server middleware and includes a handful of unrelated bug fixes. The pnpm-lock.yaml also picks up a minor next version bump as a side-effect of lock resolution, which is low-risk given it is a patch-level update.

No files require special attention — both changes are in dependency manifests only.

Important Files Changed

Filename Overview
package.json Bumps vite devDependency from ^8.0.8 to ^8.0.16; no other changes.
pnpm-lock.yaml Lock file regenerated to reflect the new vite version and transitive dependency resolutions, including a next.js bump from 16.2.6 to 16.2.9 and minor changes to drizzle-orm peer-dep specifiers.

Flowchart

 
%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Dependabot bump] --> B[package.json\nvite ^8.0.8 → ^8.0.16]
    B --> C[pnpm-lock.yaml regenerated]
    C --> D[vite 8.0.16\n+ UNC path fix\n+ Windows alt-path fix\n+ 6 other bug fixes]
    C --> E[next 16.2.6 → 16.2.9\nincidental lock resolution]
    D --> F[Dev server & build tooling\nno production runtime impact]
    E --> F
Loading 
%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[Dependabot bump] --> B[package.json\nvite ^8.0.8 → ^8.0.16]
    B --> C[pnpm-lock.yaml regenerated]
    C --> D[vite 8.0.16\n+ UNC path fix\n+ Windows alt-path fix\n+ 6 other bug fixes]
    C --> E[next 16.2.6 → 16.2.9\nincidental lock resolution]
    D --> F[Dev server & build tooling\nno production runtime impact]
    E --> F
Loading

Reviews (1): Last reviewed commit: "Bump vite from 8.0.8 to 8.0.16" | Re-trigger Greptile

@dependabot @github

dependabot Bot commented on behalf of github Jun 25, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't resolve your JavaScript dependency files. Because of this, Dependabot cannot update this pull request.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants