Skip to content

chore(deps): update dependency vite to v8#48

Merged
cbcoutinho merged 1 commit into
mainfrom
renovate/vite-8.x
May 25, 2026
Merged

chore(deps): update dependency vite to v8#48
cbcoutinho merged 1 commit into
mainfrom
renovate/vite-8.x

Conversation

@renovate-bot-cbcoutinho
Copy link
Copy Markdown
Contributor

@renovate-bot-cbcoutinho renovate-bot-cbcoutinho Bot commented Apr 5, 2026 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
vite (source) 7.3.1 → 8.0.14 age adoption passing confidence

Release Notes

vitejs/vite (vite)

v8.0.14

Compare Source

Features
Bug Fixes
Miscellaneous Chores
  • deps: update rolldown-related dependencies (#​22470) (7cb728e)
  • remove irrelevant commits from changelog (2c69495)
Code Refactoring
Tests

v8.0.13

Compare Source

Features
Bug Fixes
Miscellaneous Chores

v8.0.12

Compare Source

Features
Bug Fixes
  • deps: update all non-major dependencies (#​22420) (2be6000)
  • module-runner: prevent partial-exports race on concurrent imports of in-flight invalidated re-export chains (#​22369) (f5a22e6)
  • refer to rolldownOptions instead of deprecated rollupOptions in messages (#​22400) (b675c7b)
  • worker: apply build.target to worker bundle (#​22404) (3c93fde)
  • worker: forward define to worker bundle transform (#​22408) (d4838a0)
Miscellaneous Chores

v8.0.11

Compare Source

Features
Bug Fixes
Documentation
Miscellaneous Chores
Code Refactoring
Tests

v8.0.10

Compare Source

Features
Bug Fixes
  • hmrClient.logger.debug and hmrClient.logger.error looked different from other HMR logs (#​22147) (a4d828f)
  • css: show filename in CSS minification warnings for .css?inline (#​22292) (83f0a78)
  • optimizer: allow user transform.target to override default in optimizeDeps (#​22273) (5c7cec6)
  • remove format sniffing module resolution from JS resolver (#​22297) (b8a21cc)
Code Refactoring

v8.0.9

Compare Source

Features
Bug Fixes
Documentation
Miscellaneous Chores

v8.0.8

Compare Source

Features
Bug Fixes

v8.0.7

Compare Source

Bug Fixes
  • use sync dns.getDefaultResultOrder instead of dns.promises (#​22185) (5c05b04)

v8.0.6

Compare Source

Features
Bug Fixes
Performance Improvements
  • early return in getLocalhostAddressIfDiffersFromDNS when DNS order is verbatim (#​22151) (56ec256)
Miscellaneous Chores

v8.0.5

Compare Source

Bug Fixes

v8.0.4

Compare Source

Features
Bug Fixes
Documentation
Miscellaneous Chores
Code Refactoring

v8.0.3

Compare Source

Features
Bug Fixes
  • html: cache unfiltered CSS list to prevent missing styles across entries (#​22017) (5464190)
  • module-runner: handle non-ascii characters in base64 sourcemaps (#​21985) (77c95bf)
  • module-runner: skip re-import if the runner is closed (#​22020) (ee2c2cd)
  • optimizer: scan is not resolving sub path import if used in a glob import (#​22018) (ddfe20d)
  • ssr: ssrTransform incorrectly rewrites meta identifier inside import.meta when a binding named meta exists (#​22019) (cff5f0c)
Miscellaneous Chores
Tests

v8.0.2

Compare Source

Features
Bug Fixes
Miscellaneous Chores

v8.0.1

Compare Source

Features
Bug Fixes
Miscellaneous Chores
  • deps: update rolldown-related dependencies (#​22470) (7cb728e)
  • remove irrelevant commits from changelog (2c69495)
Code Refactoring
Tests

v8.0.0

Compare Source

Vite 8 is here!

Today, we're thrilled to announce the release of the next Vite major:

⚠ BREAKING CHANGES
Features
Bug Fixes
Performance Improvements
Documentation
Miscellaneous Chores
Code Refactoring
  • don't add optimization.inlineConst: { mode: 'smart' } as it's enabled by default ([#&

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

@claude
Copy link
Copy Markdown

claude Bot commented Apr 5, 2026 •
edited
Loading

Claude finished @renovate-bot-cbcoutinho[bot]'s task in 2m 3s —— View job

PR Review: chore(deps): update dependency vite to v8

  • Gathering context and reading repo files
  • Analyzing Vite 8 compatibility
  • Reviewing lockfile changes
  • Checking CI status
  • Posting final review

Summary

This is a clean Renovate-managed major version bump: vite 7.3.1 → 8.0.14 (the PR metadata says 8.0.13, but the branch has since been updated to 8.0.14). Changes are confined to package.json and package-lock.json — no application or config code changes. This looks safe to merge pending E2E results.

Vite 8 Architecture Change: Rolldown is now stable

The headline change in Vite 8 is the rolldown-vite merge: Rollup is replaced by rolldown as the production bundler. Previous reviews of this PR flagged rolldown's RC status as a risk — that concern is now resolved: the lockfile bundles rolldown 1.0.2, a stable release.

Lockfile impact (expected and healthy):

  • All 16 @esbuild/* platform binaries removed (−700+ lines)
  • rolldown@1.0.2 and @rolldown/* platform binaries added
  • lightningcss@1.32.0 added (now a first-party Vite dependency)
  • Net reduction: 724 deletions, 529 additions

Compatibility Assessment

Check Status Notes
rollupOptions in vite.config.js ✅ rolldown provides rollup API compatibility layer
minify: 'terser' ✅ Still supported; terser@5.46.1 is pinned as devDep
cssCodeSplit: false + assetFileNames ✅ CSS pipeline unchanged; lightningcss is bundled but doesn't affect this
@vitejs/plugin-vue@6.0.5 ✅ peerDeps explicitly include ^8.0.0
Node engine constraint ✅ Vite 8 requires ^20.19.0 || >=22.12.0; project requires ^24.0.0
sourcemap: true ✅ rolldown source maps are supported
Default browser target change ✅ Low risk Overridden via @nextcloud/browserslist-config

One thing worth knowing (vite.config.js:7): __dirname is a CJS global used in an ESM file ("type": "module" in package.json). Vite has always shimmed this in config files and continues to do so in Vite 8 — no change needed, but if you ever see a __dirname is not defined error in the future, the fix is:

import { fileURLToPath } from 'url'
import { dirname } from 'path'
const __dirname = dirname(fileURLToPath(import.meta.url))

CI Status

Check Status
CI (build, lint, PHP) ✅ Passed
E2E Tests ⏳ In progress
SonarQube Cloud ✅ Quality gate passed

Recommendation: Wait for E2E to complete before merging — it's the primary signal for a build tool upgrade. If it passes, this is ready to go.

Overall Assessment

The vite.config.js is straightforward and uses no obscure APIs likely to break in Vite 8. The plugin ecosystem (@vitejs/plugin-vue) is confirmed compatible. The rolldown RC risk flagged in earlier reviews of this PR is resolved — rolldown 1.0.2 is stable. Once E2E passes, this is a clean upgrade.

@claude
Copy link
Copy Markdown

claude Bot commented Apr 7, 2026

Code Review: Update dependency vite to v8

This is an automated Renovate PR bumping Vite from 7.2.7 → 8.0.3 — a major version upgrade. Here's my analysis:

Summary

The changes are confined to package.json and package-lock.json, which is correct for a dependency-only update. The most significant change in Vite 8 is the replacement of esbuild with Rolldown as the bundler (the "epic rolldown-vite merge"). This is reflected in the lockfile: all @esbuild/* platform-specific packages are removed, resulting in a net reduction (695 deletions, 503 additions).

Vite Config Compatibility

Checking vite.config.js against Vite 8's breaking changes:

Good news — the config is well-positioned:

  • minify: 'terser' explicitly uses Terser, so there's no dependency on esbuild for minification. This is the safest choice for a Vite 8 upgrade.
  • rollupOptions (input/output configuration) is retained in Vite 8 via Rolldown's rollup-compatible API, so the multi-entry setup should work as-is.
  • No esbuild: option is set in the config, so there's nothing to migrate there.

Worth verifying:

  • @vitejs/plugin-vue@6.0.5 was not updated alongside Vite. This plugin's peer dependencies typically track the Vite major version (v5→Vite5/6, v6→Vite7). The Node.js build CI passing suggests it's functionally compatible, but you may want to check whether a @vitejs/plugin-vue@7.x exists and is needed for full Vite 8 support.
  • Default browser target change (#21193): Vite 8 updated its default browser targets. The project uses @nextcloud/browserslist-config which controls what Nextcloud supports — verify the build output targets haven't regressed unexpectedly.
  • import.meta.hot.accept resolution fallback removed: If any modules use HMR with relative path strings in accept(), they may silently break in dev mode. Low risk for a Nextcloud app, but worth a quick check of src/ HMR usage.

CI Status

All CI checks are passing:

  • Node.js build ✅
  • ESLint ✅
  • Stylelint ✅
  • PHP CS Fixer / Psalm / PHPUnit ✅

The e2e check appears to still be pending/not yet run — this is the most important gate for a build tool upgrade, as it validates the actual built output loads correctly in a browser. I'd recommend confirming e2e passes before merging.

Overall Assessment

The project's vite config is clean and avoids the most common Vite 8 migration pitfalls (no esbuild-specific options, explicit Terser minification, rollup-compatible output config). The lockfile shrinkage from removing @esbuild/* packages is expected and healthy. Once e2e results are in, this looks safe to merge.

🤖 Generated with Claude Code

@renovate-bot-cbcoutinho renovate-bot-cbcoutinho Bot changed the title Update dependency vite to v8 chore(deps): update dependency vite to v8 Apr 7, 2026
@claude
Copy link
Copy Markdown

claude Bot commented Apr 7, 2026

Automated Code Review

This is a Vite major version upgrade (v7.3.1 → v8.0.3) from Renovate. Here's my analysis:

Summary

The diff is almost entirely lockfile changes. The meaningful changes are:

  • package.json: vite bumped from 7.3.1 to 8.0.3
  • package-lock.json: All @esbuild/* platform-specific packages removed; replaced by rolldown-based packages

Key Observations

Vite 8 is a significant architectural shift. The primary change is that Vite 8 replaces esbuild with rolldown (a Rust-based Rollup-compatible bundler) as the underlying build engine. This is why 448 lines are removed from the lockfile — all the @esbuild/* optional platform packages disappear.

CI is the right gate here. For a build-tool major bump with no application code changes, passing CI is the main signal. At review time, the following are still in progress:

  • Node.js build — this is the critical one; it will validate that vite build completes successfully with rolldown
  • E2E Tests — will validate runtime behaviour of the built output

Linting (ESLint, Stylelint, PHP CS Fixer, Psalm) and PHPUnit tests are already passing.

@vitejs/plugin-vue compatibility: The project uses @vitejs/plugin-vue@6.0.5. The v6.x plugin targets Vite 5+ and should be compatible with Vite 8, but the Node.js build check will confirm this.

Lockfile project version: The lockfile shows the project version as 0.13.6 while this PR was presumably opened against 0.13.2. This is benign — Renovate rebased onto newer commits.

Recommendation

✅ Approach is correct — this is a clean, minimal upgrade with no application code changes.

⏳ Hold until CI completes. The Node.js build and E2E Tests checks are the critical validators for a build tool upgrade. If they pass, this PR is safe to merge. If either fails, the rolldown migration in Vite 8 may require a config tweak in vite.config.*.

No code quality, security, or best-practice concerns with the changes themselves.

@claude
Copy link
Copy Markdown

claude Bot commented Apr 9, 2026

Automated Review: vite 7.3.1 → 8.0.4

This is a Renovate-generated major-version bump. Here's my assessment:

CI Status

The E2E tests are failing on this PR while the Node.js build, ESLint, Stylelint, and all PHP checks pass. Before merging, the E2E failures need to be investigated — they may point to a runtime behavior change introduced by Vite 8.

Key Consideration: Vite 8 and rolldown

The headline change in Vite 8 is the rolldown merge (#21189) — Vite now uses rolldown (a Rust-based bundler) in place of rollup internally. Rolldown aims for rollup API compatibility, so rollupOptions in vite.config.js should still work, but there can be subtle behavioral differences in output (tree-shaking, chunk splitting, module ordering) that may not surface until E2E.

vite.config.js — no changes needed, but a few things to verify

The config uses patterns that should still work in Vite 8, but are worth explicitly validating given the major version:

  1. minify: 'terser' — terser minification is still supported in Vite 8. Vite's own bundler (rolldown) includes a built-in minifier, but explicitly specifying 'terser' continues to work. No change needed, just confirming intent.

  2. __dirname in an ESM config — package.json has "type": "module", so vite.config.js is treated as ESM. __dirname is a CJS global not available in native ESM, but Vite has historically shim'd it in config files. This has worked fine up to Vite 7 and should continue to in Vite 8 — but if you ever see __dirname is not defined errors, replace with:

    import { fileURLToPath } from 'url'
import { dirname } from 'path'
const __dirname = dirname(fileURLToPath(import.meta.url))

  3. Default browser target change — Vite 8 updates the default build.target (#21193). This project doesn't set a build.target, so it will silently inherit the new default. The project uses "extends @nextcloud/browserslist-config" for browserslist but doesn't wire it into Vite's build.target. This is pre-existing and likely fine, but worth knowing.

  4. @vitejs/plugin-vue at 6.0.5 — This version should be compatible with Vite 8.

Summary

Check Status
Build ✅ Passes
Lint (ESLint / Stylelint) ✅ Passes
PHP tests ✅ Passes
E2E tests ❌ Failing — needs investigation

Recommendation: Do not merge until the E2E failures are diagnosed. The failure may be a pre-existing flake unrelated to this bump, or it may reveal a real incompatibility with Vite 8's rolldown bundler. Check the E2E job logs to determine which.

If the E2E failures turn out to be pre-existing/flaky and unrelated to this change, the upgrade looks straightforward.

@claude
Copy link
Copy Markdown

claude Bot commented Apr 9, 2026

PR Review: Vite 7 → 8 Major Version Upgrade

This is an automated Renovate PR upgrading Vite from 7.3.1 to 8.0.5. Here's my analysis:

✅ Reasons to Merge

  • Security fixes land in this upgrade: Vite 8.0.5 patches a path traversal vulnerability in the optimize-deps sourcemap handler and adds server.fs checks to the env transport endpoint. These are meaningful security improvements.
  • Package hygiene: The lock file becomes smaller (−703 / +505 lines) as esbuild's many platform-specific binaries are replaced by Rolldown's self-contained Rust binary.

⚠️ Key Concerns

1. Rolldown is still a Release Candidate

The most significant change in Vite 8 is that Rollup is replaced by Rolldown (a Rust-based Rollup rewrite). The version pulled in is rolldown@1.0.0-rc.12 — a release candidate, not a stable release.

For a Nextcloud app shipped to users, a pre-stable bundler is a meaningful risk. RC software can have edge-case bugs in tree-shaking, code splitting, or output correctness that are hard to catch without exhaustive testing. The Vite team has put significant effort into compatibility, but this warrants extra verification.

Recommendation: Manually inspect the built .mjs artifacts (run npm run build locally) and compare bundle sizes and correctness against the Vite 7 output before merging.

2. Vite Config Compatibility

vite.config.js should be reviewed for compatibility with Vite 8. Specific things to verify:

  • @vitejs/plugin-vue: Check that the installed version supports Vite 8. Vite 8 ships with a new plugin API based on Rolldown hooks; plugins using Rollup-specific internal APIs may misbehave silently.
  • terser minification (build.minify: 'terser'): Terser is no longer bundled with Vite 8 by default and is listed as a dev dependency here — that's correct. Verify the Terser minification step still produces expected output.
  • cssCodeSplit: false + Sass: Vite 8 bundles LightningCSS. While it doesn't replace PostCSS/Sass by default, there may be changes to how CSS is processed during the Rolldown pipeline. Run a build and confirm .css output is correct.

3. No Unit Tests — Build Output Is the Main Verification Signal

The project relies on Playwright E2E tests against a live Nextcloud Docker stack. These are the right tests for this kind of change, but they require the Docker infrastructure to be spun up. Confirm the CI pipeline actually runs test:e2e for this PR (not just lint/type-check), since a broken build could still produce a syntactically valid but functionally broken bundle.

📋 Suggested Checklist Before Merging

  • Run npm run build and confirm no warnings/errors from Rolldown
  • Compare built bundle sizes against a Vite 7 baseline (unexpected size regressions can indicate tree-shaking issues)
  • Confirm E2E tests pass end-to-end against the Nextcloud Docker stack
  • Verify @vitejs/plugin-vue version is compatible with Vite 8 (check its changelog/peer deps)

Summary

This is a worthwhile upgrade given the security patches, but the Rolldown RC dependency introduces non-trivial risk for a production app. I'd hold on merging until CI passes the full E2E suite and the built output has been manually spot-checked.

Review generated by Claude Sonnet 4.6

@claude
Copy link
Copy Markdown

claude Bot commented Apr 10, 2026

PR Review: chore(deps): update dependency vite to v8

Overall this is a clean Renovate-managed dependency bump. A few things worth noting before merging:

Summary of Changes

  • Vite 7.3.1 → 8.0.7
  • Bundler swap: rollup 4.x is replaced by rolldown 1.0.0-rc.13 (Rust-based reimplementation of rollup)
  • esbuild removed as a bundled dep — now an optional peer dep, which strips ~448 lines from package-lock.json
  • lightningcss 1.32.0 added (was previously an optional peer dep)

Potential Concerns

1. rolldown is still in release-candidate stage

Vite 8 migrates to rolldown as the bundler, which is still at 1.0.0-rc.13. While rolldown aims for rollup API compatibility, RC software can have subtle behavioral differences from stable rollup 4.x. There is some risk of:

  • Different tree-shaking or chunk-splitting behavior
  • Edge cases in the assetFileNames callback in vite.config.js
  • Different handling of the multiple entry points (astrolabe-main, astrolabe-adminSettings, astrolabe-personalSettings)

Recommendation: Manually verify the build output by running npm run build and confirming that:

  • js/astrolabe-main.mjs, js/astrolabe-adminSettings.mjs, and js/astrolabe-personalSettings.mjs are generated
  • css/astrolabe-main.css is generated (as a single file, since cssCodeSplit: false)
  • Source maps are present

2. minify: 'terser' — still correct, but worth knowing

Vite 8 ships rolldown's native minifier (faster). The current config explicitly requests minify: 'terser', which is still supported — and terser is correctly listed as a devDependency, so this won't break. No action needed, but you could consider switching to the default ('rolldown-esbuild') for faster builds in a follow-up.

3. rollupOptions key preserved

Vite 8 supports the rollupOptions key for backward compatibility with rolldown. The current vite.config.js uses this without issue.

No Concerns

  • No application source code changed — this is purely a dependency/lock file update.
  • The explicit terser devDependency means minify: 'terser' works correctly (Vite 8 no longer bundles esbuild by default, so a standalone minifier must be provided).
  • Browserslist-based CSS targeting via @nextcloud/browserslist-config should continue to work with lightningcss.

Verdict

Safe to merge after verifying the production build output. The rolldown RC is the only meaningful risk here — if CI runs npm run build and the output files are correct, this is good to go.

@claude
Copy link
Copy Markdown

claude Bot commented Apr 13, 2026

Dependency Update Review: vite 7.3.1 → 8.0.8

This is a Renovate-generated major version bump. The change is limited to package.json and package-lock.json, which is appropriate for a dependency update. Here's what's worth knowing before merging:

Architecture Change: Rollup → Rolldown

The biggest change in Vite 8 is the replacement of rollup with rolldown as the production bundler. This is reflected in the lockfile:

  • node_modules/rollup (4.53.3) removed
  • node_modules/rolldown (1.0.0-rc.15) added
  • All @rollup/rollup-* platform binaries removed
  • All @rolldown/binding-* platform binaries added

Risk: rolldown is still at 1.0.0-rc.15 — a release candidate, not a stable release. While Vite 8 ships with it as the default bundler, there's inherent risk in depending on an RC-stage bundler for production builds. The Vite team is aware of this and the announcement explicitly notes this is the rolldown-vite merge milestone.

esbuild → LightningCSS

  • esbuild (and all @esbuild/* platform binaries) removed as a bundled dependency
  • lightningcss (1.32.0) added as a bundled dependency
  • esbuild is now an optional peer dependency

If the vite config uses any esbuild-specific options (e.g. optimizeDeps.esbuildOptions, build.esbuildOptions, or esbuild transform plugin), those may need adjustment. Worth checking vite.config.ts.

Vite 8 Breaking Changes to Assess

From the release notes, these breaking changes may be relevant:

  1. import.meta.hot.accept resolution fallback removed — if any modules use the old non-standard fallback behavior for HMR accept, they'll need to be updated to use the standard API.
  2. Default browser targets updated — the default build.target has changed. If the app relies on implicit defaults rather than an explicit target in vite.config.ts, output compatibility may differ.

What Looks Good

  • package.json change is minimal and correct — only the vite version pin is updated.
  • @vitejs/plugin-vue (6.0.5) is listed as compatible with Vite 8 based on its peer dependency range.
  • terser remains pinned in devDependencies, so minification behavior should be unchanged.
  • picomatch 4.0.3 → 4.0.4 is a safe patch bump.
  • @emnapi/* 1.9.1 → 1.9.2 are patch bumps for optional WASM support packages.

Suggested Pre-Merge Checks

  • Verify npm run build completes without errors or unexpected warnings
  • Spot-check the production build output for correctness (bundle sizes, asset hashing, etc.)
  • Confirm npm run dev HMR still works as expected
  • Review vite.config.ts for any esbuild-specific or rollup-specific options that may need updating

The lockfile package version bump (0.13.2 → 0.13.8) is just the version captured in the lockfile snapshot at install time — not a concern.

Overall this looks like a well-formed dependency update. The main flag is the rolldown RC status — worth monitoring the Vite 8.x patch releases if any build issues emerge post-merge.

@claude
Copy link
Copy Markdown

claude Bot commented Apr 24, 2026

Code Review: chore(deps): update dependency vite to v8

Overview

This is a Renovate-managed major version bump of Vite from 7.3.1 → 8.0.9. Only package.json and package-lock.json are modified — no application or config code changes.

What Changed Under the Hood

The most significant change in Vite 8 is the replacement of esbuild with rolldown (a Rust-based bundler) as the default bundler. This is reflected in the lockfile: all @esbuild/* platform-specific packages are removed (~450 lines of lockfile deletions), and the @emnapi/* packages (rolldown dependencies) are updated.

Compatibility Assessment

vite.config.js looks compatible with Vite 8:

  • minify: 'terser' — Terser is still supported in Vite 8. The new default is rolldown's built-in oxc-based minifier, but explicitly specifying 'terser' will continue to work since terser is pinned as a dev dependency.
  • rollupOptions — rolldown is designed to be API-compatible with Rollup 4, so the existing input/output/entryFileNames/chunkFileNames/assetFileNames configuration should transfer without changes.
  • @vitejs/plugin-vue 6.0.5 — Compatible with Vite 8 (plugin-vue 6.x targets Vite 6+/8).
  • cssCodeSplit: false — Still supported.
  • Node.js engine constraint (^24.0.0) already satisfies Vite 8's minimum requirement (Node 20.19+ or 22+).

CI Status (at review time)

Check Status
ESLint ✅ Success
Stylelint ✅ Success
PHP CS Fixer ✅ Success
Psalm ✅ Success
PHPUnit (8.1 / 8.2 / 8.3) ✅ Success
renovate/stability-days ✅ Success
Node.js build ⏳ In Progress
E2E tests ⏳ In Progress

The build and E2E tests are still running — the green light on those is what matters most before merging.

Potential Risks

  1. Build output may differ subtly. rolldown and esbuild have different code-generation strategies. Chunk splitting, tree-shaking behavior, and output file sizes could vary slightly. The E2E test suite should catch any functional regressions.

  2. rolldown is still RC. The lockfile shows rolldown at 1.0.0-rc.16. It has been stable enough for Vite to ship as default, but worth noting it is not yet at a final 1.0 release.

  3. No breaking changes in vite.config.js needed — the configuration is straightforward enough that no migrations are required for this project.

Verdict

This PR looks good from a code perspective. The lockfile changes are consistent and expected for this upgrade. Recommend merging once the Node.js build and E2E jobs pass successfully.

@claude
Copy link
Copy Markdown

claude Bot commented Apr 27, 2026

Code Review: chore(deps): update dependency vite to v8

Overview

This PR upgrades Vite from 7.3.1 to 8.0.10 — a major version bump generated by Renovate. The diff is almost entirely package-lock.json churn (525 additions, 722 deletions), with the only meaningful package.json change being the version pin itself.

Key Change: Bundler Swap (esbuild to rolldown)

The most significant architectural change in Vite 8 is the rolldown-vite merge: Vite's bundler core was replaced from esbuild/rollup with rolldown (a Rust-based bundler). This explains the bulk of the lock file diff:

  • Removed: 16 @esbuild/* platform-specific binary packages
  • Added: @rolldown/* platform binaries + lightningcss for CSS processing
  • rolldown version: 1.0.0-rc.17 — still a release candidate, not stable

This is a meaningful risk to flag: production builds will now be processed by a pre-1.0 bundler. Rolldown is designed for rollup API compatibility, but subtle behavioral differences (tree-shaking, chunk splitting, source maps) are possible.

Breaking Changes — Impact Assessment

Vite 8 has three listed breaking changes:

Breaking Change Impact on This Project
import.meta.hot.accept resolution fallback removed No impact — no usage found in src/
Updated default browser target Low risk — overridden by @nextcloud/browserslist-config in package.json
rolldown-vite merge Medium risk — see bundler swap discussion above

Config Compatibility (vite.config.js)

The existing config should be compatible with Vite 8:

  • rollupOptions with custom entry points and output patterns: rolldown provides a rollup API compatibility layer — these settings should be preserved
  • minify: 'terser': still supported in Vite 8 (terser remains a first-class minifier option)
  • cssCodeSplit: false + custom assetFileNames: this is the area most worth smoke-testing, as lightningcss now handles CSS processing in Vite 8's pipeline
  • @vitejs/plugin-vue 6.0.5: confirmed Vite 8 compatible (peerDependencies includes ^8.0.0)

Observations

  • Lock file version drift: The diff shows the app version changing from 0.13.2 to 0.13.10 inside package-lock.json. This indicates the Renovate branch was cut when the repo was at 0.13.2 and has not been rebased since. This is cosmetic (it does not affect the dependency upgrade) but worth noting if rebase hygiene matters.
  • Net dependency reduction: Removing all @esbuild/* binaries and replacing them with the rolldown equivalents results in a smaller total lock file, which is a positive outcome.

Suggestions

  1. Run the build locally before merging (npm run build) and verify the output in js/ and css/ matches expectations — particularly that css/astrolabe-main.css is still generated correctly given the new lightningcss pipeline.
  2. Check source maps: The config has sourcemap: true; confirm source maps are still generated correctly with rolldown.
  3. Consider rebasing the branch onto current main to resolve the version drift in the lock file before merging.

Overall this looks like a reasonable upgrade to take. The config is clean and does not use any obscure Vite APIs that would be expected to break. The main validation needed is a build smoke test given the bundler swap.

@renovate-bot-cbcoutinho renovate-bot-cbcoutinho Bot force-pushed the renovate/vite-8.x branch 2 times, most recently from 1d622d4 to b3adb54 Compare May 15, 2026 04:02
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud Bot commented May 24, 2026

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@cbcoutinho cbcoutinho merged commit ee190a1 into main May 25, 2026
14 checks passed
@renovate-bot-cbcoutinho renovate-bot-cbcoutinho Bot deleted the renovate/vite-8.x branch May 25, 2026 15:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@cbcoutinho cbcoutinho

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@cbcoutinho