chore(deps-dev): bump @vitejs/plugin-react from 4.7.0 to 6.1.1

[dependabot]

Bumps @vitejs/plugin-react from 4.7.0 to 6.1.1.

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.1

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

plugin-react@6.1.0

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

plugin-react@6.0.5

Fixed the react compiler preset filter to be linear (#1353)

The improved filter in v6.0.3 was non-linear and caused a performance regression (#1349). The filter was changed to be linear to avoid that.

plugin-react@6.0.4

Fixed $RefreshSig$ is not defined error when running vite dev with NODE_ENV=production

When running vite dev with NODE_ENV=production, the app errored with $RefreshSig$ is not defined. This error is now fixed.

plugin-react@6.0.3

No release notes provided.

plugin-react@6.0.2

Allow all options in reactCompilerPreset (#1189)

This is a type only change. Only compilationMode and target options were available for reactCompilerPreset.

plugin-react@6.0.1

Expand @rolldown/plugin-babel peer dep range (#1146)

... (truncated)

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.1 (2026-08-28)

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

6.1.0 (2026-08-19)

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

6.0.5 (2026-07-30)

Fixed the react compiler preset filter to be linear (#1353)

The improved filter in v6.0.3 was non-linear and caused a performance regression (#1349). The filter was changed to be linear to avoid that.

6.0.4 (2026-07-22)

Fixed $RefreshSig$ is not defined error when running vite dev with NODE_ENV=production

When running vite dev with NODE_ENV=production, the app errored with $RefreshSig$ is not defined. This error is now fixed.

6.0.3 (2026-06-23)

Improve the react compiler preset filter to reduce false-positives (#1138)

Improved the filter in the react compiler babel preset to reduce the false-positives so that less modules are processed by the react compiler.

... (truncated)

Commits

• 04cac50 release: plugin-react@6.1.1 (#1440)
• 82d35ab fix(react): respect environment sourcemap option when builder.sharedPlugins...
• 397e847 fix(react): make logging diagnostics an opt-in for React Compiler (#1431)
• 61006e6 fix(deps): update all non-major dependencies (#1433)
• e2a649c chore: use deps.neverBundle instead of external in tsdown config (#1430)
• fb2d6f3 fix(deps): update all non-major dependencies (#1427)
• 39b3173 release: plugin-react@6.1.0 (#1428)
• f1340b0 feat(react): add native React Compiler support (#1419)
• 9ab698e fix(deps): update all non-major dependencies (#1375)
• 68c0cb8 release: plugin-react@6.0.5 (#1362)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​vitejs/plugin-react since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: npm. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[srpatcha]

Review — eDB#77 "chore(deps-dev): bump @vitejs/plugin-react from 4.7.0 to 6.1.1"

head: 1a40fd1 author: app/dependabot ci: green and wrong — no workflow in this repo runs npm on a pull request, and the lockfile this PR ships does not install

Verdict: Do not merge as-is. npm ci fails on this branch with ERESOLVE: @vitejs/plugin-react@6.1.1 declares a non-optional peer vite@^8.0.0, and package.json keeps vite@^6.3.1. The lockfile Dependabot generated is internally inconsistent — it pins vite@6.4.2 next to a plugin that requires vite 8. Merging this breaks npm ci in nightly.yml, weekly.yml and release.yml, and nothing on this PR would have told you, because no PR-triggered workflow runs npm at all.

Findings

#	Severity	File:line	Finding	Recommended fix
1	High	package.json:21 + package-lock.json:1155-1171	npm ci fails on this head. @vitejs/plugin-react@6.1.1's peerDependencies includes "vite": "^8.0.0", and it is not listed in peerDependenciesMeta as optional (only @rolldown/plugin-babel, babel-plugin-react-compiler and oxc-transform-react are). package.json still declares "vite": "^6.3.1" and the lock resolves vite@6.4.2 (package-lock.json:2438-2439). Verified: npm ci --dry-run → rc 1, npm error code ERESOLVE … Conflicting peer dependency: vite@8.2.2. Full error in Verification below.	Do not merge alone. Either close this and let Dependabot regroup it with a vite 6→8 bump in one PR, or bump vite to ^8.0.0 here and regenerate the lock — then run npm ci && npx tsc --noEmit && npm run build && npm run test before merging, because vite 6→8 is two majors and vite.config.ts / vitest.config.ts may not survive it untouched. Merging with --legacy-peer-deps is not a fix; it hides the conflict at install time and moves the failure into the build.
2	High	.github/workflows/ (all)	No workflow runs npm on pull_request. npm ci and npm run build appear only in nightly.yml:63,69, weekly.yml:64,70 and release.yml:118,121 — all scheduled or tag-triggered. So every npm dependency change in this repo lands unvalidated and first fails on a nightly run or, worse, during a release. That is why finding #1 reached this point with three green checks.	Add a frontend job to ci.yml on pull_request: actions/setup-node (node 22.x, cache: npm), then npm ci, npx tsc --noEmit, npm run build, npm run test. package.json:10 already defines "test": "vitest run" and it is currently run by nothing in CI.
3	Medium	.github/workflows/ci.yml:3-8 at this head	Even the Python matrix never ran here. This branch forks from 5e436bd (2026-08-25), where ci.yml triggers on pull_request: branches: [main]; this PR targets master, which was added to the trigger later in f3b1ab0. checks.txt shows only Analyze (Python), CodeQL and assign.	Rebase onto current master. Sequence after eDB#82.
4	Low	package-lock.json:1-20	This PR also silently repairs a pre-existing lockfile drift, so its true blast radius is larger than its title. On origin/master the lock records "version": "0.1.0" and omits vitest, jsdom and @testing-library/* that package.json declares — verified, npm ci on origin/master fails with EUSAGE … Missing: vitest@2.1.9 from lock file and 15 more. Regenerating the lock here fixes that as a side effect. eDB#76 and eDB#79 each carry the same repair, so all three conflict with one another.	Land the lock regeneration once, on its own, as the prerequisite. Then rebase whichever of #76/#77/#79 survive. Not opening a fix PR for this: #76 and #79 already cover it (review brief, "Opening fix PRs").

Dependabot's own comment about the missing npm label is already on this PR and is not repeated here; the config to fix is .github/dependabot.yml.

Architecture conformance

Conforms structurally — dev-dependency metadata confined to Tier 3 eDB (master design §21), no source, import or manifest-entry change, so §5.1 dependency direction is untouched. It fails §28's evidence policy rather than the architectural law: three passing checks are presented as the state of a change that provably does not install.

Proposed changes

Smallest sequence that keeps things working:

1. Land eDB#82 (CI install fix), then land a lockfile regeneration so npm ci works on master at all.
2. Add the frontend PR job from finding #2. Without it, step 3 is unverifiable in CI.
3. Only then take a combined vite 6→8 + @vitejs/plugin-react 4→6 bump, with npm ci, tsc --noEmit, npm run build and vitest run all green.

This PR should not merge before step 3, in whatever form it takes.

Verification I ran

Local, npm 11.17.0 / node 24.19.0, package.json + package-lock.json extracted from each ref:

• this head — npm ci --dry-run → rc 1:

  npm error code ERESOLVE
  npm error While resolving: @vitejs/plugin-react@6.1.1
  npm error Found: vite@6.4.2 … dev vite@"^6.3.1" from the root project
  npm error Could not resolve dependency:
  npm error peer vite@"^8.0.0" from @vitejs/plugin-react@6.1.1
  npm error Conflicting peer dependency: vite@8.2.2
  

• origin/master — npm ci --dry-run → rc 1, EUSAGE … package.json and package-lock.json … are not in sync, Missing: vitest@2.1.9, jsdom@25.0.1, @testing-library/react@16.3.3, @testing-library/jest-dom@6.9.1 and others (finding #4).
• eDB#76 head and eDB#79 head — npm ci --dry-run → rc 0 both, confirming the conflict is specific to this PR's plugin bump and not to the lock regeneration the three share.
• Trigger claim in finding #3 read from git show 1a40fd11:.github/workflows/ci.yml (pull_request: branches: [main]) against origin/master's branches: [master, main], and git merge-base → 5e436bd.

Not checked

• npm version differs from CI. I ran npm 11.17.0; nightly.yml:57-60 and weekly.yml:58-61 use node 22.x, which ships npm ~10.9. Peer-dependency enforcement in npm ci is present in both majors, so I expect the same failure, but I did not reproduce it on npm 10.
• --dry-run only. Nothing was actually installed, built or run: no tsc --noEmit, no npm run build, no vitest run on any of the three heads. rc 0 for #76/#79 means "resolves", not "builds".
• I did not evaluate whether vite 8 is viable for this project — vite.config.ts and vitest.config.ts were not read, and vitest@^2.0.0 has its own vite peer range that a vite 8 bump would also have to satisfy. The recommendation in finding #1 is a direction, not a verified plan.
• The 2374-line lockfile diff was not reviewed line by line; I checked the root package block, the vite entry and the @vitejs/plugin-react entry, and otherwise relied on npm ci to validate it.

---

Automated architecture review of 1a40fd113535 — scheduled, model claude-opus-5, checked against the EmbeddedOS Master Design v2.0. Advisory only: this reviewer never approves, requests changes, or merges. Reply here to discuss or push back — a wrong finding is a bug worth reporting.