Bump vite and @vitejs/plugin-react-swc in /bwell-typescript-react#192
Bump vite and @vitejs/plugin-react-swc in /bwell-typescript-react#192dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) and [@vitejs/plugin-react-swc](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react-swc). These dependencies needed to be updated together. Updates `vite` from 7.1.11 to 8.1.5 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.1.5/packages/vite) Updates `@vitejs/plugin-react-swc` from 3.10.2 to 4.3.1 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react-swc/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/v4.3.1/packages/plugin-react-swc) --- updated-dependencies: - dependency-name: vite dependency-version: 8.1.5 dependency-type: direct:development - dependency-name: "@vitejs/plugin-react-swc" dependency-version: 4.3.1 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
Major
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
This is a major-version bump of the primary build tool (Vite 7 → 8, plugin-react-swc 3 → 4), which changes Vite's internals substantially (Rollup → Rolldown, esbuild/lightningcss handling) — worth a quick sanity build/dev-server check by a human before merging, even though the diff itself is just package.json/package-lock.json.
Extended reasoning...
Overview
The PR only touches bwell-typescript-react/package.json and package-lock.json, bumping vite from 7.1.11 to 8.1.5 and @vitejs/plugin-react-swc from 3.10.2 to 4.3.1 (a Dependabot grouped major bump). No application source files or vite.config.ts were changed.
Security risks
None identified. Both packages are dev-only build tooling (not shipped to production runtime), and the lockfile updates are standard transitive dependency changes from the new major versions (e.g. rolldown, lightningcss, swc core bumps). No injection, auth, or data-exposure surface here.
Level of scrutiny
This is flagged as a Major dependency bump for good reason: Vite 8 changes its internal bundler stack (Rollup → Rolldown) and CSS handling (esbuild → lightningcss as a direct dependency), and @vitejs/plugin-react-swc 4.x requires Vite 4-8 and Node 20.19+/22.12+. The existing vite.config.ts is minimal (just the react plugin and a path alias) with no esbuild- or lightningcss-specific options, so config-level incompatibility is unlikely. Still, major bundler version bumps can surface build/dev-server behavior changes that aren't visible from the diff alone, so I'd rather a human confirm the build/dev server actually run cleanly rather than rubber-stamp it.
Other factors
No CODEOWNERS or security-sensitive code is touched. There are no other reviewer comments on this PR. The main risk is build-time breakage rather than logic or security bugs, which is outside what static diff review can confirm.
Bumps vite and @vitejs/plugin-react-swc. These dependencies needed to be updated together.
Updates
vitefrom 7.1.11 to 8.1.5Release notes
Sourced from vite's releases.
... (truncated)
Changelog
Sourced from vite's changelog.
... (truncated)
Commits
5e7fe12release: v8.1.56c08c39fix(optimizer): respect importer module format for dynamic import interop wit...5a72b87fix(client): overlay error message format align rolldown (#22869)f8b38e3fix(module-runner): don't crash stack-trace source mapping when globalThis.Bu...8100320fix(bundled-dev): avoid duplicatedbuildEnd(#22931)c88c236docs(build): fix incorrect@defaultfor build.cssMinify (#22948)b59a73ffix(ssr): scope switch-case declarations to the switch, not the function (#22...fef682dfix(deps): update all non-major dependencies (#22921)3c345e4fix(deps): update rolldown-related dependencies (#22922)369ed60docs(build): fix incorrect@defaultfor build.lib.formats (#22911)Updates
@vitejs/plugin-react-swcfrom 3.10.2 to 4.3.1Release notes
Sourced from @vitejs/plugin-react-swc's releases.
... (truncated)
Changelog
Sourced from @vitejs/plugin-react-swc's changelog.
... (truncated)
Commits
Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@vitejs/plugin-react-swcsince your current version.Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.