Repository navigation
Bump vite from 8.3.1 to 8.3.4 - #705
Merged
Merged
Conversation
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 8.3.1 to 8.3.4. - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.3.4/packages/vite) --- updated-dependencies: - dependency-name: vite dependency-version: 8.3.4 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
bgentry
approved these changes
Oct 22, 2026
Contributor
There was a problem hiding this comment.
🤖 Codex review: Approved after dependency security and local compatibility review. The maintainer accepts the known AWS OIDC CI failure for this update and will address it separately.
Upgrade
vite:8.3.1→8.3.4.- Lockfile transitives:
postcss8.5.28→8.5.31;nanoid3.3.19→3.3.20. - Reviewed head:
0458080164674976e1d42891000cb905c3033c1b, based on012f377b3f54d1d887d3cabe041c950f8275414d.
Security review
- Compared all six old/new npm tarballs with registry metadata and both lockfiles; SHA-512 identities match, and npm registry ECDSA signatures verify. Canonical upstream repositories, publishers, licenses, and GitHub Actions trusted-publishing workflows remain consistent. Provenance DSSE signatures, artifact subjects, and repository/commit identities match; full certificate-chain and transparency-log verification is a stated limit.
- Reviewed the executable artifact diffs, including Vite's bundled editor launcher/process execution, HMR, filesystem serving, and CSS/preload changes. No unexpected credential reads, network destinations, install hooks, or binary payloads were identified. PostCSS moves HTML/style escaping into a buffered safe stringifier and fixes parser/source-map behavior; nanoid's executable files are unchanged, with async declaration/export corrections only.
- No package additions/removals, new lifecycle hooks/bins, source replacements, or same-version integrity rewrites. Rolldown remains
1.2.12, including its existing native packages;source-map-jsremains1.2.2. - This is a security update despite its ordinary dependency labels. Vite
8.3.1is in the affected ranges for GHSA-rq7h-c2jc-7f22, GHSA-vfpm-58rq-9qcg, and GHSA-9jrq-w75r-8gcw, plus bundled launch-editor advisories GHSA-r825-w8mm-5pxw, GHSA-587h-7wmj-h5pm, and GHSA-698v-4r3x-3vcv. All six are absent from the head's npm audit results.
Compatibility verification
Executed in a detached temporary worktree at the reviewed head, using Node 26.9.0, npm 11.11.0, and Go 1.27.1 on macOS arm64:
npm ci— passed, without changing manifests or the lockfile. npm reports pre-existing SWC/esbuild/fsevents lifecycle scripts as unapproved; no allow-list configuration was changed.NODE_ENV=test npm run test:once— passed: 35 files, 243 tests.npm run lint— passed.npm run build— passed, including TypeScript checking and the Vite bundle.NODE_ENV=production VITE_RIVER_API_BASE_URL=/api npm exec -- vite build— passed.STORYBOOK_DISABLE_TELEMETRY=1 npm run build-storybook— passed.CGO_ENABLED=0 go build -o <temporary-output> ./cmd/riveruiand the equivalent./cmd/riverprouibuild fromriverproui/— passed with the production assets embedded.- Existing CI passes JS tests/build/lint on Node
24.21.0, Go lint and the six Go/Postgres test-matrix jobs, sqlc verification, release builds, and both standard River UI Docker platforms. The unchanged Go test matrix is covered by CI rather than repeated locally.
Accepted CI failure and residual risk
- Retried the failed/cancelled Pro Docker jobs in run 39527265450. The arm64 job fails again at
Configure AWS Credentials, before installing dependencies or building:Could not assume role with OIDC: Not authorized to perform sts:AssumeRoleWithWebIdentity. The sibling amd64 job is cancelled and Pro manifest merging is skipped. The maintainer explicitly accepts this known AWS OIDC failure for this update and plans to repair it separately. Dependency and local compatibility gates are clear; normal GitHub merge rules still apply. - Base/head lockfile audits introduce no new advisory entries. Five pre-existing package entries remain unchanged: critical shell-quote /
concurrentlyand Storybook, plus moderate postcss-selector-parser /@tailwindcss/typography. These need separate updates outside this PR. - No blocking supply-chain issue was identified in this upgrade. Vite includes generated bundles; this was a focused artifact/source-diff and provenance review, not a formal audit of the entire dependency tree.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps vite from 8.3.1 to 8.3.4.
Release notes
Sourced from vite's releases.
... (truncated)
Changelog
Sourced from vite's changelog.
... (truncated)
Commits
b6c20f6release: v8.3.4 (#23702)b28db28fix(server): match static aliases on path boundaries (#23643)bc0f21cfeat(bundled-dev): supportimport.meta.hot.acceptExports(#23463)fa71469fix(client): skip rewriting unchanged adopted styles (#23697)2a8c0f0fix(build): correct preloads when chunkImportMap is enabled with non-root bas...3a7f2aefix(html): avoid adding filesystem root to watcher (#23689)facc2fbfix: remove input option unescaping for now (#23694)70d56eafix(dev): a restart requested during a restart used to be dropped (fix #23392...cf52011fix(css): resolve imported preprocessors from their file path with lightningc...fcb6f12fix: don't treat modules ending with js-like query as js (#23687)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.