Bump vite from 7.3.1 to 8.0.0 by dependabot[bot] · Pull Request #593 · guibranco/pull-request-ui

dependabot · 2026-03-16T17:04:23Z

Bumps vite from 7.3.1 to 8.0.0.

Release notes

create-vite@8.0.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.0.0

Please refer to CHANGELOG.md for details.

v8.0.0

Please refer to CHANGELOG.md for details.

v8.0.0-beta.18

Please refer to CHANGELOG.md for details.

v8.0.0-beta.17

Please refer to CHANGELOG.md for details.

v8.0.0-beta.16

Please refer to CHANGELOG.md for details.

v8.0.0-beta.15

Please refer to CHANGELOG.md for details.

v8.0.0-beta.14

Please refer to CHANGELOG.md for details.

v8.0.0-beta.13

Please refer to CHANGELOG.md for details.

v8.0.0-beta.12

Please refer to CHANGELOG.md for details.

v8.0.0-beta.11

Please refer to CHANGELOG.md for details.

v8.0.0-beta.10

Please refer to CHANGELOG.md for details.

v8.0.0-beta.9

Please refer to CHANGELOG.md for details.

v8.0.0-beta.8

Please refer to CHANGELOG.md for details.

v8.0.0-beta.7

Please refer to CHANGELOG.md for details.

v8.0.0-beta.6

Please refer to CHANGELOG.md for details.

v8.0.0-beta.5

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

8.0.0 (2026-03-12)

Today, we're thrilled to announce the release of the next Vite major:

Vite 8.0 announcement blog post

Docs (translations: 简体中文, 日本語, Español, Português, 한국어, Deutsch, فارسی)

Migration Guide

⚠ BREAKING CHANGES

remove import.meta.hot.accept resolution fallback (#21382)

update default browser target (#21193)

the epic rolldown-vite merge (#21189)

Features

update rolldown to 1.0.0-rc.9 (#21813) (f05be0e)

warn when vite-tsconfig-paths plugin is detected (#21781) (ada493e)

css: support es2025 build target for lightningcss (#21769) (08906e7)

forward browser console logs and errors to dev server terminal (#20916) (2540ed0)

update rolldown to 1.0.0-rc.8 (#21790) (a0c950e)

export Visitor and ESTree from rolldown/utils (#21664) (45de31e)

update rolldown to 1.0.0-rc.6 (#21714) (37a65f8)

use util.inspect for CLI error display (#21668) (5f425a9)

update rolldown to 1.0.0-rc.5 (#21660) (b3ddbc5)

update rolldown to 1.0.0-rc.4 (#21617) (1ee5c7f)

wasm: add SSR support for .wasm?init (#21102) (216a3b5)

integrate devtools (#21331) (acbf507)

update rolldown to 1.0.0-rc.3 (#21554) (43358e9)

manifest: add assets field for standalone CSS entry points (#21015) (f289b9b)

update rolldown to 1.0.0-rc.2 (#21512) (fa136a9)

bundled-dev: support worker in initial bundle (#21415) (f3d3149)

dev: detect port conflicts on wildcard hosts (#21381) (b0dd5a9)

shortcuts case insensitive (#21224) (7796ade)

update rolldown to 1.0.0-rc.1 (#21463) (ff9dd7f)

warn if envPrefix contains spaces (#21292) (9fcde3c)

update rolldown to 1.0.0-beta.60 (#21408) (c33aa7c)

update rolldown to 1.0.0-beta.59 (#21374) (0037943)

add ignoreOutdatedRequests option to optimizeDeps (#21364) (b2e75aa)

add ios to default esbuild targets (#21342) (daae6e9)

update rolldown to 1.0.0-beta.58 (#21354) (ba40cef)

update rolldown to 1.0.0-beta.57 (#21335) (d5412ef)

css: support es2024 build target for lightningcss (#21294) (bd33b8e)

update rolldown to 1.0.0-beta.56 (#21323) (9847a63)

introduce v2 native plugins and enable it by default (#21268) (42f2ab3)

ssr: avoid errors when rewriting already rewritten stacktrace (#21269) (98d9a33)

update rolldown to 1.0.0-beta.55 (#21300) (2c8db85)

update rolldown to 1.0.0-beta.54 (#21267) (c751172)

... (truncated)

Commits

ea68a88 chore(deps): update rolldown-related dependencies (#20810)
693d255 release: v7.1.7
98a3484 fix(hmr): wait for import.meta.hot.prune callbacks to complete before runni...
9f32b1d fix(hmr): trigger prune event when import is removed from non hmr module (#20...
9f2247c fix(deps): update all non-major dependencies (#20811)
105abe8 fix(glob): handle glob imports from folders starting with dot (#20800)
4c4583c fix(build): fix ssr environment emitAssets: true when `sharedConfigBuild: t...
9bc9d12 fix(client): use CSP nonce when rendering error overlay (#20791)
54377f7 release: v7.1.6
88af2ae fix(deps): update all non-major dependencies (#20773)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependabot · 2026-03-16T17:04:24Z

Labels

The following labels could not be found: dependencies, npm. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

deepsource-io · 2026-03-16T17:04:52Z

DeepSource Code Review

We reviewed changes in 43ee4b6...62657ff on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade	Security Reliability Complexity Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Mar 26, 2026 12:37p.m.	Review ↗
Secrets		Mar 26, 2026 12:37p.m.	Review ↗

socket-security · 2026-03-16T17:05:27Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vite@7.3.1 ⏵ 8.0.3	⁺⁵		⁺¹⁹	⁺²

View full report

socket-security · 2026-03-16T17:05:29Z

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Block		Network access: npm `@emnapi/core` in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package-lock.json → `npm/vite@8.0.3` → `npm/@emnapi/core@1.9.1` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@emnapi/core@1.9.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Dynamic code execution: npm `@emnapi/core` Eval Type: Function Location: Package overview From: package-lock.json → `npm/vite@8.0.3` → `npm/@emnapi/core@1.9.1` ℹ Read more on: This package \| This alert \| What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@emnapi/core@1.9.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Dynamic code execution: npm `@emnapi/core` Eval Type: eval Location: Package overview From: package-lock.json → `npm/vite@8.0.3` → `npm/@emnapi/core@1.9.1` ℹ Read more on: This package \| This alert \| What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@emnapi/core@1.9.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Dynamic code execution: npm `@emnapi/runtime` Eval Type: Function Location: Package overview From: package-lock.json → `npm/vite@8.0.3` → `npm/@emnapi/runtime@1.9.1` ℹ Read more on: This package \| This alert \| What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@emnapi/runtime@1.9.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm `@tybys/wasm-util` in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package-lock.json → `npm/vite@8.0.3` → `npm/@tybys/wasm-util@0.10.1` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@tybys/wasm-util@0.10.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm `rolldown` in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package-lock.json → `npm/vite@8.0.3` → `npm/rolldown@1.0.0-rc.12` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/rolldown@1.0.0-rc.12`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Environment variable access: npm `@emnapi/core` reads NODE_ENV Env Vars: NODE_ENV Location: Package overview From: package-lock.json → `npm/vite@8.0.3` → `npm/@emnapi/core@1.9.1` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@emnapi/core@1.9.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Minified code present: npm `@emnapi/core` with 100.0% likelihood Confidence: 1.00 Location: Package overview From: package-lock.json → `npm/vite@8.0.3` → `npm/@emnapi/core@1.9.1` ℹ Read more on: This package \| This alert \| What's wrong with minified code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: In many cases minified code is harmless, however minified code can be used to hide a supply chain attack. Consider not shipping minified code on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@emnapi/core@1.9.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Environment variable access: npm `@emnapi/runtime` reads NODE_ENV Env Vars: NODE_ENV Location: Package overview From: package-lock.json → `npm/vite@8.0.3` → `npm/@emnapi/runtime@1.9.1` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@emnapi/runtime@1.9.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Minified code present: npm `@emnapi/runtime` with 100.0% likelihood Confidence: 1.00 Location: Package overview From: package-lock.json → `npm/vite@8.0.3` → `npm/@emnapi/runtime@1.9.1` ℹ Read more on: This package \| This alert \| What's wrong with minified code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: In many cases minified code is harmless, however minified code can be used to hide a supply chain attack. Consider not shipping minified code on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@emnapi/runtime@1.9.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Environment variable access: npm `@emnapi/wasi-threads` reads NODE_ENV Env Vars: NODE_ENV Location: Package overview From: package-lock.json → `npm/vite@8.0.3` → `npm/@emnapi/wasi-threads@1.2.0` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@emnapi/wasi-threads@1.2.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Minified code present: npm `@emnapi/wasi-threads` with 100.0% likelihood Confidence: 1.00 Location: Package overview From: package-lock.json → `npm/vite@8.0.3` → `npm/@emnapi/wasi-threads@1.2.0` ℹ Read more on: This package \| This alert \| What's wrong with minified code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: In many cases minified code is harmless, however minified code can be used to hide a supply chain attack. Consider not shipping minified code on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@emnapi/wasi-threads@1.2.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: npm `@oxc-project/types` with typescript.rs URLs: typescript.rs Location: Package overview From: package-lock.json → `npm/vite@8.0.3` → `npm/@oxc-project/types@0.122.0` ℹ Read more on: This package \| This alert \| What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@oxc-project/types@0.122.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm `@rolldown/binding-wasm32-wasi` is 90.0% likely to have a medium risk anomaly Notes: The JS loader is not itself executing obvious malicious JavaScript (no eval, no external network calls, no hard-coded credentials). However it intentionally grants a WebAssembly module broad privileges: it passes the full process.env into WASI and the worker, and preopens the host filesystem root so the wasm can access the filesystem. It also forwards worker messages into a filesystem proxy function. These design choices make running an untrusted or tampered-with wasm binary dangerous: a malicious wasm could read environment variables, enumerate and modify host files, and exfiltrate data via any network capability inside the wasm or worker. Therefore the module should be treated as high-risk if the wasm artifact (local file or npm package) is not from a trusted source. Recommended mitigations: avoid preopening the root (limit to specific directories), avoid passing full process.env, validate integrity of the wasm binary (signing/checksums), and avoid installing untrusted package replacements. Confidence: 0.90 Severity: 0.60 From: package-lock.json → `npm/vite@8.0.3` → `npm/@rolldown/binding-wasm32-wasi@1.0.0-rc.12` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@rolldown/binding-wasm32-wasi@1.0.0-rc.12`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm `@rolldown/binding-wasm32-wasi` is 90.0% likely to have a medium risk anomaly Notes: The file itself does not contain overt malicious code (no network calls, no obfuscated payloads, no hardcoded credentials). However, it deliberately exposes powerful capabilities to loaded WASM modules and local scripts: it passes all environment variables into WASI and preopens the filesystem root, and it implements importScripts by reading and eval-ing local files. These choices make the environment capable of data theft or system access if untrusted wasm or scripts are executed. Treat wasm modules and files loaded via importScripts as fully trusted/native — do not run untrusted modules with this loader. Recommend restricting WASI preopens to a minimal directory and avoid passing full process.env, and avoid eval-based importScripts when possible. Confidence: 0.90 Severity: 0.60 From: package-lock.json → `npm/vite@8.0.3` → `npm/@rolldown/binding-wasm32-wasi@1.0.0-rc.12` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@rolldown/binding-wasm32-wasi@1.0.0-rc.12`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Environment variable access: npm `@tybys/wasm-util` reads NODE_ENV Env Vars: NODE_ENV Location: Package overview From: package-lock.json → `npm/vite@8.0.3` → `npm/@tybys/wasm-util@0.10.1` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@tybys/wasm-util@0.10.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Environment variable access: npm `@tybys/wasm-util` reads NODE_DEBUG_NATIVE Env Vars: NODE_DEBUG_NATIVE Location: Package overview From: package-lock.json → `npm/vite@8.0.3` → `npm/@tybys/wasm-util@0.10.1` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@tybys/wasm-util@0.10.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Environment variable access: npm `rolldown` reads NAPI_RS_NATIVE_LIBRARY_PATH Env Vars: NAPI_RS_NATIVE_LIBRARY_PATH Location: Package overview From: package-lock.json → `npm/vite@8.0.3` → `npm/rolldown@1.0.0-rc.12` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/rolldown@1.0.0-rc.12`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Environment variable access: npm `rolldown` Env Vars: NAPI_RS_ENFORCE_VERSION_CHECK Location: Package overview From: package-lock.json → `npm/vite@8.0.3` → `npm/rolldown@1.0.0-rc.12` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/rolldown@1.0.0-rc.12`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Environment variable access: npm `rolldown` reads NAPI_RS_FORCE_WASI Env Vars: NAPI_RS_FORCE_WASI Location: Package overview From: package-lock.json → `npm/vite@8.0.3` → `npm/rolldown@1.0.0-rc.12` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/rolldown@1.0.0-rc.12`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Environment variable access: npm `rolldown` Location: Package overview From: package-lock.json → `npm/vite@8.0.3` → `npm/rolldown@1.0.0-rc.12` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/rolldown@1.0.0-rc.12`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Environment variable access: npm `rolldown` reads NODE_ENV Env Vars: NODE_ENV Location: Package overview From: package-lock.json → `npm/vite@8.0.3` → `npm/rolldown@1.0.0-rc.12` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/rolldown@1.0.0-rc.12`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Environment variable access: npm `rolldown` reads CONSOLA_LEVEL Env Vars: CONSOLA_LEVEL Location: Package overview From: package-lock.json → `npm/vite@8.0.3` → `npm/rolldown@1.0.0-rc.12` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/rolldown@1.0.0-rc.12`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Environment variable access: npm `rolldown` reads ROLLDOWN_TEST Env Vars: ROLLDOWN_TEST Location: Package overview From: package-lock.json → `npm/vite@8.0.3` → `npm/rolldown@1.0.0-rc.12` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/rolldown@1.0.0-rc.12`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
See 1 more row in the dashboard

View full report

guibranco

Automatically approved by gstraccini[bot]

dependabot · 2026-03-23T16:53:42Z

A newer version of vite exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

guibranco · 2026-03-26T12:35:15Z

@dependabot recreate

Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 7.3.1 to 8.0.0. - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/create-vite@8.0.0/packages/vite) --- updated-dependencies: - dependency-name: vite dependency-version: 8.0.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-03-26T12:36:48Z

Infisical secrets check: ✅ No secrets leaked!

💻 Scan logs

2026-03-26T12:36:45Z INF scanning for exposed secrets...
12:36PM INF 540 commits scanned.
2026-03-26T12:36:46Z INF scan completed in 666ms
2026-03-26T12:36:46Z INF no leaks found

sonarqubecloud · 2026-03-26T12:36:54Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

guibranco · 2026-03-26T12:37:27Z

@dependabot recreate

dependabot · 2026-03-26T12:37:39Z

Superseded by #614.

dependabot Bot assigned guibranco Mar 16, 2026

github-actions Bot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Mar 16, 2026

guibranco enabled auto-merge (squash) March 16, 2026 17:05

gstraccini Bot added the ☑️ auto-merge Automatic merging of pull requests (gstraccini-bot) label Mar 16, 2026

gstraccini Bot approved these changes Mar 16, 2026

View reviewed changes

guibranco approved these changes Mar 16, 2026

View reviewed changes

gstraccini Bot added the 🤖 bot Automated processes or integrations label Mar 16, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/vite-8.0.0 branch from 0afe712 to 62657ff Compare March 26, 2026 12:36

github-actions Bot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Mar 26, 2026

dependabot Bot closed this Mar 26, 2026

auto-merge was automatically disabled March 26, 2026 12:37
Pull request was closed

dependabot Bot deleted the dependabot/npm_and_yarn/vite-8.0.0 branch March 26, 2026 12:37

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump vite from 7.3.1 to 8.0.0#593

Bump vite from 7.3.1 to 8.0.0#593
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/vite-8.0.0

dependabot Bot commented on behalf of github Mar 16, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Mar 16, 2026

Uh oh!

deepsource-io Bot commented Mar 16, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Mar 16, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Mar 16, 2026 •

edited

Loading

Uh oh!

guibranco left a comment

Uh oh!

dependabot Bot commented on behalf of github Mar 23, 2026

Uh oh!

guibranco commented Mar 26, 2026

Uh oh!

github-actions Bot commented Mar 26, 2026

Uh oh!

sonarqubecloud Bot commented Mar 26, 2026

Uh oh!

guibranco commented Mar 26, 2026

Uh oh!

dependabot Bot commented on behalf of github Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

create-vite@8.0.0

plugin-legacy@8.0.0

v8.0.0

v8.0.0-beta.18

v8.0.0-beta.17

v8.0.0-beta.16

v8.0.0-beta.15

v8.0.0-beta.14

v8.0.0-beta.13

v8.0.0-beta.12

v8.0.0-beta.11

v8.0.0-beta.10

v8.0.0-beta.9

v8.0.0-beta.8

v8.0.0-beta.7

v8.0.0-beta.6

v8.0.0-beta.5

8.0.0 (2026-03-12)

⚠ BREAKING CHANGES

Features

Uh oh!

dependabot Bot commented on behalf of github Mar 16, 2026

Labels

Uh oh!

deepsource-io Bot commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DeepSource Code Review

PR Report Card

Code Review Summary

Uh oh!

socket-security Bot commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

guibranco left a comment

Choose a reason for hiding this comment

Uh oh!

dependabot Bot commented on behalf of github Mar 23, 2026

Uh oh!

guibranco commented Mar 26, 2026

Uh oh!

github-actions Bot commented Mar 26, 2026

Uh oh!

sonarqubecloud Bot commented Mar 26, 2026

Quality Gate passed

Uh oh!

guibranco commented Mar 26, 2026

Uh oh!

dependabot Bot commented on behalf of github Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Mar 16, 2026 •

edited

Loading

deepsource-io Bot commented Mar 16, 2026 •

edited

Loading

socket-security Bot commented Mar 16, 2026 •

edited

Loading

socket-security Bot commented Mar 16, 2026 •

edited

Loading