Skip to content

Bump vite from 6.4.2 to 7.3.2#2567

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/vite-7.3.2
Closed

Bump vite from 6.4.2 to 7.3.2#2567
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/vite-7.3.2

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 9, 2026 •
edited
Loading

Bumps vite from 6.4.2 to 7.3.2.

Release notes

Sourced from vite's releases.

v7.3.2

Please refer to CHANGELOG.md for details.

v7.3.1

Please refer to CHANGELOG.md for details.

v7.3.0

Please refer to CHANGELOG.md for details.

v7.2.7

Please refer to CHANGELOG.md for details.

v7.2.6

Please refer to CHANGELOG.md for details.

v7.2.5

Please refer to CHANGELOG.md for details.

Note: 7.2.5 failed to publish so it is skipped on npm

v7.2.4

Please refer to CHANGELOG.md for details.

v7.2.3

Please refer to CHANGELOG.md for details.

v7.2.2

Please refer to CHANGELOG.md for details.

plugin-legacy@7.2.1

Please refer to CHANGELOG.md for details.

v7.2.1

Please refer to CHANGELOG.md for details.

plugin-legacy@7.2.0

Please refer to CHANGELOG.md for details.

v7.2.0

Please refer to CHANGELOG.md for details.

v7.2.0-beta.1

Please refer to CHANGELOG.md for details.

v7.2.0-beta.0

Please refer to CHANGELOG.md for details.

v7.1.12

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

7.3.2 (2026-04-06)

Bug Fixes

7.3.1 (2026-01-07)

Features

  • add ignoreOutdatedRequests option to optimizeDeps (#21364) (9d39d37)

7.3.0 (2025-12-15)

Features

  • deps: update esbuild from ^0.25.0 to ^0.27.0 (#21183) (cff26ec)

7.2.7 (2025-12-08)

Bug Fixes

7.2.6 (2025-12-01)

7.2.5 (2025-12-01)

Bug Fixes

Performance Improvements

Documentation

  • clarify manifest.json imports field is JS chunks only (#21136) (46d3077)

Miscellaneous Chores

7.2.4 (2025-11-20)

Bug Fixes

  • revert "perf(deps): replace debug with obug (#21107)" (2d66b7b)

7.2.3 (2025-11-20)

... (truncated)

Commits

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Apr 9, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Apr 9, 2026

Labels

The following labels could not be found: automated. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@cloudflare-workers-and-pages
Copy link
Copy Markdown

cloudflare-workers-and-pages Bot commented Apr 9, 2026 •
edited
Loading

Deploying nodetool-staging with  Cloudflare Pages  Cloudflare Pages

Latest commit: 18e9641
Status:🚫  Build failed.

View logs

@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/vite-7.3.2 branch from 8d15726 to 71e2034 Compare April 10, 2026 15:19
@georgi
Copy link
Copy Markdown
Collaborator

georgi commented Apr 11, 2026

@claude review

@claude
Copy link
Copy Markdown
Contributor

claude Bot commented Apr 11, 2026 •
edited
Loading

Claude finished @georgi's task in 4m 20s —— View job

Vite 6.4.2 → 7.3.2 Upgrade Review

  • Gather context: examine changed files and vite config
  • Check for Vite 7 breaking changes relevant to this codebase
  • Investigate CI failures
  • Provide review summary

Overview

This is a major version bump (6.x → 7.x). While dependabot.yml has ignore: semver-major, dependabot created this PR because v7.3.2 contains security patches. These patches are legitimate and important:

Since these are server.* mitigations, they only apply in dev mode (vite serve), not to production builds.

Config Compatibility ✅

Both web/vite.config.ts and electron/vite.config.ts look compatible with Vite 7:

  • allowedHosts: [".nodetool.ai", "localhost"] — explicitly set, no impact from the Vite 7 default change (web/vite.config.ts:47)
  • rollupOptions with manual chunks and CJS format — Vite 7 still uses Rollup 4, no API changes
  • vite-plugin-electron@0.29.1 — no strict Vite peer dep declared, compatible
  • vite-plugin-svgr@4.5.0 — declares "vite": ">=2.6.0", compatible
  • @vitejs/plugin-react@^4.3.4 — supports Vite 6 and 7

Vite 7 Node.js requirement: 20.19+. CI runs Node 20.20.2 ✓. Need to verify Cloudflare Pages uses ≥ 20.19.

CI Failures Analysis

Both CI workflows are failing, but the failures appear to be pre-existing issues unrelated to the Vite upgrade:

Web Test & Electron Test — failing at "Set up Node.js":

##[error]Some specified paths were not resolved, unable to cache dependencies.

Cause: .github/workflows/test.yml specifies cache-dependency-path: web/package-lock.json, but no web/package-lock.json exists (only the root package-lock.json). This is a pre-existing CI config bug that would fail on any PR touching these paths.
Fix this →

Packages Test — fails with:

Cannot find module '../src/debug-api.js'
imported from packages/websocket/tests/debug-export.test.ts

Cause: The @nodetool/websocket package has a test that imports a compiled .js file (debug-api.js) that doesn't exist because packages aren't built before tests run. All 36 other test files in the package pass. This is also a pre-existing issue.

Cloudflare Pages — build failed. Most likely cause: Cloudflare Pages may be configured with Node.js < 20.19 (Vite 7's minimum). Check the Cloudflare Pages Node.js version setting — it needs to be 20.19+ or 22.12+.

Minor Issues

Missing "automated" label: dependabot.yml references a "automated" label that doesn't exist in the repo, causing the dependabot warning comment. Create this label to fix.

Recommendation

Approve and merge — the Vite config is compatible with v7 and the security patches are valuable. However, before merging:

  1. Verify Cloudflare Pages Node.js version is ≥ 20.19 (update the Cloudflare Pages build config if needed)
  2. The two pre-existing CI failures should be fixed in a separate PR

@georgi Claude
Copy link
Copy Markdown
Collaborator

georgi commented Apr 11, 2026

This is a major version bump (Vite 6 → 7) and should not be merged as a routine dependency update.

Vite 7 includes breaking changes that need careful evaluation and migration work. All CI checks are currently failing (Web Test, Electron Test, Packages Test, Mobile Test).

Recommend closing this PR and handling the Vite 7 migration as a dedicated effort with proper testing and evaluation of breaking changes.

Generated by Claude Code

@dependabot dependabot Bot changed the title build(deps): bump vite from 6.4.2 to 7.3.2 Bump vite from 6.4.2 to 7.3.2 Apr 11, 2026
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/vite-7.3.2 branch 3 times, most recently from 42b893a to e87a64f Compare April 11, 2026 13:34
@dependabot
build(deps): bump vite from 6.4.2 to 7.3.2
18e9641 
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 6.4.2 to 7.3.2.
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v7.3.2/packages/vite)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 7.3.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/vite-7.3.2 branch from e87a64f to 18e9641 Compare April 11, 2026 16:56
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Apr 11, 2026

Looks like vite is up-to-date now, so this is no longer needed.

@dependabot dependabot Bot closed this Apr 11, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/vite-7.3.2 branch April 11, 2026 17:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@georgi